Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-16734 State: PUBLISHED Published: 2019-12-13T20:20:34 Last Updated: 2024-08-05T01:24:47.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE ID: CVE-2019-16735 State: PUBLISHED Published: 2019-12-13T20:48:44 Last Updated: 2024-08-05T01:24:48.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in processCommandUploadLog in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to cause denial of service or run arbitrary code as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE ID: CVE-2019-16736 State: PUBLISHED Published: 2019-12-13T20:52:04 Last Updated: 2024-08-05T01:24:48.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in processCommandUploadSnapshot in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to cause denial of service or run arbitrary code as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE ID: CVE-2019-16737 State: PUBLISHED Published: 2019-12-13T20:29:28 Last Updated: 2024-08-05T01:24:47.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: The processCommandSetMac() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE ID: CVE-2019-16738 State: PUBLISHED Published: 2019-09-26T01:49:11 Last Updated: 2024-08-05T01:24:48.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T230402 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO/ - https://www.debian.org/security/2019/dsa-4545 - https://seclists.org/bugtraq/2019/Oct/32 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor
https://seclists.org/bugtraq/2019/Oct/32 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QBAOLXETM5BOYQG6OQVHGB2LNLZUXVN6/
CVE ID: CVE-2019-16743 State: PUBLISHED Published: 2019-09-30T12:06:27 Last Updated: 2024-08-05T01:24:48.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: eBrigade before 5.0 has evenement_ical.php evenement SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/ebrigade/files/ - http://packetstormsecurity.com/files/154624/eBrigade-SQL-Injection.html
CVE ID: CVE-2019-16744 State: PUBLISHED Published: 2019-09-30T12:13:44 Last Updated: 2024-08-05T01:24:47.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: eBrigade before 5.0 has evenements.php cid SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/ebrigade/files/ - https://packetstormsecurity.com/files/154624/eBrigade-SQL-Injection.html
CVE ID: CVE-2019-16745 State: PUBLISHED Published: 2019-09-30T12:14:21 Last Updated: 2024-08-05T01:24:47.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/ebrigade/files/ - https://packetstormsecurity.com/files/154624/eBrigade-SQL-Injection.html
CVE ID: CVE-2019-16746 State: PUBLISHED Published: 2019-09-24T05:55:02 Last Updated: 2024-08-05T01:24:47.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TASE2ESEZAER6DTZH3DJ4K2JNO46TVL7/ - https://seclists.org/bugtraq/2019/Nov/11 - https://usn.ubuntu.com/4183-1/ - https://usn.ubuntu.com/4186-1/ - https://usn.ubuntu.com/4209-1/ - https:/
2019/Nov/11 - https://usn.ubuntu.com/4183-1/ - https://usn.ubuntu.com/4186-1/ - https://usn.ubuntu.com/4209-1/ - https://usn.ubuntu.com/4210-1/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html - https://www.oracle.com/security-alerts/cpuApr2021.html - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://marc.info/?l=linux-wireless&m=156901391225058&w=2 - https://security.netapp.com/advisory
2-kernel-Updates.html - https://marc.info/?l=linux-wireless&m=156901391225058&w=2 - https://security.netapp.com/advisory/ntap-20191031-0005/
CVE ID: CVE-2019-16747 State: PUBLISHED Published: 2020-12-30T20:20:06 Last Updated: 2024-08-05T01:24:48.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to memory corruption and a daemon crash) via a crafted incoming network message, a different vulnerability than CVE-2019-14431. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrixssl/matrixssl/issues/33 - https://github.com/matrixssl/matrixssl/releases/tag/4-2-2-open - https://github.com/matrixssl/matrixssl/blob/4-2-2-open/doc/CHANGES_v4.x.md
CVE ID: CVE-2019-16748 State: PUBLISHED Published: 2019-09-24T12:12:38 Last Updated: 2024-08-05T01:24:47.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer over-read in CheckCertSignature_ex in wolfcrypt/src/asn.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfSSL/wolfssl/issues/2459
CVE ID: CVE-2019-16751 State: PUBLISHED Published: 2019-09-24T17:14:08 Last Updated: 2024-08-05T01:24:47.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the fallback_render method in the omniauth callbacks controller. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lynndylanhurley/devise_token_auth/issues/1332
CVE ID: CVE-2019-16752 State: PUBLISHED Published: 2019-12-04T19:30:17 Last Updated: 2024-08-05T01:24:48.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious threat to user privacy, since it can possibly leak their IP address and the fact that they are using the product. This also affects Dash Core through 0.14.0.3 and Private Instant Verified Transactions (PIVX) through 3.4.0. Additional Analyst Notes: - CVE Program Container: References: - https:/
