Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-18192 State: PUBLISHED Published: 2019-10-17T19:06:48 Last Updated: 2024-08-05T01:47:13.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365. Additional Analyst Notes: - CVE Program Container: References: - https://issues.guix.gnu.org/issue/37744 - http://www.openwall.com/lists/oss-security/2019/10/17/3
CVE ID: CVE-2019-18193 State: PUBLISHED Published: 2020-02-03T13:30:16 Last Updated: 2024-08-05T01:47:13.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4.0.027.13, 4.0.125 and 5.0.013.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.unisys.com/offerings/security-solutions/unisys-stealth-products-and-services - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=52
CVE ID: CVE-2019-18194 State: PUBLISHED Published: 2020-01-10T17:26:29 Last Updated: 2024-08-05T01:47:13.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder. Additional Analyst Notes: - CVE Program Container: References: - https://bogner.sh/2017/11/avgater-getting-local-admin-by-abusing-the-anti-virus-quarantine/ - https://www.youtube.com/watch?v=88qeaLq98Gc
CVE ID: CVE-2019-18195 State: PUBLISHED Published: 2019-10-28T13:55:04 Last Updated: 2024-08-05T01:47:13.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TerraMaster FS-210 4.0.19 devices. Normal users can use 1.user.php for privilege elevation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gusrmsdlrh/CVE-2019-18195
CVE ID: CVE-2019-18196 State: PUBLISHED Published: 2019-10-24T15:51:29 Last Updated: 2024-08-05T01:47:13.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in 13.2.36216), and 14.6.4835 (fixed in 14.7.1965) on Windows could allow an attacker to perform code execution on a target system via a service restart where the DLL was previously installed with administrative privileges. Exploitation requires that an attacker be able to create a new file in the TeamViewer application directory; directory permissions r
requires that an attacker be able to create a new file in the TeamViewer application directory; directory permissions restrict that by default. Additional Analyst Notes: - CVE Program Container: References: - https://community.teamviewer.com/t5/Announcements/Security-bulletin-CVE-2019-18196/td-p/74564 - https://safebreach.com/Post/TeamViewer-Windows-Client-v11-to-v14-DLL-Preloading-and-Potential-Abuses-CVE-2019-18196
CVE ID: CVE-2019-18197 State: PUBLISHED Published: 2019-10-18T20:07:17 Last Updated: 2024-08-05T01:47:13.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914 - https://bu
mmit/2232473733b7313d67de8836ea3b29eec6e8e285 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746 - https://usn.ubuntu.com/4164-1/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html - https://security.netapp.com/advisory/ntap-20191031-0004/ - http://www.openwall.com/lists/oss-security/2019/11/17/2 - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html - https://access.redhat.com/errata/RHSA-2020:0514 - http://lists.opensuse.org/opensuse-security
ce/2020-02/msg00015.html - https://access.redhat.com/errata/RHSA-2020:0514 - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html - https://www.oracle.com/security-alerts/cpuapr2020.html - https://security.netapp.com/advisory/ntap-20200416-0004/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html
CVE ID: CVE-2019-18198 State: PUBLISHED Published: 2019-10-18T21:07:19 Last Updated: 2024-08-05T01:47:13.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/ca7a03c4175366a92cee0ccc4fec0038c3266e26 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca7a03c4175366a92cee0ccc4fec0
c0038c3266e26 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca7a03c4175366a92cee0ccc4fec0038c3266e26 - https://launchpad.net/bugs/1847478 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4 - https://usn.ubuntu.com/4161-1/ - https://security.netapp.com/advisory/ntap-20191031-0005/
CVE ID: CVE-2019-18199 State: PUBLISHED Published: 2019-10-24T13:48:56 Last Updated: 2024-08-05T01:47:13.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of password-based authentication, they are vulnerable to replay attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-009.txt - http://packetstormsecurity.com/files/154954/Fujitsu-Wireless-Keyboard-Set-LX390-Replay-Attacks.html - https://www.syss.de/pentest-blog/2019/syss-2019-0
files/154954/Fujitsu-Wireless-Keyboard-Set-LX390-Replay-Attacks.html - https://www.syss.de/pentest-blog/2019/syss-2019-009-syss-2019-010-und-syss-2019-011-schwachstellen-in-weiterer-funktastatur-mit-sicherer-24-ghz-technologie/
CVE ID: CVE-2019-18200 State: PUBLISHED Published: 2019-10-24T14:10:28 Last Updated: 2024-08-05T01:47:13.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, they are prone to keystroke injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-011.txt - http://packetstormsecurity.com/files/154956/Fujitsu-Wireless-Keyboard-Set-LX390-Keystroke-Injection.html - https://www.syss.de/pentest-blog/2019/syss-2019-009-syss-2019-010-und-syss-2019-01
-Set-LX390-Keystroke-Injection.html - https://www.syss.de/pentest-blog/2019/syss-2019-009-syss-2019-010-und-syss-2019-011-schwachstellen-in-weiterer-funktastatur-mit-sicherer-24-ghz-technologie/
