Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12288 State: PUBLISHED Published: 2019-05-23T17:49:37 Last Updated: 2024-08-04T23:17:39.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in upgrade_htmls.cgi on VStarcam 100T (C7824WIP) KR75.8.53.20 and 200V (C38S) KR203.18.1.20 devices. The web service, network, and account files can be manipulated through a web UI firmware update without any authentication. The attacker can achieve access to the device through a manipulated web UI firmware update. Additional Analyst Notes: - CVE Program Container: References: - http://f1security.co.kr/cve/cve_190314.htm
CVE ID: CVE-2019-12289 State: PUBLISHED Published: 2019-05-23T17:52:33 Last Updated: 2024-08-04T23:17:39.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in upgrade_firmware.cgi on VStarcam 100T (C7824WIP) CH-sys-48.53.75.119~123 and 200V (C38S) CH-sys-48.53.203.119~123 devices. A remote command can be executed through a system firmware update without authentication. The attacker can modify the files within the internal firmware or even steal account information by executing a command. Additional Analyst Notes: - CVE Program Container: References: - http://f1security.co.kr/cve/cve_190314.htm
CVE ID: CVE-2019-12290 State: PUBLISHED Published: 2019-10-22T15:14:06 Last Updated: 2024-08-04T23:17:39.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated. Additional Analyst Notes: - CVE Program Container:
then back to an ASCII label), arbitrary domains can be impersonated. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libidn/libidn2/merge_requests/71 - https://gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5 - https://gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389de - https://usn.ubuntu.com/4168-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6ZXL2RDNQRAHCMKWPOMJFKYJ344X4HL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFT76Y7OSGPZV3EBEHD6ISVUM3DLARM/ - https://lists.fedoraproject.org/archives/lis
ounce%40lists.fedoraproject.org/message/3UFT76Y7OSGPZV3EBEHD6ISVUM3DLARM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KXDKYWFV6N2HHVSE67FFDM7G3FEL2ZNE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSI4TI2JTQWQ3YEUX5X36GTVGKO4QKZ5/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONG3GJRRJO35COPGVJXXSZLU4J5Y42AT/ - https://security.gentoo.org/glsa/202003-63
CVE ID: CVE-2019-12291 State: PUBLISHED Published: 2019-06-06T16:35:38 Last Updated: 2024-08-04T23:17:39.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/consul/issues/5888
CVE ID: CVE-2019-12292 State: PUBLISHED Published: 2019-06-24T15:55:42 Last Updated: 2024-08-04T23:17:39.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin - https://support.citrix.com/article/CTX253828
CVE ID: CVE-2019-12293 State: PUBLISHED Published: 2019-05-23T04:54:12 Last Updated: 2024-08-04T23:17:39.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/768 - http://www.securityfocus.com/bid/108457 - https://lists.debian.org/debian-lts-announce/2019/06/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/ - https://li
ject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWS7NVFFCUY3YSTMEKZEJEU6JVUUBKHB/ - https://usn.ubuntu.com/4042-1/ - https://access.redhat.com/errata/RHSA-2019:2713 - https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html
CVE ID: CVE-2019-12295 State: PUBLISHED Published: 2019-05-23T11:56:29 Last Updated: 2024-08-04T23:17:39.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15778 - https://www.wireshark.org/security/wnpa-sec-2019-19.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7b6e197da4c497e229ed3ebf6952bae5c426a820 - http://www.securityfoc
shark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7b6e197da4c497e229ed3ebf6952bae5c426a820 - http://www.securityfocus.com/bid/108464 - https://support.f5.com/csp/article/K06725231 - https://usn.ubuntu.com/4133-1/ - https://support.f5.com/csp/article/K06725231?utm_source=f5support&amp%3Butm_medium=RSS - https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