ant Verified Transactions (PIVX) through 3.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf
CVE ID: CVE-2019-16753 State: PUBLISHED Published: 2019-12-04T19:28:16 Last Updated: 2024-08-05T01:24:47.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak signature scheme design that would allow the reuse of signatures in some cases (or even the reuse of signatures, intended for one type of message, for another type). This also affects Private Instant Verified Transactions (PIVX) through 3.4.0. Additional Analyst Notes: - CVE Program Container:
o affects Private Instant Verified Transactions (PIVX) through 3.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf
CVE ID: CVE-2019-16754 State: PUBLISHED Published: 2019-09-24T17:50:13 Last Updated: 2024-08-05T01:24:47.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message and the ephemeral port used by RIOT's MQTT implementation. Additionally, the server IP address is required for spoofing the packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/pull/
ofing the packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/pull/12293
CVE ID: CVE-2019-16755 State: PUBLISHED Published: 2019-09-26T15:27:17 Last Updated: 2024-08-05T01:24:48.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Remedy ITSM Suite is prone to unspecified vulnerabilities in both DWP and SmartIT components, which can permit remote attackers to perform pre-authenticated remote commands execution on the Operating System running the targeted application. Affected DWP versions: versions: 3.x to 18.x, all versions, service packs, and patches are affected by this vulnerability. Affected SmartIT versions: 1.x, 2.0, 18.05, 18.08, and 19.02, all versions, service packs, and patches are affected by this vulnerability. Additional Analyst Notes
18.08, and 19.02, all versions, service packs, and patches are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bmcsites.force.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA21O000000gnYQSAY&type=Solution
CVE ID: CVE-2019-16758 State: PUBLISHED Published: 2019-11-21T17:56:23 Last Updated: 2024-08-05T01:24:47.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal technique using /../../../ or ..%2F..%2F..%2F to obtain local files on the host operating system. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/155365/Lexmark-Services-Monitor-2.27.4.0.39-Directory-Traversal.html - http://seclists.org/fulldisclosure/2019/Nov/17 - https://www.symantec.com/security-center/vulnerabilities/writeup/110943 - http://support.lexmar
disclosure/2019/Nov/17 - https://www.symantec.com/security-center/vulnerabilities/writeup/110943 - http://support.lexmark.com/index?page=content&id=TE930&locale=en&userlocale=EN_US
CVE ID: CVE-2019-16759 State: PUBLISHED Published: 2019-09-24T21:01:49.000Z Last Updated: 2025-10-21T23:45:30.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2019/Sep/31 - https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/ - https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/ - http://packetstormsecurity.com/files/1
09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/ - http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html - http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html - http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html - http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html - http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Aug/5 - http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html
CVE ID: CVE-2019-16760 State: PUBLISHED Published: 2019-09-30T21:39:38 Last Updated: 2024-08-05T01:24:48.330Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: rust Products: cargo Problem Types: CWE-16 Description: Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests
rates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no poi
enting this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rust-lang/rust/security/advisories/GHSA-phjm-8x66-qw4r - https://groups.google.com/forum/#%21topic/rustlang-security-announcements/rVQ5e3TDnpQ - https://gist.github.com/pietroalbini/0d293b24a44babbeb6187e06eebd4992 - http://www.openwall.com/lists/oss-security/2019/10/08/3
CVE ID: CVE-2019-16761 State: PUBLISHED Published: 2019-11-15T23:05:57 Last Updated: 2024-08-05T01:24:48.496Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H) Vendors: simpleledger Products: slp-validate Problem Types: CWE-20 Description: A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0.0 have been patched. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simpleledger/slp-validate/security
. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simpleledger/slp-validate/security/advisories/GHSA-wmx6-vxcf-c3gr - https://github.com/simpleledger/slp-validate/commit/50ad96c2798dad6b9f9a13333dd05232defe5730#diff-fe58606994c412ba56a65141a7aa4a62L123
