Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12109 State: PUBLISHED Published: 2019-05-15T22:23:11 Last Updated: 2024-08-04T23:10:30.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for rem_port. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp - https://github.com/miniupnp/miniupnp/commit/13585f15c7f7dc28bbbba1661efb280d530d114c - https://github.com/miniupnp/miniupnp/commit/86030db849260dd8fb2ed975b9890aef1b62b692 - https://lists.debian.org/debian-lts-announce/2019/05/msg000
CVE ID: CVE-2019-12110 State: PUBLISHED Published: 2019-05-15T22:23:19 Last Updated: 2024-08-04T23:10:30.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: An AddPortMapping Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in upnpredirect.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp - https://github.com/miniupnp/miniupnp/commit/f321c2066b96d18afa5158dfa2d2873a2957ef38 - https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html - https://usn.ubuntu.com/4542-1/
CVE ID: CVE-2019-12111 State: PUBLISHED Published: 2019-05-15T22:23:27 Last Updated: 2024-08-04T23:10:30.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp - https://github.com/miniupnp/miniupnp/commit/cb8a02af7a5677cf608e86d57ab04241cf34e24f - https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html - https://usn.ubuntu.com/4542-1/
CVE ID: CVE-2019-12112 State: PUBLISHED Published: 2020-03-18T17:01:37 Last Updated: 2024-08-04T23:10:30.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-199
CVE ID: CVE-2019-12113 State: PUBLISHED Published: 2020-03-18T17:03:18 Last Updated: 2024-08-04T23:10:30.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-43
CVE ID: CVE-2019-12114 State: PUBLISHED Published: 2020-03-18T17:04:39 Last Updated: 2024-08-04T23:10:30.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-10
CVE ID: CVE-2019-12115 State: PUBLISHED Published: 2020-03-18T17:05:31 Last Updated: 2024-08-04T23:10:30.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-10
CVE ID: CVE-2019-12116 State: PUBLISHED Published: 2020-03-18T17:06:49 Last Updated: 2024-08-04T23:10:30.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-10
CVE ID: CVE-2019-12117 State: PUBLISHED Published: 2020-03-18T17:07:24 Last Updated: 2024-08-04T23:10:30.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-10
CVE ID: CVE-2019-12118 State: PUBLISHED Published: 2020-03-18T17:08:07 Last Updated: 2024-08-04T23:10:30.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-10
CVE ID: CVE-2019-12119 State: PUBLISHED Published: 2020-03-18T17:08:50 Last Updated: 2024-08-04T23:10:30.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-10
CVE ID: CVE-2019-12120 State: PUBLISHED Published: 2020-03-18T17:16:57 Last Updated: 2024-08-04T23:10:30.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-10
CVE ID: CVE-2019-12121 State: PUBLISHED Published: 2020-03-18T17:18:01 Last Updated: 2024-08-04T23:10:30.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-92
CVE ID: CVE-2019-12122 State: PUBLISHED Published: 2020-03-18T17:18:53 Last Updated: 2024-08-04T23:10:30.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may retrieve that user's password from the database. All Portal setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-65
CVE ID: CVE-2019-12123 State: PUBLISHED Published: 2020-03-18T17:19:40 Last Updated: 2024-08-04T23:10:30.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-42
CVE ID: CVE-2019-12124 State: PUBLISHED Published: 2020-03-18T17:20:54 Last Updated: 2024-08-04T23:10:30.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticated attacker can read or overwrite an arbitrary file. All APPC setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-63
CVE ID: CVE-2019-12125 State: PUBLISHED Published: 2020-03-19T17:30:30 Last Updated: 2024-08-04T23:10:30.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-27
CVE ID: CVE-2019-12126 State: PUBLISHED Published: 2020-03-19T17:30:36 Last Updated: 2024-08-04T23:10:30.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-27
CVE ID: CVE-2019-12127 State: PUBLISHED Published: 2020-03-19T17:30:41 Last Updated: 2024-08-04T23:10:30.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-27
CVE ID: CVE-2019-12128 State: PUBLISHED Published: 2020-03-19T13:42:47 Last Updated: 2024-08-04T23:10:30.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-27
CVE ID: CVE-2019-12129 State: PUBLISHED Published: 2020-03-19T13:43:21 Last Updated: 2024-08-04T23:10:30.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-27
CVE ID: CVE-2019-12130 State: PUBLISHED Published: 2020-03-19T13:44:17 Last Updated: 2024-08-04T23:10:30.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager (OOM) setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-27
CVE ID: CVE-2019-12131 State: PUBLISHED Published: 2020-03-18T17:26:01 Last Updated: 2024-08-04T23:10:30.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USER_ID parameter in an HTTP header, an attacker may impersonate an arbitrary existing user without any authentication. All APPC and SDC setups are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-93
CVE ID: CVE-2019-12132 State: PUBLISHED Published: 2020-03-18T17:25:06 Last Updated: 2024-08-04T23:10:30.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.onap.org/browse/OJSI-41
