Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10059 State: PUBLISHED Published: 2019-08-28T21:28:37 Last Updated: 2024-08-04T22:10:09.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices. Additional Analyst Notes: - CVE Program Container: References: - http://support.lexmark.com/index?page=content&id=TE923&locale=EN&userlocale=EN_US
CVE ID: CVE-2019-10060 State: PUBLISHED Published: 2019-03-25T23:54:09 Last Updated: 2024-08-04T22:10:09.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execute arbitrary code via a long configuration key value. An attacker must be able to download files to the device in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2019-002.md
CVE ID: CVE-2019-10061 State: PUBLISHED Published: 2019-03-26T00:07:20 Last Updated: 2024-08-04T22:10:09.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/advisories/789 - https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b - https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563
CVE ID: CVE-2019-10062 State: PUBLISHED Published: 2021-05-13T20:27:29 Last Updated: 2024-08-04T22:10:09.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example. Additional Analyst Notes: - CVE Program Container: References: - https://aurelia.
plitting and nesting them for example. Additional Analyst Notes: - CVE Program Container: References: - https://aurelia.io - https://github.com/aurelia/templating-resources/blob/0cef07a8cac8e99146d8e1c4b734491bb3dc4724/src/html-sanitizer.js - https://www.gosecure.net/blog/2021/05/12/aurelia-framework-insecure-default-allows-xss/
CVE ID: CVE-2019-10063 State: PUBLISHED Published: 2019-03-26T13:40:19 Last Updated: 2024-08-04T22:10:09.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32
mplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flatpak/flatpak/issues/2782 - https://access.redhat.com/errata/RHSA-2019:1024 - https://access.redhat.com/errata/RHSA-2019:1143
CVE ID: CVE-2019-10064 State: PUBLISHED Published: 2020-02-28T14:07:14 Last Updated: 2024-08-04T22:10:09.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743. Additional Analyst Notes: - CVE Program Container: References: - https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389 - http://www.openwall.com/lists/oss-security/2020/02/27/1 - http://www.openwall.com/lists/oss-security/2020/02/27/2 - http://secl
www.openwall.com/lists/oss-security/2020/02/27/1 - http://www.openwall.com/lists/oss-security/2020/02/27/2 - http://seclists.org/fulldisclosure/2020/Feb/26 - http://www.openwall.com/lists/oss-security/2020/02/27/1 - http://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00010.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html
CVE ID: CVE-2019-10065 State: PUBLISHED Published: 2020-03-10T12:41:10 Last Updated: 2024-08-04T22:10:09.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6. An attacker who is logged into OTRS as a customer user can use the search result screens to disclose information from internal FAQ articles, a different vulnerability than CVE-2019-9753. Additional Analyst Notes: - CVE Program Container: References: - https://community.otrs.com/category/release-and-security-notes-en/ - https://otrs.com/release-notes/otrs-security-advisory-2019-07/
CVE ID: CVE-2019-10066 State: PUBLISHED Published: 2019-05-21T23:23:15 Last Updated: 2024-08-04T22:10:09.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment in order to cause execution of JavaScript in the context of OTRS. Additional Analyst Notes: - CVE Program Container: References: - https://community.otrs.com/security-advisory-2019-06-security-update-for-otrs-framework/
CVE ID: CVE-2019-10067 State: PUBLISHED Published: 2019-05-21T23:09:13 Last Updated: 2024-08-04T22:10:09.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS. Additional Analyst Notes: - CVE Program Container: References: - https://community.otrs.com/security-advisory-2019-05-security-update-for-otrs-framework/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg0
advisory-2019-05-security-update-for-otrs-framework/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE ID: CVE-2019-10068 State: PUBLISHED Published: 2019-03-26T17:43:23.000Z Last Updated: 2025-10-21T23:45:41.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
ion on the server where the Kentico instance was hosted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devnet.kentico.com/download/hotfixes#securityBugs-v12 - http://packetstormsecurity.com/files/157588/Kentico-CMS-12.0.14-Remote-Command-Execution.html
CVE ID: CVE-2019-10069 State: PUBLISHED Published: 2019-05-31T21:36:11 Last Updated: 2024-08-04T22:10:09.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly. Additional Analyst Notes: - CVE Program Container: References: - https://godotengine.org/news - https://github.com/godotengine/godot/pull/27398
CVE ID: CVE-2019-10070 State: PUBLISHED Published: 2019-11-18T20:05:31 Last Updated: 2024-08-04T22:10:09.252Z Vendors: Apache Products: Atlas Problem Types: Stored XSS Vulnerability Description: Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/cc21437c4c5053a13e13332d614d5172f39da03491fe17ae260be221%40%3Cdev.atlas.apache.org%3E
CVE ID: CVE-2019-10071 State: PUBLISHED Published: 2019-09-16T17:46:19 Last Updated: 2024-08-04T22:10:09.295Z Vendors: Apache Products: Apache Tapestry Problem Types: Information Disclosure Description: The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/6e8f42c88da7be3c60aafe3f6a85eb00b4f8b444
es: - CVE Program Container: References: - https://lists.apache.org/thread.html/6e8f42c88da7be3c60aafe3f6a85eb00b4f8b444de26b38d36233a43%40%3Cusers.tapestry.apache.org%3E - https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E - https://lists.apache.org/thread.html/7a437dad5af7309aba4d01bfc2463b3ac34e6aafaa565381d3a36460%40%3Cusers.tapestry.apache.org%3E - https://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843%40%3Ccommits.tapestry.apache.org%3E - https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3E
CVE ID: CVE-2019-10072 State: PUBLISHED Published: 2019-06-21T17:56:42 Last Updated: 2024-08-04T22:10:09.192Z Vendors: n/a Products: Apache Tomcat Problem Types: Denial of Service Description: The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108874 - https://usn.ubuntu.com/4128-1/ - https://usn.
