Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
er an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rust-lang/rust/issues/53566 - https://github.com/rust-lang/rust/pull/53571/commits/b85e4cc8fadaabd41da5b9645c08c68b8f89908d
CVE ID: CVE-2019-1010300 State: PUBLISHED Published: 2019-07-15T17:15:13 Last Updated: 2024-08-05T03:07:18.488Z Vendors: mz-automation Products: libiec61850 Problem Types: Buffer Overflow Description: mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: server_example_complex_array. The attack vector is: Send a specific MMS protocol packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mz-automation/libiec61850/issues/127
CVE ID: CVE-2019-1010301 State: PUBLISHED Published: 2019-07-15T17:10:56 Last Updated: 2024-08-05T03:07:18.473Z Vendors: jhead Products: jhead Problem Types: Buffer Overflow Description: jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1679952 - https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1838251 - https://launchpadlibrarian.net/435112680/32_crash_in_gpsinfo - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora
rarian.net/435112680/32_crash_in_gpsinfo - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WVQTORTGQE56XXC6OVHQCSCUGABRMQZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTGUHTJTQ6EKEPDXFSKZKVLUJC4UAPBQ/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00037.html - https://security.gentoo.org/glsa/202007-17
CVE ID: CVE-2019-1010302 State: PUBLISHED Published: 2019-07-15T17:07:06 Last Updated: 2024-08-05T03:07:18.460Z Vendors: jhead Products: jhead Problem Types: Incorrect Access Control Description: jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1679978 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WVQTORTGQE56XXC6OVHQCSCUGABRMQZ/ - https://lists.fedoraproject.org/archives/lis
ounce%40lists.fedoraproject.org/message/3WVQTORTGQE56XXC6OVHQCSCUGABRMQZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTGUHTJTQ6EKEPDXFSKZKVLUJC4UAPBQ/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00037.html - https://security.gentoo.org/glsa/202007-17
CVE ID: CVE-2019-1010304 State: PUBLISHED Published: 2019-07-15T14:45:39 Last Updated: 2024-08-05T03:07:18.378Z Vendors: Saleor Products: Saleor Problem Types: Incorrect Access Control Description: Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1. Add
/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirumee/saleor/issues/3768
CVE ID: CVE-2019-1010305 State: PUBLISHED Published: 2019-07-15T14:39:55 Last Updated: 2024-08-05T03:07:18.456Z Vendors: libmspack Products: libmspack Problem Types: Buffer Overflow Description: libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyz/libmspack/issues/27 - https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf57
References: - https://github.com/kyz/libmspack/issues/27 - https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d - https://usn.ubuntu.com/4066-1/ - https://usn.ubuntu.com/4066-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2QJTUAGP22YY7453MHGTFN4YQE5HJBR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXWNEY4CJBLPRKV6LG7FQUPD6WVZYBTB/ - https://lists.debian.org/debian-lts-announce/2019/08/msg00028.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00033.html
CVE ID: CVE-2019-1010306 State: PUBLISHED Published: 2019-07-15T14:32:46 Last Updated: 2024-08-05T03:07:18.494Z Vendors: Slanger Products: Slanger Problem Types: Remote Code Execution (RCE) Description: Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a2272
Program Container: References: - https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a22727c111f5c3
CVE ID: CVE-2019-1010307 State: PUBLISHED Published: 2019-07-15T17:05:18 Last Updated: 2024-08-05T03:07:18.393Z Vendors: GLPI Products: GLPI Product Problem Types: Cross Site Scripting (XSS) Description: GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/g
dpoint fetches js and executes it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/releases/tag/9.3.1 - https://github.com/glpi-project/glpi/blob/9.4/bugfixes/ajax/getDropdownValue.php
CVE ID: CVE-2019-1010308 State: PUBLISHED Published: 2019-07-15T17:01:22 Last Updated: 2024-08-05T03:07:18.494Z Vendors: Aquaverde GmbH Products: Aquarius CMS Problem Types: Incorrect Access Control Description: Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aquaverde/aquarius-core - https://github.com/aquaverde/aquarius-core/commit/e1af89aa9df07ea265d879518ede9eb98aa494e0
CVE ID: CVE-2019-1010309 State: REJECTED Published: 2019-07-12T17:51:01 Last Updated: 2019-07-13T00:04:46 Description: No description available.
