Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-6504 State: PUBLISHED Published: 2019-02-06T00:00:00Z Last Updated: 2024-09-16T20:38:11.190Z Vendors: CA Technologies - A Broadcom Company Products: CA Automic Workload Automation Problem Types: Persistent Cross Site Scripting Description: Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting (XSS) attacks via a crafted object. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=bugtraq&m=154874504200510&w=2 - http://www.securityfocus.com/bid/106755 - https://sec-consult.com/en/blog/advisories/cross-site-scrip
874504200510&w=2 - http://www.securityfocus.com/bid/106755 - https://sec-consult.com/en/blog/advisories/cross-site-scripting-in-ca-automic-workload-automation-web-interface-formerly-automic-automation-engine/ - https://packetstormsecurity.com/files/151325/CA-Automic-Workload-Automation-12.x-Cross-Site-Scripting.html - https://communities.ca.com/community/product-vulnerability-response/blog/2019/01/24/ca20190124-01-security-notice-for-ca-automic-workload-automation - https://seclists.org/fulldisclosure/2019/Jan/61 - https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190124-01-security-notice-for-ca-automic-workload-automation.html
CVE ID: CVE-2019-6506 State: PUBLISHED Published: 2019-04-02T21:14:57 Last Updated: 2024-08-04T20:23:21.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM before 7.8.28, 7.9.x and 7.10.x before 7.10.15, and 7.11.x before 7.11.3 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/#anchor-7.10.11 - https://suitecrm.com/suitecrm-7-11-3-lts-security-maintenance-patch-released/ - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_3 - https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_15 - https://docs.suitecrm.com/admin/releases/7.8.x/#_7_8_28
CVE ID: CVE-2019-6507 State: PUBLISHED Published: 2019-01-22T16:00:00 Last Updated: 2024-08-04T20:23:22.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in creditease-sec insight through 2018-09-11. login_user_delete in srcpm/app/admin/views.py allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/creditease-sec/insight/issues/42
CVE ID: CVE-2019-6508 State: PUBLISHED Published: 2019-01-22T16:00:00 Last Updated: 2024-08-04T20:23:21.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in creditease-sec insight through 2018-09-11. role_perm_delete in srcpm/app/admin/views.py allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/creditease-sec/insight/issues/42
CVE ID: CVE-2019-6509 State: PUBLISHED Published: 2019-01-22T16:00:00 Last Updated: 2024-08-04T20:23:21.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in creditease-sec insight through 2018-09-11. depart_delete in srcpm/app/admin/views.py allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/creditease-sec/insight/issues/42
CVE ID: CVE-2019-6510 State: PUBLISHED Published: 2019-01-22T16:00:00 Last Updated: 2024-08-04T20:23:22.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in creditease-sec insight through 2018-09-11. user_delete in srcpm/app/admin/views.py allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/creditease-sec/insight/issues/42
CVE ID: CVE-2019-6512 State: PUBLISHED Published: 2019-05-14T14:24:33.000Z Last Updated: 2025-05-30T16:01:08.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to enumerate files because of the existence of the file:// wrapper. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory - https://wso2.com/security-patch-releases/api-manager - https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6512
CVE ID: CVE-2019-6513 State: PUBLISHED Published: 2019-05-21T21:34:58.000Z Last Updated: 2025-05-30T16:01:10.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory - https://www.excellium-services.com/cert-xlm-advisory/cve-2019-6513/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6513
CVE ID: CVE-2019-6514 State: PUBLISHED Published: 2019-05-14T14:35:30.000Z Last Updated: 2025-05-30T16:01:18.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory - https://wso2.com/security-patch-releases/dashboard-server - https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6514
CVE ID: CVE-2019-6515 State: PUBLISHED Published: 2019-05-14T14:44:29.000Z Last Updated: 2025-05-30T16:01:12.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory - https://wso2.com/security-patch-releases/api-manager - https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6515