Program Container: References: - http://www.securityfocus.com/bid/108874 - https://usn.ubuntu.com/4128-1/ - https://usn.ubuntu.com/4128-2/ - https://access.redhat.com/errata/RHSA-2019:3929 - https://access.redhat.com/errata/RHSA-2019:3931 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - h
lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://www.debian.org/security/2020/dsa-4680 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E - https://www.synology.com/
/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E - https://www.synology.com/security/advisory/Synology_SA_19_29 - https://security.netapp.com/advisory/ntap-20190625-0002/ - https://support.f5.com/csp/article/K17321505 - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2019-10073 State: PUBLISHED Published: 2019-09-11T20:34:02 Last Updated: 2024-08-04T22:10:09.190Z Vendors: Apache Products: OFBiz Problem Types: XSS vulnerability Description: The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616 Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/w6edy - https://lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.or
tml/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f%40%3Ccommits.ofbiz.apache.org%3E
CVE ID: CVE-2019-10074 State: PUBLISHED Published: 2019-09-11T20:38:56 Last Updated: 2024-08-04T22:10:09.294Z Vendors: Apache Products: OFBiz Problem Types: RCE Description: An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533 Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/r49vw
t on branch 16.11: r1858533 Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/r49vw - https://lists.apache.org/thread.html/a02aaa4c19dfd520807cf6b106b71aad0131a6543f7f60802ae71ec2%40%3Cnotifications.ofbiz.apache.org%3E
CVE ID: CVE-2019-10075 State: REJECTED Published: 2019-12-03T14:31:14 Last Updated: 2019-12-03T14:31:14 Description: No description available.
CVE ID: CVE-2019-10076 State: PUBLISHED Published: 2019-05-20T20:31:41 Last Updated: 2024-08-04T22:10:09.207Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: Cross-site scripting vulnerability Description: A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/05/19/4 - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-1007
- http://www.openwall.com/lists/oss-security/2019/05/19/4 - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10076 - http://www.securityfocus.com/bid/108437
CVE ID: CVE-2019-10077 State: PUBLISHED Published: 2019-05-20T20:46:15 Last Updated: 2024-08-04T22:10:09.440Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: Cross-site scripting vulnerability Description: A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/05/19/5 - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10077 - ht
p://www.openwall.com/lists/oss-security/2019/05/19/5 - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10077 - http://www.securityfocus.com/bid/108437
CVE ID: CVE-2019-10078 State: PUBLISHED Published: 2019-05-20T20:50:54 Last Updated: 2024-08-04T22:10:09.382Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: Cross-site scripting vulnerability Description: A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/24f324ef11e43ba89ec9aac3725a5ecd4289835639c476299e7660d9%40%3Cdev.jspwiki.apache.org%3E - htt
sts.apache.org/thread.html/24f324ef11e43ba89ec9aac3725a5ecd4289835639c476299e7660d9%40%3Cdev.jspwiki.apache.org%3E - https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/05/19/6 - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078 - https://lists.apache.org/thread.html/959811b776e1a332a1a4295405b683fd64190d079a7c3028f1c314d7%40%3Cdev.jspwiki.apache.org%3E - http://www.securityfocus.com/bid/108437
CVE ID: CVE-2019-10079 State: PUBLISHED Published: 2019-10-22T15:42:35 Last Updated: 2024-08-04T22:10:09.532Z Vendors: n/a Products: Apache Traffic Server Problem Types: DOS Attack Description: Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E - https://lists.apache.org/thr
2309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E - https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E - https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
CVE ID: CVE-2019-10080 State: PUBLISHED Published: 2019-11-19T21:32:11 Last Updated: 2024-08-04T22:10:09.485Z Vendors: n/a Products: Apache NiFi Problem Types: Information Disclosure Description: The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%
s://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://nifi.apache.org/security.html#CVE-2019-10080
CVE ID: CVE-2019-10081 State: PUBLISHED Published: 2019-08-15T21:02:49 Last Updated: 2024-08-04T22:10:09.413Z Vendors: n/a Products: Apache HTTP Server Problem Types: mod_http2, memory corruption on early pushes Description: HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4509 - https://seclists.org/bugtraq/2019/Aug/47 - https://usn.ubuntu.com/4113-1/ -
s://www.debian.org/security/2019/dsa-4509 - https://seclists.org/bugtraq/2019/Aug/47 - https://usn.ubuntu.com/4113-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html - https://security.gentoo.org/glsa/201909-04 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://httpd
ty-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20190905-0003/ - https://support.f5.com/csp/article/K84341091?utm_source=f5support&amp%3Butm_medium=RSS - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https:/
.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea9
b2e36%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2019-10082 State: PUBLISHED Published: 2019-09-26T14:40:39 Last Updated: 2024-08-04T22:10:09.458Z Vendors: n/a Products: Apache HTTP Server Problem Types: mod_http2, write beyond array on h2 push Description: In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.or
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690