Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
xists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html - https://www.debian.org/security/2019/dsa-4542 - https://seclists.org/bugtraq/2019/Oct/6 - https://lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370%40%3Cissues.geode.apache.org%3E - https://lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5%40%3Cissues.geode.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.
13084e176d0df5%40%3Cissues.geode.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/ - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/ - https://access.redhat.com/errata/RHSA-2019:3901 - https://lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954%40%3Cissues.geode.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0164 - https://access.redhat.com/errata/RHSA-2020:0159 - https://access.redhat.com/errata/RHSA-2020:0160 - https://access.redhat.com/errata/RHSA-2020:0161 - https://access.redhat.com/errata/RHSA-2020:0445 - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpuapr2020.ht
ackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://github.com/FasterXML/jackson-databind/issues/2478 - https://issues.apache.org/jira/browse/GEODE-7255 - https://security.netapp.com/advisory/ntap-20191017-0006/ - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E - https://www.oracle.com/secur
rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2019-16943 State: PUBLISHED Published: 2019-10-01T16:06:23 Last Updated: 2024-08-05T01:24:48.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling. Additional Analyst Notes: - CVE Program Container: References
because of com.p6spy.engine.spy.P6DataSource mishandling. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html - https://www.debian.org/security/2019/dsa-4542 - https://seclists.org/bugtraq/2019/Oct/6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/ - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.ht
9eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/ - https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E - https://lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd%40%3Ccommits.iceberg.apache.org%3E - https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c
its.iceberg.apache.org%3E - https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0164 - https://access.redhat.com/errata/RHSA-2020:0159 - https://access.redhat.com/errata/RHSA-2020:0160 - https://access.redhat.com/errata/RHSA-2020:0161 - https://access.redhat.com/errata/RHSA-2020:0445 - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://github
www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://github.com/FasterXML/jackson-databind/issues/2478 - https://security.netapp.com/advisory/ntap-20191017-0006/ - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2019-16948 State: PUBLISHED Published: 2019-11-13T17:01:22 Last Updated: 2024-08-05T01:24:48.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network (as opposed to what general web traffic would see on the product's host). The response from open ports is different than from closed ports. The product does not allow one to change the protocol: anything except http(s) will throw an error; however, it is the type of error that allo
llow one to change the protocol: anything except http(s) will throw an error; however, it is the type of error that allows one to determine if a port is open or not. Additional Analyst Notes: - CVE Program Container: References: - https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/
CVE ID: CVE-2019-16949 State: PUBLISHED Published: 2019-11-13T17:37:36 Last Updated: 2024-08-05T01:24:48.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat (where the user enters in their name and e-mail address). This POST request can be modified to change the message as well as the end recipient of the message. The e-mail address will have the same domain name and user as the product allotted. This can be used in phishing campaigns against users on the same domain. Additional Analyst Notes: - C
product allotted. This can be used in phishing campaigns against users on the same domain. Additional Analyst Notes: - CVE Program Container: References: - https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/
CVE ID: CVE-2019-16950 State: PUBLISHED Published: 2019-11-13T18:12:39 Last Updated: 2024-08-05T01:24:48.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/
