Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
urity/advisories/mfsa2019-09/ - https://www.mozilla.org/security/advisories/mfsa2019-10/ - https://www.mozilla.org/security/advisories/mfsa2019-12/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1537924 - https://access.redhat.com/errata/RHSA-2019:0966 - https://access.redhat.com/errata/RHSA-2019:1144 - http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html
CVE ID: CVE-2019-9811 State: PUBLISHED Published: 2019-07-23T13:26:03 Last Updated: 2024-08-04T22:01:54.737Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Sandbox escape via installation of malicious language pack Description: As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-21/ - https://www.mozilla.org/security/advisori
iner: References: - https://www.mozilla.org/security/advisories/mfsa2019-21/ - https://www.mozilla.org/security/advisories/mfsa2019-22/ - https://www.mozilla.org/security/advisories/mfsa2019-23/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1538007 - https://bugzilla.mozilla.org/show_bug.cgi?id=1539598 - https://bugzilla.mozilla.org/show_bug.cgi?id=1563327 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html - https://security.gentoo.org/glsa/201908-12 - h
ml - https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html - https://security.gentoo.org/glsa/201908-12 - https://security.gentoo.org/glsa/201908-20 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
CVE ID: CVE-2019-9812 State: PUBLISHED Published: 2020-01-08T21:41:06 Last Updated: 2024-08-04T22:01:54.689Z Vendors: Mozilla Products: Firefox ESR, Firefox Problem Types: Sandbox escape through Firefox Sync Description: Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox <
t the sandbox if a crash is triggered. This vulnerability affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-25/ - https://www.mozilla.org/security/advisories/mfsa2019-27/ - https://www.mozilla.org/security/advisories/mfsa2019-26/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1538015 - https://bugzilla.mozilla.org/show_bug.cgi?id=1538008
CVE ID: CVE-2019-9813 State: PUBLISHED Published: 2019-04-26T16:09:57 Last Updated: 2024-08-04T22:01:54.683Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Ionmonkey type confusion with __proto__ mutations Description: Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-09/ - https://www.mozilla.org/security/advisories/mfsa2019-10/ - https://www.mozilla.org/sec
ecurity/advisories/mfsa2019-09/ - https://www.mozilla.org/security/advisories/mfsa2019-10/ - https://www.mozilla.org/security/advisories/mfsa2019-12/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1538006 - https://access.redhat.com/errata/RHSA-2019:0966 - https://access.redhat.com/errata/RHSA-2019:1144
CVE ID: CVE-2019-9814 State: PUBLISHED Published: 2019-07-23T13:24:44 Last Updated: 2024-08-04T22:01:54.950Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 67 Description: Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 67. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%
illa.org/security/advisories/mfsa2019-13/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%2C1543159%2C1539393%2C1459932%2C1459182%2C1516425
CVE ID: CVE-2019-9815 State: PUBLISHED Published: 2019-07-23T13:24:32 Last Updated: 2024-08-04T22:01:55.125Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Disable hyperthreading on content JavaScript threads on macOS Description: If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. *Note: users need to update to macOS 10.14.5 in order to take advantage of this change.*. This vulnerability affe
reads. *Note: users need to update to macOS 10.14.5 in order to take advantage of this change.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - https://www.mozilla.org/security/advisories/mfsa2019-14/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1546544 - https://mdsattacks.com/
CVE ID: CVE-2019-9816 State: PUBLISHED Published: 2019-07-23T13:24:19 Last Updated: 2024-08-04T22:01:54.964Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Type confusion with object groups and UnboxedObjects Description: A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Additional Analyst Notes: - CVE Program Contai
ability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - https://www.mozilla.org/security/advisories/mfsa2019-14/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1536768