CVE ID: CVE-2019-1010310 State: PUBLISHED Published: 2019-07-12T17:45:56 Last Updated: 2024-08-05T03:07:18.662Z Vendors: GLPI Products: GLPI Product Problem Types: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description Description: GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools > Reminder > Description .. Set the description to any iframe/form tags and apply. The attack vector is: The attacker puts a login form, the user fills it and clicks
on to any iframe/form tags and apply. The attack vector is: The attacker puts a login form, the user fills it and clicks on submit .. the request is sent to the attacker domain saving the data. The fixed version is: 9.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/releases/tag/9.3.1 - https://github.com/glpi-project/glpi/pull/5519
CVE ID: CVE-2019-1010311 State: REJECTED Published: 2019-07-12T17:37:18 Last Updated: 2019-07-13T00:00:21 Description: No description available.
CVE ID: CVE-2019-1010312 State: REJECTED Published: 2019-07-12T17:33:52 Last Updated: 2019-07-12T23:11:45 Description: No description available.
CVE ID: CVE-2019-1010314 State: PUBLISHED Published: 2019-07-11T19:33:46 Last Updated: 2024-08-05T03:07:18.527Z Vendors: Gitea Products: Gitea Problem Types: Cross Site Scripting (XSS) Description: Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-gitea/gitea/releases
CVE ID: CVE-2019-1010315 State: PUBLISHED Published: 2019-07-11T19:34:35 Last Updated: 2024-08-05T03:07:18.489Z Vendors: WavPack Products: WavPack Problem Types: CWE 369: Divide by Zero Description: WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dbry/WavPack/is
af1e1aeb3da5d35b9fc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dbry/WavPack/issues/65 - https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc - https://usn.ubuntu.com/4062-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html
CVE ID: CVE-2019-1010316 State: PUBLISHED Published: 2019-07-11T19:25:13 Last Updated: 2024-08-05T03:07:18.600Z Vendors: pyxtrlock Products: pyxtrlock Problem Types: Incorrect Access Control Description: pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in a non-X11 session. The fixed version is: 0.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leonnnn/pyxtrlock/issues/21
CVE ID: CVE-2019-1010317 State: PUBLISHED Published: 2019-07-11T19:24:40 Last Updated: 2024-08-05T03:07:18.514Z Vendors: WavPack Products: WavPack Problem Types: CWE-457 Description: WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dbry/WavPack/issues/66 - https://github.com/dbry/WavPack/commit/
CVE Program Container: References: - https://github.com/dbry/WavPack/issues/66 - https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b - https://usn.ubuntu.com/4062-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYESOAZ6Z6IG4BQBURL6OUY6P4YB6SKS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IX3J2JML5A7KC2BLGBEFTIIZR3EM7LVJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3T
RGRD5LOLGZA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html
CVE ID: CVE-2019-1010318 State: REJECTED Published: 2019-07-11T19:23:52 Last Updated: 2019-07-14T16:25:34 Description: No description available.