CVE ID: CVE-2019-16951 State: PUBLISHED Published: 2019-11-13T18:47:22 Last Updated: 2024-08-05T01:24:48.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amount of information sent in the request from this product to the attacker: it reveals information the public should not have. This includes pathnames and internal ip addresses. Additional Analyst Notes: - CVE Program Container: Refere
d not have. This includes pathnames and internal ip addresses. Additional Analyst Notes: - CVE Program Container: References: - https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/
CVE ID: CVE-2019-16954 State: PUBLISHED Published: 2021-01-06T16:53:20 Last Updated: 2024-08-05T01:24:48.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/ - https://www.solarwinds.com/free-tools/free-help-desk-software - https://www.esecforte.com/html-injection-vulnerability-in-solarwinds-web-help-desk/
CVE ID: CVE-2019-16955 State: PUBLISHED Published: 2020-12-18T08:55:56 Last Updated: 2024-08-05T01:24:48.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/ - https://www.solarwinds.com/free-tools/free-help-desk-software - https://www.esecforte.com/cross-site-scripting-via-file-upload-vulnerability-in-solarwinds-web-help-desk/
CVE ID: CVE-2019-16956 State: PUBLISHED Published: 2021-01-04T07:56:50 Last Updated: 2024-08-05T01:24:48.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/ - https://www.solarwinds.com/free-tools/free-help-desk-software - https://www.esecforte.com/cross-site-scripting-vulnerability-india-responsible-vulnerability-disclosure/
CVE ID: CVE-2019-16957 State: PUBLISHED Published: 2020-12-18T08:53:24 Last Updated: 2024-08-05T01:24:48.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/ - https://www.solarwinds.com/free-tools/free-help-desk-software - https://www.esecforte.com/cross-site-scripting-vulnerability-in-solarwinds-web-help-desk/
CVE ID: CVE-2019-16958 State: PUBLISHED Published: 2020-12-01T17:57:13 Last Updated: 2024-08-05T01:24:48.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/free-tools/free-help-desk-software - https://www.esecforte.com/cross-site-scripting-vulnerability-with-solarwinds-web-help-desk/
CVE ID: CVE-2019-16959 State: PUBLISHED Published: 2020-12-21T15:13:21 Last Updated: 2024-08-05T01:24:48.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/ - https://www.solarwinds.com/free-tools/free-help-desk-software - https://www.esecforte.com/formula-injection-vulnerability-india-in-solarwinds-web-help-desk/
CVE ID: CVE-2019-16960 State: PUBLISHED Published: 2021-01-04T08:00:34 Last Updated: 2024-08-05T01:24:48.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/ - https://www.solarwinds.com/free-tools/free-help-desk-software - https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16960-cross-site-scripting-vulnerability-in-solarwinds-web-help-desk/
CVE ID: CVE-2019-16961 State: PUBLISHED Published: 2021-01-15T13:28:14 Last Updated: 2024-08-05T01:24:48.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/ - https://www.solarwinds.com/free-tools/free-help-desk-software - https://www.esecforte.com/cross-site-scripting-vulnerability-in-solarwinds-web-help-desk-cve-2019-16961-responsible-vulnerability-disclosure/
CVE ID: CVE-2019-16962 State: PUBLISHED Published: 2021-01-06T16:55:08 Last Updated: 2024-08-05T01:24:48.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/download.html - https://www.esecforte.com/manage-engine-desktopcentral-india-html-injection-vulnerability/
CVE ID: CVE-2019-16964 State: PUBLISHED Published: 2019-10-21T18:15:03 Last Updated: 2024-08-05T01:24:48.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated attackers (with at least the permission call_center_queue_add or call_center_queue_edit) to execute any commands on the host as www-data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/2f9e591a4034c3aea70185dcab837946096449bf - https://resp3ctblog.wordpress.com/2019/10/19/fus
m/fusionpbx/fusionpbx/commit/2f9e591a4034c3aea70185dcab837946096449bf - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-sofia-api-command-injection-1/
CVE ID: CVE-2019-16965 State: PUBLISHED Published: 2019-10-21T18:45:21 Last Updated: 2024-08-05T01:24:48.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/6baad9af1bc55c80b793af3bd1ac35b39c20b173 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-sofia-api-command-injection-2/
