Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-14927 State: PUBLISHED Published: 2019-10-28T12:08:22 Last Updated: 2024-09-10T17:10:01.107018 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulnerability allows an attacker to download the smartRTU's configuration file (which contains data such as usernames, passwords, and other sensitive RTU data). Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/ - https://www.mogozobo.com/?p=3593
CVE ID: CVE-2019-14928 State: PUBLISHED Published: 2019-10-28T12:09:14 Last Updated: 2024-09-10T17:10:56.429899 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script (XSS) vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to stored XSS is SerialInitialModemString in the index.php page. Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/ - https://www.mogozobo.com/?p=3593
CVE ID: CVE-2019-14929 State: PUBLISHED Published: 2019-10-28T12:11:44 Last Updated: 2024-09-10T17:11:52.794131 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. An unauthenticated user can obtain the exposed password credentials to gain access to the following services: DDNS service, Mobile Network Provider, and OpenVPN service. Additional Analyst Notes: - CVE Program Container:
services: DDNS service, Mobile Network Provider, and OpenVPN service. Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/ - https://www.mogozobo.com/?p=3593
CVE ID: CVE-2019-14930 State: PUBLISHED Published: 2019-10-28T12:10:55 Last Updated: 2024-09-10T17:02:59.676467 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.) Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/ - h
/etc/sudoers on the RTU.) Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/ - https://www.mogozobo.com/?p=3593
CVE ID: CVE-2019-14931 State: PUBLISHED Published: 2019-10-28T12:07:23 Last Updated: 2024-09-10T17:04:23.308312 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An
via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data. Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/ - https://www.mogozobo.com/?p=3593
CVE ID: CVE-2019-14932 State: PUBLISHED Published: 2019-08-12T12:46:28 Last Updated: 2024-08-05T00:34:52.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates' information on the website via a modified selApp variable to personalData/resumeDetail.cfm. This includes personal information and other sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/donut117/1ddbb8290a1186502da81b46a5d53c63
CVE ID: CVE-2019-14933 State: PUBLISHED Published: 2019-08-11T20:56:09 Last Updated: 2024-08-05T00:34:52.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bagisto 0.1.5 allows CSRF under /admin URIs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bagisto/bagisto/issues/750 - https://forums.bagisto.com/category/1/announcements
CVE ID: CVE-2019-14934 State: PUBLISHED Published: 2019-08-11T21:28:22 Last Updated: 2024-08-05T00:34:52.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and out-of-bounds write. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/enferex/pdfresurrect/commit/0c4120fffa3dffe97b95c486a120eded82afe8a6 - https://github.com/enferex/pdfresurrect/compare/v0.17...v0.18 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DBYXYU2VSDJ3NAL54IW2KYD3TZSR33M/ - h
fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DBYXYU2VSDJ3NAL54IW2KYD3TZSR33M/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXN6W5QTNQJ2LFDCQWKYSMMZ3NPUWP3U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y243C2IFMRFQWHV62JCSHTMQGDDCICNF/ - https://lists.debian.org/debian-lts-announce/2020/12/msg00002.html
CVE ID: CVE-2019-14935 State: PUBLISHED Published: 2019-08-11T23:03:43 Last Updated: 2024-08-05T00:34:52.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and leading to privilege escalation because of a StartUp link. Additional Analyst Notes: - CVE Program Container: References: - https://www.3cx.com/community/threads/security-issue-with-3cx-windows-client-install.64432/
CVE ID: CVE-2019-14936 State: PUBLISHED Published: 2019-09-11T18:01:27 Last Updated: 2024-08-05T00:34:52.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Additional Analyst Notes: - CVE Program Container: References: - https://www.blackdragon.team/contents/index.php/cves/cve-2019-14936/