CVE ID: CVE-2019-1010319 State: PUBLISHED Published: 2019-07-11T19:23:29 Last Updated: 2024-08-05T03:14:15.258Z Vendors: WavPack Products: WavPack Problem Types: CWE-457 Description: WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dbry/WavPack/issues/68 - https://github.com/dbry/WavPack/com
: - CVE Program Container: References: - https://github.com/dbry/WavPack/issues/68 - https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe - https://usn.ubuntu.com/4062-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYESOAZ6Z6IG4BQBURL6OUY6P4YB6SKS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IX3J2JML5A7KC2BLGBEFTIIZR3EM7LVJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQ
DW3PRGRD5LOLGZA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html
CVE ID: CVE-2019-1020001 State: PUBLISHED Published: 2019-07-29T00:00:00 Last Updated: 2024-08-05T03:14:15.223Z Vendors: yard Products: yard Problem Types: path traversal Description: yard before 0.9.20 allows path traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr - https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
CVE ID: CVE-2019-1020002 State: PUBLISHED Published: 2019-07-29T14:25:23 Last Updated: 2024-08-05T03:14:15.311Z Vendors: Pterodactyl Products: Pterodactyl Panel Problem Types: credential sniffing Description: Pterodactyl before 0.7.14 with 2FA allows credential sniffing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8
CVE ID: CVE-2019-1020003 State: PUBLISHED Published: 2019-07-29T14:03:57 Last Updated: 2024-08-05T03:14:15.260Z Vendors: Invenio Products: invenio-records Problem Types: XSS Description: invenio-records before 1.2.2 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inveniosoftware/invenio-records/security/advisories/GHSA-vxh3-mvv7-265j
CVE ID: CVE-2019-1020004 State: PUBLISHED Published: 2019-07-29T14:20:39 Last Updated: 2024-08-05T03:14:15.162Z Vendors: Tridactyl Products: Tridactyl Problem Types: fake key events Description: Tridactyl before 1.16.0 allows fake key events. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tridactyl/tridactyl/security/advisories/GHSA-7qr7-93pf-hr8f
CVE ID: CVE-2019-1020005 State: PUBLISHED Published: 2019-07-29T14:07:05 Last Updated: 2024-08-05T03:14:15.309Z Vendors: Invenio Products: invenio-communities Problem Types: XSS Description: invenio-communities before 1.0.0a20 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inveniosoftware/invenio-communities/security/advisories/GHSA-mfv8-q39f-mgfg
CVE ID: CVE-2019-1020006 State: PUBLISHED Published: 2019-07-29T14:10:07 Last Updated: 2024-08-05T03:14:15.372Z Vendors: Invenio Products: invenio-app Problem Types: host header injection Description: invenio-app before 1.1.1 allows host header injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inveniosoftware/invenio-app/security/advisories/GHSA-94mf-xfg5-r247
CVE ID: CVE-2019-1020007 State: PUBLISHED Published: 2019-07-29T14:18:52 Last Updated: 2024-08-05T03:14:15.264Z Vendors: Dependency-Track Products: Dependency-Track Problem Types: XSS Description: Dependency-Track before 3.5.1 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-jp9v-w6vw-9m5v
CVE ID: CVE-2019-1020008 State: PUBLISHED Published: 2019-07-29T14:14:54 Last Updated: 2024-08-05T03:14:16.073Z Vendors: stacktable.js Products: stacktable.js Problem Types: XSS Description: stacktable.js before 1.0.4 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WebFirst/stacktable.js/security/advisories/GHSA-r9j3-hgxr-75xg
CVE ID: CVE-2019-1020009 State: PUBLISHED Published: 2019-07-29T14:17:02 Last Updated: 2024-08-05T03:14:16.115Z Vendors: Fleet Products: Fleet Problem Types: exposure of SMTP credentials Description: Fleet before 2.1.2 allows exposure of SMTP credentials. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kolide/fleet/security/advisories/GHSA-6g7f-8qm4-f7h8