CVE ID: CVE-2019-16966 State: PUBLISHED Published: 2019-10-21T18:57:44 Last Updated: 2024-08-05T01:24:48.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager. Additional Analyst Notes: - CVE Program Container: References: - https://issues.freepbx.org/browse/FREEPBX-20437 - https:
dditional Analyst Notes: - CVE Program Container: References: - https://issues.freepbx.org/browse/FREEPBX-20437 - https://github.com/FreePBX/contactmanager/commit/99e5aa0050224289cfe64c9036f38ce2531bf633 - https://resp3ctblog.wordpress.com/2019/10/19/freepbx-xss-1/
CVE ID: CVE-2019-16967 State: PUBLISHED Published: 2019-10-21T19:10:13 Last Updated: 2024-08-05T01:24:48.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\admin\modules\manager\views\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to /config.php?type=tool&display=manager. Additional Analyst Notes: - CVE Program Container: References: - https://issues.freepbx.org/browse/FREEPBX-20436 - https://github.com/FreePBX/manager/commit/071a50983ca6a373bb2d1d
es: - https://issues.freepbx.org/browse/FREEPBX-20436 - https://github.com/FreePBX/manager/commit/071a50983ca6a373bb2d1d3db68e9eda4667a372 - https://resp3ctblog.wordpress.com/2019/10/19/freepbx-xss-2/
CVE ID: CVE-2019-16968 State: PUBLISHED Published: 2019-10-21T19:30:38 Last Updated: 2024-08-05T01:24:48.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FusionPBX up to 4.5.7. In the file app\conference_controls\conference_control_details.php, an unsanitized id variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/02378c54722d89f875c66ddb00ff06468dabbc6d - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-1/
CVE ID: CVE-2019-16969 State: PUBLISHED Published: 2019-10-21T20:37:59 Last Updated: 2024-08-05T01:24:48.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/d3679bbeface57a21f6623cbc193b04a7fc0a885 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-2/
CVE ID: CVE-2019-16970 State: PUBLISHED Published: 2019-10-21T19:52:22 Last Updated: 2024-08-05T01:24:48.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\sip_status\sip_status.php uses an unsanitized "savemsg" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/a55f1cd5d8edd655058152e9acf212680d5b75f3 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-3/
CVE ID: CVE-2019-16971 State: PUBLISHED Published: 2019-10-22T21:16:56 Last Updated: 2024-08-05T01:24:48.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized "contact_uuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/c48a160af53352ad1a43518b7d0faab16b8dfbcc - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-4/
CVE ID: CVE-2019-16972 State: PUBLISHED Published: 2019-10-22T21:36:48 Last Updated: 2024-08-05T01:24:48.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/913ad234cf145a55e5f2faaab08d776d83c1699b - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-5/
CVE ID: CVE-2019-16973 State: PUBLISHED Published: 2019-10-22T21:41:45 Last Updated: 2024-08-05T01:24:48.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/cc820b2eb12a3b7070afdcb7f977f70a1d49ce49 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-6/
CVE ID: CVE-2019-16974 State: PUBLISHED Published: 2019-10-21T20:45:13 Last Updated: 2024-08-05T01:24:48.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/bcc75d63aa5b721f699a2b416425943ad7707825 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-7/
CVE ID: CVE-2019-16975 State: PUBLISHED Published: 2019-10-23T15:53:03 Last Updated: 2024-08-05T01:24:48.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\contacts\contact_notes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/80f2ce087ab1343f1ff3bf8a058eed9b5027eb8c - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-8/
CVE ID: CVE-2019-16976 State: PUBLISHED Published: 2019-10-23T14:34:44 Last Updated: 2024-08-05T01:24:48.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/d6ea02d896b2c57dec491ee3b36ec102639270be - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-9/
CVE ID: CVE-2019-16977 State: PUBLISHED Published: 2019-10-23T16:27:28 Last Updated: 2024-08-05T01:24:48.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/fc8e4e2d278ce6bffff21b04248d469a59eb8cd4 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-10/
CVE ID: CVE-2019-16978 State: PUBLISHED Published: 2019-10-21T14:01:34 Last Updated: 2024-08-05T01:24:48.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\devices\device_settings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/83622c4ee1d9dd1913e9fb01ce8f060b46a5768a - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-11/