Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-19072 State: PUBLISHED Published: 2019-11-18T05:24:18 Last Updated: 2024-08-05T02:09:39.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/96c5c6e6a5b6db592acae039fed54b5c8844cd35 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/ - https://lists.fedoraproject.org/archiv
ge-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/ - https://security.netapp.com/advisory/ntap-20191205-0001/ - https://usn.ubuntu.com/4226-1/ - https://usn.ubuntu.com/4225-1/ - https://usn.ubuntu.com/4225-2/
CVE ID: CVE-2019-19073 State: PUBLISHED Published: 2019-11-18T05:24:19 Last Updated: 2024-08-05T02:09:39.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function, aka CID-853acf7caf10. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6
: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://usn.ubuntu.com/4527-1/ - https://usn.ubuntu.com/4526-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20191205-0001/ - https://github.com/to
e.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20191205-0001/ - https://github.com/torvalds/linux/commit/853acf7caf10b828102d92d05b5c101666a6142b
CVE ID: CVE-2019-19074 State: PUBLISHED Published: 2019-11-18T05:24:21 Last Updated: 2024-08-05T02:09:38.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW
tps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://usn.ubuntu.com/4527-1/ - https://usn.ubuntu.com/4526-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20191205-0001/ - https://github.com/torvalds/linux/commit/728c1e2a05e4b5fc52fab3421dce772a806612a2
CVE ID: CVE-2019-19075 State: PUBLISHED Published: 2019-11-18T05:24:22 Last Updated: 2024-08-05T02:09:39.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8 - https://github.com/torvalds/linux/commit/6402939ec86eaf226c8b8ae00ed983936b164908 - https://usn.ubuntu.com/4208-1/ - https://usn.ubuntu.com/4210-1/ -
nux/commit/6402939ec86eaf226c8b8ae00ed983936b164908 - https://usn.ubuntu.com/4208-1/ - https://usn.ubuntu.com/4210-1/ - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://usn.ubuntu.com/4226-1/
CVE ID: CVE-2019-19076 State: PUBLISHED Published: 2019-11-18T05:24:23 Last Updated: 2024-08-05T02:09:39.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to cause a denial of service (memory consumption), aka CID-78beef629fd9. NOTE: This has been argued as not a valid vulnerability. The upstream commit 78beef629fd9 was reverted Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.6 - https://github.com/torvalds/linux/commit/78beef629fd95be4ed853b2d37b832
rnel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.6 - https://github.com/torvalds/linux/commit/78beef629fd95be4ed853b2d37b832f766bd96ca - https://usn.ubuntu.com/4209-1/ - https://security.netapp.com/advisory/ntap-20191205-0001/ - https://git.kernel.org/linus/1d1997db870f4058676439ef7014390ba9e24eb2 - https://lore.kernel.org/lkml/20191204103955.63c4d9af%40cakuba.netronome.com/
CVE ID: CVE-2019-19077 State: PUBLISHED Published: 2019-11-18T05:24:25 Last Updated: 2024-08-05T02:09:38.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy to udata failures, aka CID-4a9d46a9fe14. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/4a9d46a9fe14401f21df69cea97c62396d5fb053 - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00
://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4284-1/
CVE ID: CVE-2019-19078 State: PUBLISHED Published: 2019-11-18T05:24:26 Last Updated: 2024-08-05T02:09:38.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MN6MLCN7G7VFTSXSZYXKXEFCUMFBUAXQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed
g/message/MN6MLCN7G7VFTSXSZYXKXEFCUMFBUAXQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4ISVNIC44SOGXTUBCIZFSUNQJ5LRKNZ/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://usn.ubuntu.com/4284-1/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20191205-0001/ - https://github.com/torvalds/linux/commit/b8d17e7d93d2beb89e4f34c59996376b8b544792
CVE ID: CVE-2019-19079 State: PUBLISHED Published: 2019-11-18T05:24:27 Last Updated: 2024-08-05T02:09:38.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of service (memory consumption), aka CID-a21b7f0cff19. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3 - https://github.com/torvalds/linux/commit/a21b7f0cff1906a93a0130b74713b15a0b36481d - https://security.netapp.com/advisory/ntap-20191205-0001/ - https://usn.ubuntu.com/4258-1/
CVE ID: CVE-2019-19080 State: PUBLISHED Published: 2019-11-18T05:24:29 Last Updated: 2024-08-05T02:09:38.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4 - https://github.com/torvalds/linux/commit/8572cea1461a006bce1d06c0c4b0575869125fa4 - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.o
ea1461a006bce1d06c0c4b0575869125fa4 - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
CVE ID: CVE-2019-19081 State: PUBLISHED Published: 2019-11-18T05:24:30 Last Updated: 2024-08-05T02:09:38.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4 - https://github.com/torvalds/linux/commit/8ce39eb5a67aee25d9f05b40b673c95b23502e3e - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.org
5a67aee25d9f05b40b673c95b23502e3e - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
CVE ID: CVE-2019-19082 State: PUBLISHED Published: 2019-11-18T05:24:31 Last Updated: 2024-08-05T02:09:38.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_create_res
dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka CID-104c307147ad. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/104c307147ad379617472dd91a5bcb368d72bd6d - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.c
-announce/2019-12/msg00029.html - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://usn.ubuntu.com/4284-1/