CVE ID: CVE-2019-6516 State: PUBLISHED Published: 2019-05-14T14:50:37.000Z Last Updated: 2025-05-30T16:01:14.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning) and to perform requests to adjacent workstations (network-scanning), aka SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory - https://wso2.com/security-patch-releases/dashboard-server - https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6516
CVE ID: CVE-2019-6517 State: PUBLISHED Published: 2019-02-06T21:00:00Z Last Updated: 2024-09-16T20:22:23.258Z Vendors: ICS-CERT Products: BD FACSLyric Problem Types: CWE-284 Description: BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric IVD Windows 10 Professional Operating System US release does not properly enforce user access control to privileged accounts, which may allow for unauthorized access to administrative level functions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106766 - https://ics-cert.us-cert.gov/advisories/ICSMA
Program Container: References: - http://www.securityfocus.com/bid/106766 - https://ics-cert.us-cert.gov/advisories/ICSMA-19-029-02
CVE ID: CVE-2019-6518 State: PUBLISHED Published: 2019-03-05T21:00:00Z Last Updated: 2024-09-16T18:49:44.263Z Vendors: ICS-CERT Products: Moxa IKS, EDS Problem Types: CWE-256 Description: Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01 - http://www.securityfocus.com/bid/107178
CVE ID: CVE-2019-6519 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-04T20:23:21.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-024-01 - http://www.securityfocus.com/bid/106722
CVE ID: CVE-2019-6520 State: PUBLISHED Published: 2019-03-05T21:00:00Z Last Updated: 2024-09-16T19:01:03.479Z Vendors: ICS-CERT Products: Moxa IKS, EDS Problem Types: CWE-284 Description: Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01 - http://www.securityfocus.com/bid/107178
CVE ID: CVE-2019-6521 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-04T20:23:21.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-024-01 - http://www.securityfocus.com/bid/106722
CVE ID: CVE-2019-6522 State: PUBLISHED Published: 2019-03-05T21:00:00Z Last Updated: 2024-09-17T02:32:19.762Z Vendors: ICS-CERT Products: Moxa IKS, EDS Problem Types: CWE-125 Description: Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allow an attacker to retrieve sensitive data or cause device reboot. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01 - http://www.securityfocus.com/bid/107178
CVE ID: CVE-2019-6523 State: PUBLISHED Published: 2019-02-05T21:00:00 Last Updated: 2024-08-04T20:23:21.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-024-01 - http://www.securityfocus.com/bid/106722
CVE ID: CVE-2019-6524 State: PUBLISHED Published: 2019-03-05T21:00:00Z Last Updated: 2024-09-16T16:57:49.226Z Vendors: ICS-CERT Products: Moxa IKS, EDS Problem Types: CWE-307 Description: Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01 - http://www.securityfocus.com/bid/107178
CVE ID: CVE-2019-6525 State: PUBLISHED Published: 2019-04-11T20:21:37 Last Updated: 2024-08-04T20:23:21.335Z Vendors: AVEVA Products: Wonderware System Platform Problem Types: CWE-522 Description: AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-029-03 - https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec135.pdf
CVE ID: CVE-2019-6526 State: PUBLISHED Published: 2019-04-12T20:11:08 Last Updated: 2024-08-04T20:23:21.401Z Vendors: Moxa Products: IKS, EDS Problem Types: CWE-311 Description: Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior use plaintext transmission of sensitive data, which may allow an attacker to capture sensitive data such as an administrative password. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-057-01
CVE ID: CVE-2019-6527 State: PUBLISHED Published: 2019-02-12T17:00:00Z Last Updated: 2024-09-17T02:32:35.184Z Vendors: ICS-CERT Products: PR100088 Modbus gateway Problem Types: CWE-287 Description: PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the password for an admin user who is currently or previously logged in, provided the device has not been restarted. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05
CVE ID: CVE-2019-6528 State: PUBLISHED Published: 2019-03-05T21:00:00Z Last Updated: 2024-09-16T23:10:35.249Z Vendors: ICS-CERT Products: PSI GridConnect GmbH (formerly known as PSI Nentec GmbH) Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy. Problem Types: CWE-79 Description: PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.
ntrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107201 - https://ics-cert.us-cert.gov/advisories/ICSA-19-059-01
CVE ID: CVE-2019-6529 State: PUBLISHED Published: 2020-01-07T20:21:54 Last Updated: 2024-08-04T20:23:21.370Z Vendors: n/a Products: PR100088 Modbus gateway Problem Types: Other Description: An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Version 1.1.13166). Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05
CVE ID: CVE-2019-6530 State: PUBLISHED Published: 2019-06-07T13:58:17 Last Updated: 2024-08-04T20:23:21.474Z Vendors: Panasonic Products: FPWIN Pro Problem Types: CWE-122 Description: Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based buffer overflows, which may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-157-02 - http://www.securityfocus.com/bid/108683 - https://www.zerodayinitiative.com/advisories/ZDI-19-565/ - https://www.zerodayinitiative.com/advisories/ZDI-19-567/
CVE ID: CVE-2019-6531 State: PUBLISHED Published: 2019-04-02T19:15:11 Last Updated: 2024-08-04T20:23:21.405Z Vendors: Kunbus Products: PR100088 Modbus gateway Problem Types: CWE-598 Description: An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) if the attacker is in an MITM position. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05
CVE ID: CVE-2019-6532 State: PUBLISHED Published: 2019-06-07T13:58:48 Last Updated: 2024-08-04T20:23:21.586Z Vendors: Panasonic Products: FPWIN Pro Problem Types: CWE-843 Description: Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-157-02 - http://www.securityfocus.com/bid/108683 - https://www.zerodayinitiative.com/advisories/ZDI-19-568/ - https://www.zerodayinitiative.com/advis
ocus.com/bid/108683 - https://www.zerodayinitiative.com/advisories/ZDI-19-568/ - https://www.zerodayinitiative.com/advisories/ZDI-19-566/ - https://www.zerodayinitiative.com/advisories/ZDI-19-570/
CVE ID: CVE-2019-6533 State: PUBLISHED Published: 2019-02-12T17:00:00Z Last Updated: 2024-09-16T17:18:38.780Z Vendors: ICS-CERT Products: PR100088 Modbus gateway Problem Types: CWE-306 Description: Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166). Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05
CVE ID: CVE-2019-6534 State: PUBLISHED Published: 2019-04-11T20:38:50 Last Updated: 2024-08-04T20:23:21.993Z Vendors: Gemalto Products: Sentinel UltraPro Problem Types: CWE-427 Description: The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02 - https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01 - https://supportportal.gemalto.com/csm?id=kb_article_view&sysparm_article=KB0017694 - https://sw.aveva.com/hubfs/assets-2018/pdf/securit
portal.gemalto.com/csm?id=kb_article_view&sysparm_article=KB0017694 - https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf
CVE ID: CVE-2019-6535 State: PUBLISHED Published: 2019-02-05T19:00:00Z Last Updated: 2025-06-26T17:08:15.995Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Mitsubishi Electric Products: Q03/04/06/13/26UDVCPU, Q04/06/13/26UDPVCPU, Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU Problem Types: CWE-400 Description: Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication. Additional A
cific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106771 - https://www.cisa.gov/news-events/ics-advisories/icsa-19-029-02
CVE ID: CVE-2019-6536 State: PUBLISHED Published: 2019-03-27T15:25:23 Last Updated: 2024-08-04T20:23:21.362Z Vendors: LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Products: LAquis SCADA Problem Types: CWE-787 Description: Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may allow an attacker to execute remote code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-073-01 - https://www.zerodayinitiative.com/advisories/ZDI-19-307/
CVE ID: CVE-2019-6537 State: PUBLISHED Published: 2019-02-13T00:00:00Z Last Updated: 2024-09-16T23:46:28.780Z Vendors: ICS-CERT Products: WECON LeviStudioU Problem Types: CWE-121 Description: Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings within project files. The process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage these vulnerabilities to execute code under the context of the current process. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnera
cess. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106861 - https://ics-cert.us-cert.gov/advisories/ICSA-19-036-03
CVE ID: CVE-2019-6538 State: PUBLISHED Published: 2019-03-25T21:26:03 Last Updated: 2025-05-22T19:26:15.126Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) Vendors: Medtronic Products: Conexus Radio Frequency Telemetry Protocol, MyCareLink Monitor, CareLink Monitor, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D, Maximo II ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD, Protecta CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, Viva CRT-D, Brava CRT-D, Mirro MRI ICD Problem Types: CWE-284 Description: The Conexus telemetry protocol utilized wit
, Viva CRT-D, Brava CRT-D, Mirro MRI ICD Problem Types: CWE-284 Description: The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product, in situations where the product’s radio is turned on, can inject, replay, modif
ort-range access to an affected product, in situations where the product’s radio is turned on, can inject, replay, modify, and/or intercept data within the telemetry communication. This communication protocol provides the ability to read and write memory values to affected implanted cardiac devices; therefore, an attacker could exploit this communication protocol to change memory in the implanted cardiac device. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01 - http://www.securityfocus.com/bid/107544
CVE ID: CVE-2019-6539 State: PUBLISHED Published: 2019-02-13T00:00:00Z Last Updated: 2024-09-16T19:56:23.233Z Vendors: ICS-CERT Products: WECON LeviStudioU Problem Types: CWE-122 Description: Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106861 - https://ics-cert.us-cert.gov/advisories/ICSA-19-036-03
CVE ID: CVE-2019-6540 State: PUBLISHED Published: 2019-03-26T17:47:23 Last Updated: 2025-05-22T19:23:42.770Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Medtronic Products: Conexus Radio Frequency Telemetry Protocol, MyCareLink Monitor, CareLink Monitor, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D, Maximo II ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD, Protecta CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, Viva CRT-D, Brava CRT-D, Mirro MRI ICD Problem Types: CWE-319 Description: The Conexus telemetry protocol utilized withi