Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-25043 State: PUBLISHED Published: 2021-05-06T16:32:34 Last Updated: 2024-08-05T03:00:19.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SpiderLabs/ModSecurity/issues/2566
CVE ID: CVE-2019-25044 State: PUBLISHED Published: 2021-05-14T22:57:29 Last Updated: 2024-08-05T03:00:18.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2 - https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-blk_mq_free_rqs - https://syzkaller.appspot.com/bug?id=36fe241584203cf394d44560a42e3430434f1213
n-use-after-free-read-in-blk_mq_free_rqs - https://syzkaller.appspot.com/bug?id=36fe241584203cf394d44560a42e3430434f1213 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c3e2219216c92919a6bd1711f340f5faa98695e6 - https://security.netapp.com/advisory/ntap-20210629-0006/
CVE ID: CVE-2019-25045 State: PUBLISHED Published: 2021-06-07T19:19:06 Last Updated: 2024-08-05T03:00:19.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.19 - https://syzkaller.appspot.com/bug?id=f99edaeec58ad40380ed5813d89e205861be2896 - https://sites.google.com/view/syzscope/warning-in-xfrm_state_fini-2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbb2483b2a46fba
ing-in-xfrm_state_fini-2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399 - https://security.netapp.com/advisory/ntap-20210720-0003/
CVE ID: CVE-2019-25046 State: PUBLISHED Published: 2021-06-10T11:39:28 Last Updated: 2024-08-05T03:00:18.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document. Additional Analyst Notes: - CVE Program Container: References: - https://www.cerberusftp.com/products/releasenotes/ - https://www.cerberusftp.com/xss-vulnerability-when-previewing-svg-content/
CVE ID: CVE-2019-25047 State: PUBLISHED Published: 2021-06-21T14:08:38 Last Updated: 2024-08-05T03:00:18.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Greenbone Security Assistant (GSA) before 8.0.2 and Greenbone OS (GOS) before 5.0.10 allow XSS during 404 URL handling in gsad. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/greenbone/gsa/issues/1601 - https://github.com/greenbone/gsa/pull/1603 - https://github.com/greenbone/gsa/blob/master/CHANGELOG.md#802---2020-05-13
CVE ID: CVE-2019-25048 State: PUBLISHED Published: 2021-07-01T02:53:25 Last Updated: 2024-08-05T03:00:19.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libressl-portable/portable/commit/17c88164016df821df2dff4b2b1291291ec4f28a - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13914 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libressl/OSV-2020-1923.yaml
CVE ID: CVE-2019-25049 State: PUBLISHED Published: 2021-07-01T02:53:38 Last Updated: 2024-08-05T03:00:18.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libressl-portable/portable/commit/17c88164016df821df2dff4b2b1291291ec4f28a - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13920 - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libressl/OSV-2020-1965.yaml
CVE ID: CVE-2019-25050 State: PUBLISHED Published: 2021-07-20T06:46:38 Last Updated: 2024-08-05T03:00:18.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gdal/OSV-2020-392.yaml - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gdal/OSV-2020-420.yaml - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15143 - https://
zz-vulns/blob/main/vulns/gdal/OSV-2020-420.yaml - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15143 - https://github.com/OSGeo/gdal/commit/767e3a56144f676ca738ef8f700e0e56035bd05a - https://github.com/OSGeo/gdal/commit/27b9bf644bcf1208f7d6594bdd104cc8a8bb0646 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15156
CVE ID: CVE-2019-25051 State: PUBLISHED Published: 2021-07-20T06:46:25 Last Updated: 2024-08-05T03:00:19.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/google/oss-fuzz-vulns/blob/main/vulns/aspell/OSV-2020-521.yaml - https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18462 - https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html -
s.chromium.org/p/oss-fuzz/issues/detail?id=18462 - https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7E4EI7F6TVN7K6XWU6HSANMCOKKEREE/ - https://www.debian.org/security/2021/dsa-4948
CVE ID: CVE-2019-25052 State: PUBLISHED Published: 2021-08-11T14:59:12 Last Updated: 2024-08-05T03:00:18.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OP-TEE/optee_os/security/advisories/GHSA-pgwr-qmgh-vhmf - https://github.com/OP-TEE/optee_os/commit/34a08bec755670ea0490cb53bbc68058cafc69b6
CVE ID: CVE-2019-25053 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T19:21:51.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.on-x.com/wp-content/uploads/2023/01/on-x_-_security_advisory_-_sage_frp_1000_-_cve-2019-25053.pdf
CVE ID: CVE-2019-25054 State: PUBLISHED Published: 2021-12-26T21:54:36 Last Updated: 2024-08-05T03:00:19.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0037.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/pnet/RUSTSEC-2019-0037.md