CVE ID: CVE-2019-19083 State: PUBLISHED Published: 2019-11-18T05:24:33 Last Updated: 2024-08-05T02:09:38.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). This affects the dce112_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, the dce100_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, the dcn20_clock_source_create
0_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, the dcn20_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c, the dce120_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, and the dce80_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c, aka CID-055e547478a1. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8 - https://github.com/torvalds/linux/commit/055e547478a1
: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8 - https://github.com/torvalds/linux/commit/055e547478a11a6360c7ce05e2afc3e366968a12 - https://usn.ubuntu.com/4208-1/ - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://usn.ubuntu.com/4227-1/ - https://usn.ubuntu.com/4226-1/ - https://usn.ubuntu.com/4227-2/
CVE ID: CVE-2019-19084 State: PUBLISHED Published: 2019-11-18T15:36:51 Last Updated: 2024-08-05T02:09:39.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/5971
CVE ID: CVE-2019-19085 State: PUBLISHED Published: 2019-11-18T15:36:59 Last Updated: 2024-08-05T02:09:38.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/5961
CVE ID: CVE-2019-19086 State: PUBLISHED Published: 2020-01-03T15:34:04 Last Updated: 2024-08-05T02:09:38.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19087 State: PUBLISHED Published: 2020-01-03T15:38:04 Last Updated: 2024-08-05T02:09:38.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19088 State: PUBLISHED Published: 2020-01-03T15:40:19 Last Updated: 2024-08-05T02:09:39.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19089 State: PUBLISHED Published: 2020-04-02T19:46:36 Last Updated: 2024-08-05T02:09:39.266Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ABB Products: eSOMS Problem Types: CWE-16 Description: For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text interpreted as JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A
nalyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19090 State: PUBLISHED Published: 2020-04-02T19:46:45 Last Updated: 2024-08-05T02:09:38.942Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: ABB Products: eSOMS Problem Types: CWE-16 Description: For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19091 State: PUBLISHED Published: 2020-04-02T19:46:55 Last Updated: 2024-08-05T02:09:39.345Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ABB Products: eSOMS Problem Types: CWE-16, CWE-202 Description: For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to specifically craft the attack. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19092 State: PUBLISHED Published: 2020-04-02T19:47:07 Last Updated: 2024-08-05T02:09:39.100Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: ABB Products: eSOMS Problem Types: CWE-16 Description: ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19093 State: PUBLISHED Published: 2020-04-02T19:47:23 Last Updated: 2024-08-05T02:09:39.388Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: ABB Products: eSOMS Problem Types: CWE-521 Description: eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19094 State: PUBLISHED Published: 2020-04-02T19:47:32 Last Updated: 2024-08-05T02:09:39.344Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: ABB Products: eSOMS Problem Types: CWE-89 Description: Lack of input checks for SQL queries in ABB eSOMS versions 3.9 to 6.0.3 might allow an attacker SQL injection attacks against the backend database. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19095 State: PUBLISHED Published: 2020-04-02T19:47:46 Last Updated: 2024-08-05T02:09:39.185Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ABB Products: eSOMS Problem Types: CWE-20 Description: Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing malicious content in the database. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19096 State: PUBLISHED Published: 2020-04-02T19:48:02 Last Updated: 2024-08-05T02:09:39.348Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: ABB Products: eSOMS Problem Types: CWE-257 Description: The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19097 State: PUBLISHED Published: 2020-04-02T19:48:26 Last Updated: 2024-08-05T02:09:39.210Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ABB Products: eSOMS Problem Types: CWE-16, CWE-326 Description: ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to eavesdrop and/or intercept the connection. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2019-19100 State: PUBLISHED Published: 2020-04-29T02:09:21 Last Updated: 2024-08-05T02:09:39.275Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: B&R Products: Automation Studio Problem Types: CWE-264 Description: A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP, < 4.7.2 and < 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/
CVE ID: CVE-2019-19101 State: PUBLISHED Published: 2020-04-29T02:07:32 Last Updated: 2024-08-05T02:09:39.436Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: B&R Products: Automation Studio Problem Types: CWE-326 Description: A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.5SP, < 4.6.4 and < 4.7.2 enable unauthenticated users to perform MITM attacks via the B&R upgrade server. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automatio
Program Container: References: - https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/
CVE ID: CVE-2019-19102 State: PUBLISHED Published: 2020-04-29T02:07:47 Last Updated: 2024-08-05T02:09:39.123Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: B&R Products: Automation Studio Problem Types: CWE-22 Description: A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/