CVE ID: CVE-2019-1020010 State: PUBLISHED Published: 2019-07-29T12:12:04 Last Updated: 2024-08-05T03:14:15.294Z Vendors: Misskey Products: Misskey Problem Types: hijacking a user's token Description: Misskey before 10.102.4 allows hijacking a user's token. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/syuilo/misskey/security/advisories/GHSA-6qw9-6jxq-xj3p
CVE ID: CVE-2019-1020011 State: PUBLISHED Published: 2019-07-29T12:13:43 Last Updated: 2024-08-05T03:14:15.188Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AC:L/AV:N/A:L/C:H/I:H/PR:H/S:C/UI:N) Vendors: SmokeDetector Products: SmokeDetector Problem Types: remote code execution Description: SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Charcoal-SE/SmokeDetector/security/advisories/GHSA-5w85-7mwr-v44q
CVE ID: CVE-2019-1020012 State: PUBLISHED Published: 2019-07-29T12:16:14 Last Updated: 2024-08-05T03:14:16.043Z Vendors: Parse Products: parse-server Problem Types: DoS Description: parse-server before 3.4.1 allows DoS after any POST to a volatile class. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-2479-qvv7-47qq
CVE ID: CVE-2019-1020013 State: PUBLISHED Published: 2019-07-29T12:18:07 Last Updated: 2024-08-05T03:14:15.223Z Vendors: Parse Products: parse-server Problem Types: account enumeration Description: parse-server before 3.6.0 allows account enumeration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5
CVE ID: CVE-2019-1020014 State: PUBLISHED Published: 2019-07-29T12:20:21 Last Updated: 2024-08-05T03:14:16.187Z Vendors: Docker Products: docker-credential-helpers Problem Types: double free Description: docker-credential-helpers before 0.6.3 has a double free in the List functions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/docker/docker-credential-helpers/commit/1c9f7ede70a5ab9851f4c9cb37d317fd89cd318a - https://github.com/docker/docker-credential-helpers/releases/tag/v0.6.3 - https://usn.ubuntu.com/4103-1/ - https://usn.ubuntu.com/4103-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VVFB6UWUK2G
/4103-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VVFB6UWUK2GQQN7DVUU6GRRAL637A73/
CVE ID: CVE-2019-1020015 State: PUBLISHED Published: 2019-07-29T12:21:40 Last Updated: 2024-08-05T03:14:16.238Z Vendors: graphql-engine Products: graphql-engine Problem Types: mishandles the audience check Description: graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac
CVE ID: CVE-2019-1020016 State: PUBLISHED Published: 2019-07-29T12:23:12 Last Updated: 2024-08-05T03:14:15.994Z Vendors: ASH-AIO Products: ASH-AIO Problem Types: open redirect Description: ASH-AIO before 2.0.0.3 allows an open redirect. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ASHTeam/ash-aio-2/security/advisories/GHSA-cg3m-qj5v-8g48
CVE ID: CVE-2019-1020017 State: PUBLISHED Published: 2019-07-29T12:25:59 Last Updated: 2024-08-05T03:14:15.909Z Vendors: n/a Products: Discourse Problem Types: lacks a confirmation screen Description: Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a - https://github.com/discourse/discourse/commit/e6e47f2fb22764c92aaa90445c7bf203192fba11
CVE ID: CVE-2019-1020018 State: PUBLISHED Published: 2019-07-29T13:14:16 Last Updated: 2024-08-05T03:14:15.913Z Vendors: n/a Products: Discourse Problem Types: lacks a confirmation screen Description: Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a - https://github.com/discourse/discourse/commit/52387be4a44cdeaca5421ee955ba1343e836bade
CVE ID: CVE-2019-1020019 State: PUBLISHED Published: 2019-07-29T13:16:32 Last Updated: 2024-08-05T03:14:16.053Z Vendors: Invenio Products: invenio-previewer Problem Types: XSS Description: invenio-previewer before 1.0.0a12 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inveniosoftware/invenio-previewer/security/advisories/GHSA-j9m2-6hq2-4r3c
CVE ID: CVE-2019-10008 State: PUBLISHED Published: 2019-04-24T18:58:55 Last Updated: 2024-08-04T22:10:08.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://www.exploit-db.com/exploits/46659