CVE ID: CVE-2019-25055 State: PUBLISHED Published: 2021-12-26T21:54:23 Last Updated: 2024-08-05T03:00:19.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0038.html - https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libpulse-binding/RUSTSEC-2019-0038.md
CVE ID: CVE-2019-25056 State: PUBLISHED Published: 2022-01-26T04:20:10 Last Updated: 2024-08-05T03:00:19.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing which resources are blocked and which aren't can identify the application version and defeat the User-Agent protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bromite/bromite/issues/2#issuecomment-524102774
CVE ID: CVE-2019-25057 State: PUBLISHED Published: 2022-02-14T20:10:10 Last Updated: 2024-08-05T03:00:19.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer. Additional Analyst Notes: - CVE Program Container: References: - https://docs.r3.com/en/platform/corda/4.1/open-source/release-notes.html
CVE ID: CVE-2019-25058 State: PUBLISHED Published: 2022-02-24T01:53:33 Last Updated: 2024-08-05T03:00:19.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devices to be connected in the future. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/USBGuard/usbguard/issues/273 - https://github.com/USBGuard/usbguard/issues/403 - https://github.com/USBGuard/usbguard/pull/531 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2ET6DU4IA64M6TMQ4X3SG2L6TR
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2ET6DU4IA64M6TMQ4X3SG2L6TRPLDN6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3HQVTHHJFQLSWSXA7W3ZHRF72YMPI46/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4QO5J5YEWVX27QXYOGL3BDRV3KXNRQI/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00010.html
CVE ID: CVE-2019-25059 State: PUBLISHED Published: 2022-04-25T03:29:14 Last Updated: 2024-08-05T03:00:19.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. Additional Analyst Notes: - CVE Program Container: References: - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=430e219ea17a2650577d70021399c4ead05869e0 - https://lists.debian.org/debian-lts-announce/2022/05/msg00000.html
CVE ID: CVE-2019-25060 State: PUBLISHED Published: 2022-05-09T16:50:25 Last Updated: 2024-08-05T03:00:19.088Z Vendors: Unknown Products: WPGraphQL Problem Types: CWE-284 Description: The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/393be73a-f8dc-462f-8670-f20ab89421fc - https://github.com/wp-graphql/wp-graphql/pull/900
CVE ID: CVE-2019-25061 State: PUBLISHED Published: 2022-05-18T05:49:20 Last Updated: 2024-08-05T03:00:19.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23 - https://ruby-doc.org/core-3.1.2/Random.html - https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-o
uby-doc.org/core-3.1.2/Random.html - https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560 - https://github.com/bvsatyaram/random_password_generator/pull/1
CVE ID: CVE-2019-25062 State: PUBLISHED Published: 2022-06-04T05:00:16.000Z Last Updated: 2025-04-15T14:33:32.046Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Sricam Products: IP CCTV Camera Problem Types: CWE-121 Description: A vulnerability was found in Sricam IP CCTV Camera and classified as critical. This issue affects some unknown processing of the component Device Viewer. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/47477 -
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/47477 - https://vuldb.com/?id.159431
CVE ID: CVE-2019-25063 State: PUBLISHED Published: 2022-06-04T05:00:17.000Z Last Updated: 2025-04-15T14:33:25.498Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Sricam Products: IP CCTV Camera Problem Types: CWE-119 Description: A vulnerability was found in Sricam IP CCTV Camera. It has been classified as critical. Affected is an unknown function of the component Device Viewer. The manipulation leads to memory corruption. Local access is required to approach this attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.159432
CVE ID: CVE-2019-25064 State: PUBLISHED Published: 2022-06-09T13:10:24.000Z Last Updated: 2025-04-15T14:31:38.145Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CoreHR Products: Core Portal Problem Types: CWE-352 Description: A vulnerability was found in CoreHR Core Portal up to 27.0.7. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. Upgrading to version 27.0.8 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
ade the affected component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.146832
CVE ID: CVE-2019-25065 State: PUBLISHED Published: 2022-06-09T13:10:26.000Z Last Updated: 2025-04-15T14:31:26.655Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: OpenNetAdmin Problem Types: CWE-78 Description: A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0day.today/exploit/33544 - https://vuldb.com/?id.1467
