Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15043 State: PUBLISHED Published: 2019-09-03T11:47:35 Last Updated: 2024-08-05T00:34:53.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana. Additional Analyst Notes: - CVE Program Container: References: - https://community.grafana.com/t/release-notes-v6-3-x/19202 - https://github.com/grafana/grafana/releases - https://community.grafana.com/t/grafana-5-4-5-and-6-3-4-security-update/20569 - https://grafana.com/blog/2019/08/29/grafana-5.4.5-and-6.3.4-released-with-important-security-fix
security-update/20569 - https://grafana.com/blog/2019/08/29/grafana-5.4.5-and-6.3.4-released-with-important-security-fix/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RF5ARGYX3WYB7H2FDR7VAWTEQ27UX3FU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UO4NBL7PKW4OSFRVZENGC42EWEJV2YAH/ - https://security.netapp.com/advisory/ntap-20191004-0004/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html
CVE ID: CVE-2019-15045 State: PUBLISHED Published: 2019-08-21T18:26:18 Last Updated: 2024-08-05T00:34:53.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - http://seclists.org/fulldisclosure/2019/Aug/17 - http://packetstormsecurity.com/files/154183/Zoho-Corporation-ManageEngine-ServiceDesk-Plus-Information-Disclosure.html
CVE ID: CVE-2019-15046 State: PUBLISHED Published: 2019-08-14T14:51:40 Last Updated: 2024-08-05T00:34:53.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html#10509 - http://seclists.org/fulldisclosure/2019/Aug/17 - https://seclists.org/bugtraq/2019/Aug/37 - http://packetstormsecurity.com/files/154183/Zoho-Corporation-ManageEngine-ServiceDesk-Plus-Information-Disclosure.html
CVE ID: CVE-2019-15047 State: PUBLISHED Published: 2019-08-14T15:12:19 Last Updated: 2024-08-05T00:34:53.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBits at Core/Ap4Utils.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/bento4/issues/408
CVE ID: CVE-2019-15048 State: PUBLISHED Published: 2019-08-14T15:12:02 Last Updated: 2024-08-05T00:34:53.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4RtpAtom.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/bento4/issues/409
CVE ID: CVE-2019-15049 State: PUBLISHED Published: 2019-08-14T15:11:53 Last Updated: 2024-08-05T00:34:53.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4Dec3Atom.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/bento4/issues/408
CVE ID: CVE-2019-15050 State: PUBLISHED Published: 2019-08-14T15:11:43 Last Updated: 2024-08-05T00:34:53.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_AvccAtom class at Core/Ap4AvccAtom.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/bento4/issues/409
CVE ID: CVE-2019-15051 State: PUBLISHED Published: 2019-10-10T19:12:31 Last Updated: 2024-08-05T00:34:53.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to command injection via a maliciously crafted form parameter. Additional Analyst Notes: - CVE Program Container: References: - https://security.mioso.com/CVE-2019-15051-en.html
CVE ID: CVE-2019-15052 State: PUBLISHED Published: 2019-08-14T19:38:41 Last Updated: 2024-08-05T00:34:53.188Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/pull/10176 - https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7
ences: - https://github.com/gradle/gradle/pull/10176 - https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95 - https://github.com/gradle/gradle/issues/10278
CVE ID: CVE-2019-15053 State: PUBLISHED Published: 2019-08-14T16:05:33 Last Updated: 2024-08-05T00:34:53.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/4885/html-include-and-replace-macro?hosting=server&tab=versions - https://github.com/l0nax/CVE-2019-15053
CVE ID: CVE-2019-15054 State: PUBLISHED Published: 2019-11-18T20:28:27 Last Updated: 2024-08-05T00:34:53.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a privileged context via a crafted HTML mail message. This vulnerability is distinct from CVE-2015-4657. Additional Analyst Notes: - CVE Program Container: References: - https://startrekdude.github.io/mailbird.html - https://www.getmailbird.com/ReleaseNotes/LatestReleaseNotes.html
CVE ID: CVE-2019-15055 State: PUBLISHED Published: 2019-08-26T20:12:52 Last Updated: 2024-08-05T00:34:53.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://mikrotik.com/download/changelogs/testing-release-tree - https://fortiguard.com/zeroday/FG-VD-19-108 - https://medium.com/tenable-techblog/
oad/changelogs/testing-release-tree - https://fortiguard.com/zeroday/FG-VD-19-108 - https://medium.com/tenable-techblog/rooting-routeros-with-a-usb-drive-16d7b8665f90 - https://github.com/tenable/routeros/tree/master/poc/cve_2019_15055 - https://forum.mikrotik.com/viewtopic.php?t=151603