CVE ID: CVE-2019-16762 State: PUBLISHED Published: 2019-11-15T23:10:57 Last Updated: 2024-08-05T01:24:47.227Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H) Vendors: simpleledger Products: slpjs Problem Types: CWE-20 Description: A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any version >= 0.21.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simpleledger/slpjs/security/advisories/G
tional Analyst Notes: - CVE Program Container: References: - https://github.com/simpleledger/slpjs/security/advisories/GHSA-425c-ccf3-3jrr - https://github.com/simpleledger/slpjs/commit/ac8809b42e47790a6f0205991b36f2699ed10c84#diff-fe58606994c412ba56a65141a7aa4a62L701
CVE ID: CVE-2019-16763 State: PUBLISHED Published: 2019-11-22T18:26:09 Last Updated: 2024-08-05T01:24:48.382Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: mpretroff Products: pannellum Problem Types: CWE-79 Description: In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if pannellum.htm was hosted on a domain that shared cookies with the targeted site's user authentication; an &lt;iframe&gt; could then be embedded
d on a domain that shared cookies with the targeted site's user authentication; an &lt;iframe&gt; could then be embedded on the attacker's site using pannellum.htm from the targeted site, which would allow the attacker to potentially access information from the targeted site as the authenticated user (or worse if the targeted site did not have adequate CSRF protections) if the user clicked on a hot spot in the attacker's embedded panorama viewer. This was patched in version 2.5.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mpetroff/pannellum/security/advisories/GHSA-m52x-29pq-w3vv - https://github.com/mpetroff/pannellum/commit/cc2f3d99953de59db908e0c6
annellum/security/advisories/GHSA-m52x-29pq-w3vv - https://github.com/mpetroff/pannellum/commit/cc2f3d99953de59db908e0c6efd1c2c17f7c6914
CVE ID: CVE-2019-16764 State: PUBLISHED Published: 2019-11-25T17:11:19 Last Updated: 2024-08-05T01:24:47.215Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: pow-auth Products: pow_assent Problem Types: CWE-400 Description: The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to
s unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986 - https://hex.pm/packages/pow_assent - http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1 - https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf
CVE ID: CVE-2019-16765 State: PUBLISHED Published: 2019-11-25T17:41:17 Last Updated: 2024-08-05T01:24:47.950Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: github Products: vscode-codeql Problem Types: CWE-250, CWE-22 Description: If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the codeQL.cli.executablePath setting can only be
g Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the codeQL.cli.executablePath setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found here. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/github/vscode-codeql/security/advisories/GHSA-wf4x-8mpj-r42q - https://github.com/github/vscode-codeql/pull/174 - https://github.com/github/vscode-codeql/blob/v1.0.1/CHANGELOG.md
CVE ID: CVE-2019-16766 State: PUBLISHED Published: 2019-11-29T17:05:14 Last Updated: 2024-08-05T01:24:47.232Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Lab Digital Products: wagtail-2fa Problem Types: CWE-304, CWE-290 Description: When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm - htt
- CVE Program Container: References: - https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm - https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81 - https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca
CVE ID: CVE-2019-16767 State: PUBLISHED Published: 2019-11-29T17:40:14 Last Updated: 2024-08-05T01:24:47.259Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: Inist-CNRS Products: ezmaster Problem Types: CWE-250 Description: The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced capabilities (not launched as root) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Inist-CNRS/ezmaster/security/advisories/GHSA-g654-5qjf-g6cx - https://github.com/Inist-CNRS/ezmaster/pull/51 - https://github.com/Inist-CNRS/ezmaster/blob/master/CH
-g654-5qjf-g6cx - https://github.com/Inist-CNRS/ezmaster/pull/51 - https://github.com/Inist-CNRS/ezmaster/blob/master/CHANGELOG.md#ezmaster-5211
CVE ID: CVE-2019-16768 State: PUBLISHED Published: 2019-12-05T20:00:21 Last Updated: 2024-08-05T01:24:47.238Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Sylius Products: Sylius Problem Types: CWE-209 Description: In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been pa
essage with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h - https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f