Program Container: - CISA ADP Vulnrichment: References: - https://0day.today/exploit/33544 - https://vuldb.com/?id.146798
CVE ID: CVE-2019-25066 State: PUBLISHED Published: 2022-06-09T13:10:27.000Z Last Updated: 2025-04-15T14:31:12.770Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: ajenti Problem Types: CWE-269 Description: A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgra
ble to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/47497 - https://github.com/ajenti/ajenti/commit/7aa146b724e0e20cfee2c71ca78fafbf53a8767c - https://vuldb.com/?id.143950
CVE ID: CVE-2019-25067 State: PUBLISHED Published: 2022-06-09T13:10:29 Last Updated: 2024-08-05T03:00:19.039Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Podman, Varlink Problem Types: Privilege Escalation Description: A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-143949 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References
identifier VDB-143949 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.143949 - https://vuldb.com/?ctiid.143949 - https://www.exploit-db.com/exploits/47500 - https://github.com/containers/podman/issues/21628
CVE ID: CVE-2019-25068 State: PUBLISHED Published: 2022-06-09T13:10:31.000Z Last Updated: 2025-04-15T14:31:00.913Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Axios Italia Products: Axios RE Problem Types: CWE-269 Description: A vulnerability classified as critical was found in Axios Italia Axios RE 1.7.0/7.0.0. This vulnerability affects unknown code of the file REDefault.aspx of the component Connection Handler. The manipulation of the argument DBIDX leads to privilege escalation. The attack can be initiated remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.139528
CVE ID: CVE-2019-25069 State: PUBLISHED Published: 2022-06-09T13:10:32.000Z Last Updated: 2025-04-15T14:30:50.640Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Axios Italia Products: Axios RE Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, has been found in Axios Italia Axios RE 1.7.0/7.0.0. This issue affects some unknown processing of the component Error Message Handler. The manipulation leads to information disclosure (ASP.NET). The attack may be initiated remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.139528 - https://vuldb.com/?id.1395
CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.139528 - https://vuldb.com/?id.139529
CVE ID: CVE-2019-25070 State: PUBLISHED Published: 2022-06-09T13:10:34 Last Updated: 2024-08-05T03:00:19.026Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: WolfCMS Problem Types: CWE-80 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in WolfCMS up to 0.8.3.1. It has been rated as problematic. This issue affects some unknown processing of the file /wolfcms/?/admin/user/add of the component User Add. The manipulation of the argument name leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-135125 was assigned to this vulner
ely. The exploit has been disclosed to the public and may be used. The identifier VDB-135125 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.135125 - https://vuldb.com/?ctiid.135125 - https://github.com/wolfcms/wolfcms/issues/683
CVE ID: CVE-2019-25071 State: PUBLISHED Published: 2022-06-25T06:10:12.000Z Last Updated: 2025-05-30T16:45:36.998Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Apple Products: iOS Problem Types: CWE-269 Description: A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the atta
ce and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.scip.ch/en/?labs.20191010 - https://youtu.be/AeuGjMbAirU - https://vuldb.com/?id.143125
CVE ID: CVE-2019-25072 State: PUBLISHED Published: 2022-12-27T21:13:24.222Z Last Updated: 2025-04-11T16:40:25.817Z Vendors: github.com/tendermint/tendermint Products: github.com/tendermint/tendermint/rpc/lib/client Problem Types: CWE-400: Uncontrolled Resource Consumption Description: Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tendermint/tendermint/pull/3430 - https://github.com/tenderm
: - CISA ADP Vulnrichment: References: - https://github.com/tendermint/tendermint/pull/3430 - https://github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613 - https://pkg.go.dev/vuln/GO-2020-0037
CVE ID: CVE-2019-25073 State: PUBLISHED Published: 2022-12-27T21:13:17.493Z Last Updated: 2025-04-11T22:51:40.014Z Vendors: github.com/goadesign/goa, goa.design/goa, goa.design/goa/v3 Products: github.com/goadesign/goa, goa.design/goa, goa.design/goa/v3 Problem Types: CWE-22: Improper Limitation of a Pathname to a Restricted Directory('Path Traversal') Description: Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/goadesign/goa/pull/2388 - https://github.com/goadesign/goa/com
- CISA ADP Vulnrichment: References: - https://github.com/goadesign/goa/pull/2388 - https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39 - https://pkg.go.dev/vuln/GO-2020-0032