CVE ID: CVE-2019-14937 State: PUBLISHED Published: 2019-08-17T16:15:20 Last Updated: 2024-08-05T00:34:52.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data. Additional Analyst Notes: - CVE Program Container: References: - https://projectredcap.org/resources/community/ - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://gist.github.com/hiennv20/6739606a4d0d
tps://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://gist.github.com/hiennv20/6739606a4d0d25612f5139ec391060b7
CVE ID: CVE-2019-14939 State: PUBLISHED Published: 2019-08-12T00:51:33 Last Updated: 2024-08-05T00:34:53.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mysqljs/mysql/issues/2257
CVE ID: CVE-2019-14940 State: PUBLISHED Published: 2019-08-12T01:36:19 Last Updated: 2024-08-05T00:34:52.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spdk/spdk/releases/tag/v19.07
CVE ID: CVE-2019-14941 State: PUBLISHED Published: 2020-04-27T16:08:24 Last Updated: 2024-08-05T00:34:52.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set of data). This could lead to a system denial of service due to uncontrolled memory allocation. Additional Analyst Notes: - CVE Program Container: References: - https://shareit.one/blog/ - https://github.com/nathunandwani/shareit-cwe-789
CVE ID: CVE-2019-14942 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T17:07:36.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitlab-pages/issues/232 - https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/
CVE ID: CVE-2019-14943 State: PUBLISHED Published: 2019-08-29T11:58:32 Last Updated: 2024-08-05T00:34:52.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4530 - https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/
CVE ID: CVE-2019-14944 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T17:04:10.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitaly/issues/1801 - https://gitlab.com/gitlab-org/gitaly/issues/1802 - https://about.gitlab.com/releases/2019
itlab-org/gitaly/issues/1801 - https://gitlab.com/gitlab-org/gitaly/issues/1802 - https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/
CVE ID: CVE-2019-14945 State: PUBLISHED Published: 2019-08-12T15:29:32 Last Updated: 2024-08-05T00:34:52.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ultimate-member plugin before 2.0.54 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ultimate-member/#developers - https://wpvulndb.com/vulnerabilities/9506
CVE ID: CVE-2019-14946 State: PUBLISHED Published: 2019-08-12T15:29:05 Last Updated: 2024-08-05T00:34:52.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ultimate-member/#developers - https://wpvulndb.com/vulnerabilities/9449
CVE ID: CVE-2019-14947 State: PUBLISHED Published: 2019-08-12T15:27:56 Last Updated: 2024-08-05T00:34:52.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/ultimate-member/#developers - https://wpvulndb.com/vulnerabilities/9449
CVE ID: CVE-2019-14948 State: PUBLISHED Published: 2019-08-12T14:57:52 Last Updated: 2024-08-05T00:34:52.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9502 - https://wordpress.org/plugins/woocommerce-product-addon/#developers - https://www.pluginvulnerabilities.com/2019/08/08/this-authenticated-persistent-xss-vulnerability-might-be-what-hackers-are-targeting-ppom-for-woocommerce-for/
CVE ID: CVE-2019-14949 State: PUBLISHED Published: 2019-08-12T14:56:59 Last Updated: 2024-08-05T00:34:53.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-database-backup plugin before 5.1.2 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-database-backup/#developers - https://wpvulndb.com/vulnerabilities/9548
CVE ID: CVE-2019-14950 State: PUBLISHED Published: 2019-08-12T14:50:49 Last Updated: 2024-08-05T00:34:52.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-live-chat-support/#developers
CVE ID: CVE-2019-14951 State: PUBLISHED Published: 2019-08-12T15:15:51 Last Updated: 2024-08-05T00:34:52.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as demonstrated by a DrivingRestriction method call to uma/jsonrpc/mobile. Additional Analyst Notes: - CVE Program Container: References: - https://sites.google.com/site/iosappnss/more-vulnerable-apps-and-libraries