CVE ID: CVE-2019-12133 State: PUBLISHED Published: 2019-06-18T21:27:25 Last Updated: 2024-08-04T23:10:30.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager P
ects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html - https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-007.md
CVE ID: CVE-2019-12134 State: PUBLISHED Published: 2019-06-06T13:27:44 Last Updated: 2024-08-04T23:10:30.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export. Additional Analyst Notes: - CVE Program Container: References: - https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html
CVE ID: CVE-2019-12135 State: PUBLISHED Published: 2019-06-06T16:07:07 Last Updated: 2024-08-04T23:10:30.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector. Additional Analyst Notes: - CVE Program Container: References: - https://www.papercut.com/products/mf/release-history/ - https://www.papercut.com/products/ng/release-history/
CVE ID: CVE-2019-12136 State: PUBLISHED Published: 2019-05-16T02:55:45 Last Updated: 2024-08-04T23:10:30.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BoostIO/Boostnote/issues/3007
CVE ID: CVE-2019-12137 State: PUBLISHED Published: 2019-05-16T13:20:53 Last Updated: 2024-08-04T23:10:30.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/typora/typora-issues/issues/2505 - http://packetstormsecurity.com/files/153082/Typora-0.9.9.24.6-Directory-Traversal.html - https://twitter.com/RandomDhiraj/status/1136960564540915712
CVE ID: CVE-2019-12138 State: PUBLISHED Published: 2019-05-16T13:21:06 Last Updated: 2024-08-04T23:10:30.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: MacDown 0.7.1 allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MacDownApp/macdown/issues/1076
CVE ID: CVE-2019-12139 State: PUBLISHED Published: 2019-05-16T14:04:59 Last Updated: 2024-08-04T23:10:30.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui
CVE ID: CVE-2019-12143 State: PUBLISHED Published: 2019-06-11T20:54:00 Last Updated: 2024-08-04T23:10:30.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose WS_FTP usernames as well as filenames. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm
CVE ID: CVE-2019-12144 State: PUBLISHED Published: 2019-06-11T20:55:50 Last Updated: 2024-08-04T23:10:30.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the SITE command feature. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm
CVE ID: CVE-2019-12145 State: PUBLISHED Published: 2019-06-11T20:57:16 Last Updated: 2024-08-04T23:10:30.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose path names on the host operating system. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm
CVE ID: CVE-2019-12146 State: PUBLISHED Published: 2019-06-11T20:58:26 Last Updated: 2024-08-04T23:10:30.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm
CVE ID: CVE-2019-12147 State: PUBLISHED Published: 2019-10-22T15:47:35 Last Updated: 2024-08-04T23:10:30.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system user with sudo privileges, and use that user to login to the system (either via the web interface or via SSH) to achieve complete compromise of the device. This affects /var/webconfig/gui/Webconfig.inc.php and /usr/local/sng/bin/sng-user-mgmt. Additional Analyst Notes: - CVE Program Contain
ar/webconfig/gui/Webconfig.inc.php and /usr/local/sng/bin/sng-user-mgmt. Additional Analyst Notes: - CVE Program Container: References: - https://blog.appsecco.com - http://seclists.org/fulldisclosure/2019/Oct/40 - http://packetstormsecurity.com/files/154914/Sangoma-SBC-2.3.23-119-GA-Unauthenticated-User-Creation.html
CVE ID: CVE-2019-12148 State: PUBLISHED Published: 2019-10-22T15:20:37 Last Updated: 2024-08-04T23:10:30.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field. Upon successful exploitation, a remote unauthenticated user can login into the device's admin web portal without providing any credentials. This affects /var/webconfig/gui/Webconfig.inc.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Oct/41 - http://packetstormse
lyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Oct/41 - http://packetstormsecurity.com/files/154915/Sangoma-SBC-2.3.23-119-GA-Authentication-Bypass.html
CVE ID: CVE-2019-12149 State: PUBLISHED Published: 2019-06-11T21:22:05 Last Updated: 2024-08-04T23:10:30.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/cve-2019-12149
CVE ID: CVE-2019-12150 State: PUBLISHED Published: 2019-05-24T15:39:26 Last Updated: 2024-08-04T23:10:30.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted). The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under the UltimateEditorInclude/UserFiles/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.karamasoft.com - https://github.com/Gr4y21/My-CVE-IDs/blob/master/CVE-2019-12150/Karamasoft%20Arbitrary%20File%20Upload
CVE ID: CVE-2019-12153 State: PUBLISHED Published: 2019-06-11T20:33:14 Last Updated: 2024-08-04T23:10:30.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content. Additional Analyst Notes: - CVE Program Container: References: - https://www.pdfreactor.com/important-pdfreactor-security-advisory/ - https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/ - https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html