CVE ID: CVE-2019-9817 State: PUBLISHED Published: 2019-07-23T13:24:05 Last Updated: 2024-08-04T22:01:54.839Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Stealing of cross-domain images using canvas Description: Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - http
tps://www.mozilla.org/security/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - https://www.mozilla.org/security/advisories/mfsa2019-14/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1540221
CVE ID: CVE-2019-9818 State: PUBLISHED Published: 2019-07-23T13:23:53 Last Updated: 2024-08-04T22:01:54.839Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Use-after-free in crash generation server Description: A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. *Note: this vulnerability only affects Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Additional Analyst Notes: - CVE Program Container: R
y affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - https://www.mozilla.org/security/advisories/mfsa2019-14/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1542581
CVE ID: CVE-2019-9819 State: PUBLISHED Published: 2019-07-23T13:23:43 Last Updated: 2024-08-04T22:01:54.971Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Compartment mismatch with fetch API Description: A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - https://www.mozilla.org/security/advisories/mfsa2019
19-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - https://www.mozilla.org/security/advisories/mfsa2019-14/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1532553
CVE ID: CVE-2019-9820 State: PUBLISHED Published: 2019-07-23T13:23:31 Last Updated: 2024-08-04T22:01:54.677Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Use-after-free of ChromeEventHandler by DocShell Description: A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - https://www.mozilla.org/securi
rity/advisories/mfsa2019-13/ - https://www.mozilla.org/security/advisories/mfsa2019-15/ - https://www.mozilla.org/security/advisories/mfsa2019-14/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1536405
CVE ID: CVE-2019-9821 State: PUBLISHED Published: 2019-07-23T13:23:21 Last Updated: 2024-08-04T22:01:55.087Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-free in AssertWorkerThread Description: A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. This vulnerability affects Firefox < 67. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2019-13/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1539125
CVE ID: CVE-2019-9823 State: PUBLISHED Published: 2019-07-03T18:11:48 Last Updated: 2024-08-04T22:01:54.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-9824 State: PUBLISHED Published: 2019-06-03T20:50:39 Last Updated: 2024-08-04T22:01:54.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg00400.html - https://access.redhat.com/errata/RHSA-2019:1650 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL/ - https://access.redhat.com/errata/RHSA-2019:2078 - https://access.
roject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL/ - https://access.redhat.com/errata/RHSA-2019:2078 - https://access.redhat.com/errata/RHSA-2019:2425 - https://access.redhat.com/errata/RHSA-2019:2553 - https://access.redhat.com/errata/RHSA-2019:3345
CVE ID: CVE-2019-9825 State: PUBLISHED Published: 2019-03-14T22:00:00Z Last Updated: 2024-09-17T02:01:24.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/cve/FeiFeiCMS_4.1_code_execution.doc - http://blog.whiterabbitxyj.com/cve/FeiFeiCMS_4.1_code_execution.doc
CVE ID: CVE-2019-9826 State: PUBLISHED Published: 2019-05-02T20:43:17 Last Updated: 2024-08-04T22:01:55.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fulltext search component in phpBB before 3.2.6 allows Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/29/3 - https://www.phpbb.com/community/viewtopic.php?f=14&t=2509941 - https://lists.debian.org/debian-lts-announce/2019/05/msg00004.html
CVE ID: CVE-2019-9827 State: PUBLISHED Published: 2019-07-03T20:13:06 Last Updated: 2024-08-04T22:01:54.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.ciphertechs.com/hawtio-advisory/
CVE ID: CVE-2019-9829 State: PUBLISHED Published: 2019-03-15T03:00:00 Last Updated: 2024-08-04T22:01:54.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/guobaoyou/vul_environment/blob/master/maccms10_getshell/maccms10_getshell_en.md