CVE ID: CVE-2019-14952 State: PUBLISHED Published: 2019-10-01T13:24:20 Last Updated: 2024-08-05T00:34:52.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14953 State: PUBLISHED Published: 2019-10-01T15:48:39 Last Updated: 2024-08-05T00:34:52.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14954 State: PUBLISHED Published: 2019-10-01T13:22:24 Last Updated: 2024-08-05T00:34:52.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14955 State: PUBLISHED Published: 2019-10-01T15:50:27 Last Updated: 2024-08-05T00:34:52.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14956 State: PUBLISHED Published: 2019-10-02T18:41:19 Last Updated: 2024-08-05T00:34:53.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14957 State: PUBLISHED Published: 2019-10-01T15:39:44 Last Updated: 2024-08-05T00:34:52.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14958 State: PUBLISHED Published: 2019-10-02T18:40:23 Last Updated: 2024-08-05T00:34:52.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very specific situation, it could lead to a remote invocation of an OOM error message because of Uncontrolled Memory Allocation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14959 State: PUBLISHED Published: 2019-10-02T18:37:57 Last Updated: 2024-08-05T00:34:53.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14960 State: PUBLISHED Published: 2019-10-01T15:51:55 Last Updated: 2024-08-05T00:34:52.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14961 State: PUBLISHED Published: 2019-10-01T16:43:04 Last Updated: 2024-08-05T00:34:53.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-14965 State: PUBLISHED Published: 2019-08-12T17:21:58 Last Updated: 2024-08-05T00:34:52.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/frappe/pull/8044 - https://github.com/frappe/frappe/pull/8045 - https://github.com/frappe/frappe/pull/8046 - https://github.com/frappe/frappe/pull/8047 - https://github.com/frappe/frappe/compare/v12.0.3...v12.0.4 - https://github.com/frappe/frappe/releases/tag/v12.0.4
CVE ID: CVE-2019-14966 State: PUBLISHED Published: 2019-08-12T17:21:44 Last Updated: 2024-08-05T00:34:53.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/frappe/pull/8044 - https://github.com/frappe/frappe/pull/8045 - https://github.com/frappe/frappe/pull/8046 - https://github.com/frappe/frappe/pull/8047 - https://github.com/frappe/frappe/compare/v12.0.3...v12.0.4 - https://github.com/frappe/frappe/releases/tag/v12.0.4
CVE ID: CVE-2019-14967 State: PUBLISHED Published: 2019-08-12T17:21:30 Last Updated: 2024-08-05T00:34:52.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/frappe/pull/7981 - https://github.com/frappe/frappe/releases/tag/v11.1.46 - https://github.com/frappe/frappe/compare/v11.1.45...v11.1.46
CVE ID: CVE-2019-14968 State: PUBLISHED Published: 2019-08-12T17:56:01 Last Updated: 2024-08-05T00:34:52.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/peacexie/imcat/issues/2
CVE ID: CVE-2019-14969 State: PUBLISHED Published: 2019-08-12T18:17:59 Last Updated: 2024-08-05T00:34:53.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folders. In addition, the service Netwrix.ADA.StorageAuditService (which writes to that directory) does not perform proper impersonation, and thus the target file will have the same permissions as the invoking process (in this case, granting Authenticated Users full access over the target file). This vulnerability can be triggered by a low-privileged user to perform DLL Hijacking/Binary Planting attacks and ultim
This vulnerability can be triggered by a low-privileged user to perform DLL Hijacking/Binary Planting attacks and ultimately execute code as NT AUTHORITY\SYSTEM with the help of Symbolic Links. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-010.md
CVE ID: CVE-2019-14970 State: PUBLISHED Published: 2019-08-29T18:55:11 Last Updated: 2024-08-05T00:34:52.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019 - https://www.debian.org/security/2019/dsa-4504 - https://seclists.org/bugtraq/2019/Aug/36 - https://www.videolan.org/security/sb-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131
ps://www.videolan.org/security/sb-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE ID: CVE-2019-14973 State: PUBLISHED Published: 2019-08-14T05:15:29 Last Updated: 2024-08-05T00:34:53.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/merge_requests/90 - https://lists.debian.org/debian-lts-announce/2019/08/msg00031.html - https://seclists.org/bugtraq/2019/Nov/5 - http://packetstormsecurity.com/files/155095/Sla