CVE ID: CVE-2019-15058 State: PUBLISHED Published: 2019-08-14T20:30:35 Last Updated: 2024-08-05T00:34:53.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nothings/stb/issues/790 - https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1695025.html - https://security-tracker.debian.org/tracker/CVE-2019-15058 - https://www.suse.com/security/cve/CVE-2019-15058/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973 - https://www.c
s://www.suse.com/security/cve/CVE-2019-15058/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973 - https://www.cvedetails.com/cve/CVE-2019-15058/
CVE ID: CVE-2019-15059 State: PUBLISHED Published: 2021-04-12T19:12:33 Last Updated: 2024-08-05T00:34:53.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX information including extension numbers, contacts, and passwords. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/famatte69/52e6ad03d0f23428b92bd029c856112c
CVE ID: CVE-2019-15060 State: PUBLISHED Published: 2019-08-22T18:56:43 Last Updated: 2024-08-05T00:34:53.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an IP address input field. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/rapt00rvf - https://vitor-fernandes.github.io/First-CVE/
CVE ID: CVE-2019-15062 State: PUBLISHED Published: 2019-08-14T22:54:51 Last Updated: 2024-08-05T00:34:53.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/issues/11671
sed.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/issues/11671 - https://gauravnarwani.com/publications/CVE-2019-15062/
CVE ID: CVE-2019-15064 State: PUBLISHED Published: 2019-10-17T19:19:53.093044Z Last Updated: 2024-09-16T19:01:42.697Z Vendors: HiNET Products: GPON Problem Types: Authentication bypass Description: HiNet GPON firmware version < I040GWR190731 allows an attacker login to device without any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/en/cp-128-3015-170fe-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201908007
CVE ID: CVE-2019-15065 State: PUBLISHED Published: 2019-10-17T19:23:13.111981Z Last Updated: 2024-09-16T23:31:24.179Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: HiNET Products: GPON Problem Types: read arbitrary files Description: A service which is hosted on port 6998 in HiNet GPON firmware < I040GWR190731 allows an attacker to execute a specific command to read arbitrary files. CVSS 3.0 Base score 9.3. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/en/cp-128-3016-b0e90-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201908011
CVE ID: CVE-2019-15066 State: PUBLISHED Published: 2019-10-17T19:22:14.824669Z Last Updated: 2024-09-16T16:48:07.146Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: HiNET Products: GPON Problem Types: execute arbitrary command Description: An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 6998. CVSS 3.0 Base score 10.0. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/en/cp-128-3017-fd6bc-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201908012
CVE ID: CVE-2019-15067 State: PUBLISHED Published: 2019-09-25T18:10:15.597509Z Last Updated: 2024-09-16T17:48:11.809Z Vendors: Gigastone Products: Smart Battery A2-25DE Problem Types: Authentication bypass Description: An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201908002 - https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=44
CVE ID: CVE-2019-15068 State: PUBLISHED Published: 2019-09-25T18:10:15.674145Z Last Updated: 2024-09-16T21:02:47.178Z Vendors: Gigastone Products: Smart Battery A4 Problem Types: CWE-284 Description: A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 allows an attacker to get/reset administrator’s password without any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201908003 - https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=45
CVE ID: CVE-2019-15069 State: PUBLISHED Published: 2019-09-25T18:10:15.721824Z Last Updated: 2024-09-17T02:32:36.703Z Vendors: Gigastone Products: Smart Battery A4 Problem Types: unsafe authentication interface Description: An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 . An attacker can bypass authentication without modifying device file and gain web page management privilege. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201908004 - https://www.twcert.org.tw/subpages/ServeThePublic/public_document_details.aspx?lang=en-US&id=46
CVE ID: CVE-2019-15071 State: PUBLISHED Published: 2019-11-20T04:06:20.948847Z Last Updated: 2024-09-17T00:10:30.678Z Vendors: Openfind Products: MAIL2000 Problem Types: CWE-79 Description: The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27 - https://www.openfind.com.