CVE ID: CVE-2019-9831 State: PUBLISHED Published: 2019-03-15T17:00:00 Last Updated: 2024-08-04T22:01:55.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /?Key=PhoneRequestAuthorization requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46381 - https://www.youtube.com/watch?v=FJmZ_FfcdoU
CVE ID: CVE-2019-9832 State: PUBLISHED Published: 2019-03-15T17:00:00 Last Updated: 2024-08-04T22:01:54.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket connections through a configured port. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46445 - https://www.youtube.com/watch?v=qwjuY7znZjs
CVE ID: CVE-2019-9833 State: PUBLISHED Published: 2019-03-15T17:00:00 Last Updated: 2024-08-04T22:01:54.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-stop requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46443
CVE ID: CVE-2019-9834 State: PUBLISHED Published: 2019-03-15T17:00:00 Last Updated: 2024-08-04T22:01:54.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot Additional Analyst Notes: - CVE Program
isk because there is a clear warning next to the button for importing a snapshot Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46545 - https://www.youtube.com/watch?v=zSG93yX0B8k - https://github.com/netdata/netdata/issues/5800#issuecomment-510986112
CVE ID: CVE-2019-9835 State: PUBLISHED Published: 2019-03-15T18:00:00 Last Updated: 2024-08-04T22:01:54.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-033.txt - http://www.securityfocus.com/bid/107440
CVE ID: CVE-2019-9836 State: PUBLISHED Published: 2019-06-25T20:17:47 Last Updated: 2024-08-04T22:01:54.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Jun/46 - https://www.amd.com/en/corporate/product-security - http://packetstormsecurity.com/files/153436/AMD-Secure-Encrypted-Virtualization-SEV-Key-Recovery.html - https://support.hpe.com/hpsc/doc/public/display?d
les/153436/AMD-Secure-Encrypted-Virtualization-SEV-Key-Recovery.html - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03943en_us - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00032.html
CVE ID: CVE-2019-9837 State: PUBLISHED Published: 2019-03-15T23:00:00 Last Updated: 2024-08-04T22:01:54.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/doorkeeper-gem/doorkeeper-openid_connect/pull/66 - https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issu
.com/doorkeeper-gem/doorkeeper-openid_connect/pull/66 - https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/61 - https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md
CVE ID: CVE-2019-9838 State: PUBLISHED Published: 2019-06-03T20:46:28 Last Updated: 2024-08-04T22:01:54.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ - http://packetstormsecurity.com/files/153104/VFront-0.99.5-Persistent-Cross-Site-Scripting.html
CVE ID: CVE-2019-9839 State: PUBLISHED Published: 2019-06-03T20:44:04 Last Updated: 2024-08-04T22:01:54.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/web-applications-advisories/ - http://packetstormsecurity.com/files/153103/VFront-0.99.5-Reflective-Cross-Site-Scripting.html
CVE ID: CVE-2019-9841 State: PUBLISHED Published: 2019-04-19T18:34:28 Last Updated: 2024-08-04T22:01:55.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://forum.vestacp.com/viewtopic.php?f=25&t=18599&sid=fc1a48fd2f43815b2dc69c3f64caed36 - https://github.com/serghey-rodin/vesta/commit/c28c5d29a3c61bc8110c11349e3f2309cd537cfa - https://cardaci.xyz/advisories/2019/04/15/vesta-control-panel-0.9.8-23-reflected-xss-in-file-manager-api/
CVE ID: CVE-2019-9842 State: PUBLISHED Published: 2019-06-14T19:14:39 Last Updated: 2024-08-04T22:01:54.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in app_code/handlers/PostHandler.cs writes a decoded base64 string to a file without validating the extension. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/madskristensen/MiniBlog/blob/1a7ae45ddba484e2c8f808e288e018748c9ddb57/Website/app_code/handlers/PostHandler.cs#L85 - https://rastating.github.io/miniblog-remote-code-execution/
CVE ID: CVE-2019-9843 State: PUBLISHED Published: 2019-03-15T23:00:00 Last Updated: 2024-08-04T22:01:55.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14t
ntainer: References: - https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter - https://github.com/diffplug/spotless/issues/358 - https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter - https://github.com/diffplug/spotless/pull/369 - https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E