CVE ID: CVE-2019-18201 State: PUBLISHED Published: 2019-10-24T14:19:01 Last Updated: 2024-08-05T01:47:13.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is able to eavesdrop on sensitive data such as passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-010.txt - http://packetstormsecurity.com/files/154955/Fujitsu-Wireless-Keyboard-Set-LX390-Missing-Encryption.html - https://www.syss.de/pentest-blog/2019/syss-2019-009-syss-201
jitsu-Wireless-Keyboard-Set-LX390-Missing-Encryption.html - https://www.syss.de/pentest-blog/2019/syss-2019-009-syss-2019-010-und-syss-2019-011-schwachstellen-in-weiterer-funktastatur-mit-sicherer-24-ghz-technologie/
CVE ID: CVE-2019-18202 State: PUBLISHED Published: 2019-10-19T00:02:03 Last Updated: 2024-08-05T01:47:13.649Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/de-de/advisories/vde-2019-017
CVE ID: CVE-2019-18203 State: PUBLISHED Published: 2019-10-21T17:35:31 Last Updated: 2024-08-05T01:47:13.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn and KeyDisplay parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/zero2flag/cve-2019-18203-bfa65918e591
CVE ID: CVE-2019-18204 State: PUBLISHED Published: 2019-10-30T18:31:06 Last Updated: 2024-08-05T01:47:13.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution. Additional Analyst Notes: - CVE Program Container: References: - https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42
CVE ID: CVE-2019-18205 State: PUBLISHED Published: 2019-10-30T18:31:21 Last Updated: 2024-08-05T01:47:13.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input (encoded in base64). This also applies to the search functionality for the searchKey parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42
CVE ID: CVE-2019-18206 State: PUBLISHED Published: 2019-10-30T18:31:29 Last Updated: 2024-08-05T01:47:14.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload. Additional Analyst Notes: - CVE Program Container: References: - https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42
CVE ID: CVE-2019-18207 State: PUBLISHED Published: 2019-10-30T18:33:47 Last Updated: 2024-08-05T01:47:14.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload will be triggered every time a user browses the reports page. Additional Analyst Notes: - CVE Program Container: References: - https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42
CVE ID: CVE-2019-18209 State: PUBLISHED Published: 2019-10-19T00:50:06 Last Updated: 2024-08-05T01:47:13.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ether/etherpad-lite/commit/5879037ddca4ab9a4002adf90fc7ce6c9f82f01b
CVE ID: CVE-2019-18210 State: PUBLISHED Published: 2020-02-11T13:43:36 Last Updated: 2024-08-05T01:47:14.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has
ility to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation, they have stated "this report has been closed as a false positive, and not a bug." Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Danbardo/4a6b0fe8cb21ec6d7c54e6ac951bdb0a - https://docs.moodle.org/38/en/Teacher_role
CVE ID: CVE-2019-18211 State: PUBLISHED Published: 2019-12-23T22:13:58 Last Updated: 2024-08-05T01:47:14.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Orckestra/C1-CMS-Foundation/commits/dev
CVE ID: CVE-2019-18212 State: PUBLISHED Published: 2019-10-23T21:05:32 Last Updated: 2024-08-05T01:47:13.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/angelozerr/lsp4xml/ - https://github.com/redhat-developer/vscode-xml/ - https://marketplace.visualstudio.com/items?itemName=redhat.vscode-xml - https://github.com/angelozerr/lsp4xml/pull
ml/ - https://marketplace.visualstudio.com/items?itemName=redhat.vscode-xml - https://github.com/angelozerr/lsp4xml/pull/567 - https://github.com/angelozerr/lsp4xml/blob/master/CHANGELOG.md#others - https://www.shielder.it/blog/dont-open-that-xml-xxe-to-rce-in-xml-plugins-for-vs-code-eclipse-theia/
CVE ID: CVE-2019-18213 State: PUBLISHED Published: 2019-10-23T21:06:46 Last Updated: 2024-08-05T01:47:14.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF (as well as SMB connection initiation that can lead to NetNTLM challenge/response capture for password cracking). This occurs in extensions/contentmodel/participants/diagnostics/LSPXMLParserConfiguration.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/angelozerr/lsp4xml/ -
uration.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/angelozerr/lsp4xml/ - https://github.com/redhat-developer/vscode-xml/ - https://marketplace.visualstudio.com/items?itemName=redhat.vscode-xml - https://github.com/angelozerr/lsp4xml/pull/566 - https://github.com/angelozerr/lsp4xml/blob/master/CHANGELOG.md#others - https://www.shielder.it/blog/dont-open-that-xml-xxe-to-rce-in-xml-plugins-for-vs-code-eclipse-theia/
CVE ID: CVE-2019-18214 State: PUBLISHED Published: 2019-10-19T13:32:49 Last Updated: 2024-08-05T01:47:14.023Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PaulLereverend/NextcloudVideo_Converter/issues/22