Container: References: - https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27 - https://www.openfind.com.tw/taiwan/resource.html - https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d - https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt - https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201909001 - https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf - https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf
CVE ID: CVE-2019-15072 State: PUBLISHED Published: 2019-11-20T04:16:18.705244Z Last Updated: 2024-09-17T01:37:01.538Z Vendors: Openfind Products: MAIL2000 Problem Types: CWE-79 Description: The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities. Additional Analyst Notes: - CVE Program Container: References: - https://www.openfind.com.tw/taiwan/resource.html - https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24a - https://gist.github.com/tonykuo76/5bf
urce.html - https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24a - https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147 - https://www.chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txt - https://tvn.twcert.org.tw/taiwanvn/TVN-201909002 - https://www.twcert.org.tw/en/cp-128-3086-ff35d-2.html
CVE ID: CVE-2019-15073 State: PUBLISHED Published: 2019-11-20T04:16:09.274335Z Last Updated: 2024-09-17T03:37:27.148Z Vendors: Openfind Products: MAIL2000 Problem Types: CWE-601 Description: An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities. Additional Analyst Notes: - CVE Program Container: References: - https://www.openfind.com.tw/taiwan/resource.html - https://gist.github.com/chtsecurity/512ebad24dddffb5321cf5f1a336f90f - https://gist.github.com/tonykuo76/ed1cc21cf755bfb8b67ca24f50bded13
ub.com/chtsecurity/512ebad24dddffb5321cf5f1a336f90f - https://gist.github.com/tonykuo76/ed1cc21cf755bfb8b67ca24f50bded13 - https://www.chtsecurity.com/download/258686130f7a16063c765f9e79cffd813409f6fe61c2dec05fceca541762d5bd.txt - https://www.twcert.org.tw/en/cp-128-3087-5cecd-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201909003
CVE ID: CVE-2019-15074 State: PUBLISHED Published: 2019-08-21T18:23:04 Last Updated: 2024-08-05T00:34:53.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=25995 - https://github.com/mantisbt/mantisbt/commit/9cee1971c498bbe0a72bca1c773fae5
ttps://mantisbt.org/bugs/view.php?id=25995 - https://github.com/mantisbt/mantisbt/commit/9cee1971c498bbe0a72bca1c773fae50171d8c27
CVE ID: CVE-2019-15075 State: PUBLISHED Published: 2020-03-20T17:05:54 Last Updated: 2024-08-05T00:34:53.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/iNextrix/ASTPP/commit/9877ec62556f0470030acd306b24bc94fdcbe2ae
CVE ID: CVE-2019-15078 State: PUBLISHED Published: 2020-12-30T19:53:56 Last Updated: 2024-08-05T00:34:53.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The name of the constructor has a typo (wrong case: XBornID versus XBORNID) that allows an attacker to change the owner of the contract and obtain cryptocurrency for free. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smsecgroup/SM-VUL/tree/master/typo-vul-00
CVE ID: CVE-2019-15079 State: PUBLISHED Published: 2020-12-30T19:57:36 Last Updated: 2024-08-05T00:34:53.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This vulnerability could be used by an attacker to acquire EAI tokens for free. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smsecgroup/SM-VUL/tree/master/typo-vul-01
CVE ID: CVE-2019-15080 State: PUBLISHED Published: 2020-12-30T19:59:25 Last Updated: 2024-08-05T00:34:53.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract (which is inherited by MORPH Token) allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for free and can perform a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smsecgroup/SM-VUL/tree/master/typo-vul-02 - https://etherscan.io/address/0x2ef27bf41236bd859a95209e17a43fbd26851f
ub.com/smsecgroup/SM-VUL/tree/master/typo-vul-02 - https://etherscan.io/address/0x2ef27bf41236bd859a95209e17a43fbd26851f92#contracts
CVE ID: CVE-2019-15081 State: PUBLISHED Published: 2019-08-15T14:25:18 Last Updated: 2024-08-05T00:34:53.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nipunsomani/Opencart-3.x.x-Authenticated-Stored-XSS/blob/master/README.md - http://packetstormsecurity.com/files/154286/Opencart-3.x-Cross-Site-Scripting.html
CVE ID: CVE-2019-15082 State: PUBLISHED Published: 2019-08-20T13:29:04 Last Updated: 2024-08-05T00:34:53.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9405 - https://wordpress.org/plugins/360-product-rotation/#developers
CVE ID: CVE-2019-15083 State: PUBLISHED Published: 2020-05-14T13:45:08 Last Updated: 2024-08-05T00:34:53.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this f
ware is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme105 - http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/48473
CVE ID: CVE-2019-15084 State: PUBLISHED Published: 2019-08-15T23:23:56 Last Updated: 2024-08-05T00:34:53.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. As a result, a local attacker can escalate to SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46416