CVE ID: CVE-2019-18215 State: PUBLISHED Published: 2019-11-18T20:00:48 Last Updated: 2024-08-05T01:47:14.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. A DLL Preloading vulnerability allows an attacker to implant an unsigned DLL named iLog.dll in a partially unprotected product directory. This DLL is then loaded into a high-privileged service before the binary signature validation logic is loaded, and might bypass some of the self-defense mechanisms. Additional Analyst Notes: - CVE Program Container: References: - https://safebreach.com/blog - https://safebreach.com/Post/Comodo-Interne
t Notes: - CVE Program Container: References: - https://safebreach.com/blog - https://safebreach.com/Post/Comodo-Internet-Security-DLL-Preloading-and-Potential-Abuses-CVE-2019-18215 - https://forums.comodo.com/news-announcements-feedback-cis/comodo-internet-security-2019-v12106914-released-t124993.0.html
CVE ID: CVE-2019-18216 State: PUBLISHED Published: 2019-10-20T15:21:24 Last Updated: 2024-08-05T01:47:14.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access can exhaust the main battery to reset the BIOS configuration, and then achieve direct access to the hard drive by booting a live USB OS without disassembling the laptop. NOTE: the vendor has apparently indicated that this is "normal" and use of t
ve USB OS without disassembling the laptop. NOTE: the vendor has apparently indicated that this is "normal" and use of the same battery for the BIOS and the overall system is a "new design." However, the vendor apparently plans to "improve" this an unspecified later time Additional Analyst Notes: - CVE Program Container: References: - https://blog.modpr0.be/2019/10/18/asus-rog-bios-reset-on-lost-battery-power/
CVE ID: CVE-2019-18217 State: PUBLISHED Published: 2019-10-21T03:12:31 Last Updated: 2024-08-05T01:47:13.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/proftpd/proftpd/issues/846 - https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES - https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES - https://github.com/proftpd/proftpd/blob/master/NEWS - https://github.com/proftpd/proft
roftpd/blob/1.3.6/RELEASE_NOTES - https://github.com/proftpd/proftpd/blob/master/NEWS - https://github.com/proftpd/proftpd/blob/1.3.6/NEWS - https://lists.debian.org/debian-lts-announce/2019/10/msg00036.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJDQRVZTILBX4BUCTIRKP2WBHDHDCJR5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YLRPYEEMQJVAXO2SXRGOQ4HBFEEPCNXG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RB2FPAWDWXT5ALAFIC5Y3RSEMXSFL6H2/ - https://seclists.org/bugtraq/2019/Nov/7 - https://www.debian.org/security/2019/dsa-4559 - h
DWXT5ALAFIC5Y3RSEMXSFL6H2/ - https://seclists.org/bugtraq/2019/Nov/7 - https://www.debian.org/security/2019/dsa-4559 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html - https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf - https://security.gentoo.org/glsa/202003-35
CVE ID: CVE-2019-18218 State: PUBLISHED Published: 2019-10-21T04:41:56 Last Updated: 2024-08-05T01:47:13.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780 - https://lists.debian.org/debian-lts-announce/2019/10/msg00032.html - https://www.debian.org/security/2019/dsa-4550 - https://usn.ubuntu.com/4172-1/
bian-lts-announce/2019/10/msg00032.html - https://www.debian.org/security/2019/dsa-4550 - https://usn.ubuntu.com/4172-1/ - https://usn.ubuntu.com/4172-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VBK6XOJR6OVWT2FUEBO7V7KCOSSLAP52/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV6PFCEYHYALMTT45QE2U5C5TEJZQPXJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D6BJVGXSCC6NMIAWX36FPWHEIFON3OSE/ - https://security.netapp.com/advisory/ntap-20200115-0001/ - https://security.gentoo.org/glsa/202003-24 - http://lists.opensuse.org/opensuse-securi
om/advisory/ntap-20200115-0001/ - https://security.gentoo.org/glsa/202003-24 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00044.html - https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html
CVE ID: CVE-2019-18219 State: PUBLISHED Published: 2019-10-23T13:14:41 Last Updated: 2024-08-05T01:47:14.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting (XSS) vulnerability, as it fails to validate user input. The affected components (index.php, upgrade.php) allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Jemt/SitemagicCMS/blob/master/changelog.txt - https://vuldb.com/?id.144007
CVE ID: CVE-2019-18220 State: PUBLISHED Published: 2019-10-23T13:17:10 Last Updated: 2024-08-05T01:47:14.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitemagic CMS 4.4.1 is affected by a Cross-Site-Request-Forgery (CSRF) issue as it doesn't implement any method to validate incoming requests, allowing the execution of critical functionalities via spoofed requests. This behavior could be abused by a remote unauthenticated attacker to trick Sitemagic users into performing unwarranted actions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Jemt/SitemagicCMS/blob/master/changelog.txt - https://vuldb.com/?id.144008
CVE ID: CVE-2019-18221 State: PUBLISHED Published: 2019-10-25T21:12:18 Last Updated: 2024-08-05T01:47:14.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: CoreHR Core Portal before 27.0.7 allows stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.corehr.com - https://vuldb.com/?id.144170