CVE ID: CVE-2019-12297 State: PUBLISHED Published: 2019-05-23T13:02:06 Last Updated: 2024-08-04T23:17:39.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled Format String, reachable via TCP port 8010 or UDP port 8080. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter_fmtVuln.md
CVE ID: CVE-2019-12298 State: PUBLISHED Published: 2019-05-23T13:40:45 Last Updated: 2024-08-04T23:17:39.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leanify 0.4.3 allows remote attackers to trigger an out-of-bounds write (1024 bytes) via a modified input file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JayXon/Leanify/issues/50
CVE ID: CVE-2019-12299 State: PUBLISHED Published: 2019-11-18T18:20:28 Last Updated: 2024-08-04T23:17:38.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Nov/8 - https://medium.com/insidersec0x42/centraleyezer-stored-xss-using-html-entities-cve-2019-12299-5c295ae54ef
CVE ID: CVE-2019-12300 State: PUBLISHED Published: 2019-05-23T14:18:06 Last Updated: 2024-08-04T23:17:39.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XL
or-authentication - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA/
CVE ID: CVE-2019-12301 State: PUBLISHED Published: 2019-05-23T15:07:22 Last Updated: 2024-08-04T23:17:39.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2. Additional Analyst Notes: - CVE Program Container: References: - https://www.percona.com/blog/2019/05/17/percona-server-for-mysql-5-6-44-85-0-is-now-available/ - https://jira.percona.com/browse/PS-5640
CVE ID: CVE-2019-12303 State: PUBLISHED Published: 2019-06-06T15:02:39 Last Updated: 2024-08-04T23:17:39.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container. Additional Analyst Notes: - CVE Program Container: References: - https://forums.rancher.com/c/announcements - https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466
CVE ID: CVE-2019-12305 State: PUBLISHED Published: 2020-10-16T19:11:40 Last Updated: 2024-08-04T23:17:39.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration panel of the device. Additional Analyst Notes: - CVE Program Container: References: - https://digital.security/advisories/cert-ds_advisory-ezcast_pro_ii_admin_password-cve-2019-12305.txt
CVE ID: CVE-2019-12308 State: PUBLISHED Published: 2019-06-03T16:24:31 Last Updated: 2024-08-04T23:17:39.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. Additional Analyst Notes: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - http://www.openwall.com/lis
Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - http://www.openwall.com/lists/oss-security/2019/06/03/2 - https://groups.google.com/forum/#%21topic/django-announce/GEbHU7YoVz8 - https://docs.djangoproject.com/en/dev/releases/1.11.21/ - https://docs.djangoproject.com/en/dev/releases/2.1.9/ - https://docs.djangoproject.com/en/dev/releases/2.2.2/ - https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ - http://www.securityfocus.com/bid/108559 - https://lists.debian.org/debian-lts-announce/2019/06/msg00001.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPG
//lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/USYRARSYB7PE3S2ZQO7PZNWMH7RPGL5G/ - https://usn.ubuntu.com/4043-1/ - https://lists.debian.org/debian-lts-announce/2019/07/msg00001.html - https://www.debian.org/security/2019/dsa-4476 - https://seclists.org/bugtraq/2019/Jul/10 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html - https://security.gentoo.org/glsa/202004-17
CVE ID: CVE-2019-12309 State: PUBLISHED Published: 2019-05-23T19:21:17 Last Updated: 2024-08-04T23:17:39.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - https://dotcms.com/security/SI-48 - https://github.com/dotCMS/core/compare/605e5db...364c910
CVE ID: CVE-2019-12310 State: PUBLISHED Published: 2019-06-03T18:59:47 Last Updated: 2024-08-04T23:17:39.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view and retrieve verbose logging information. Files within this directory were observed to contain sensitive run-time information, including Base64 encoded 'support' credentials, leading to administrative access of the device. Additional Analyst Notes: - CVE Program Container: References: - https://exagrid.com/exagrid-products/resources/ - https://www.inquisitllc.com/exagr
CVE Program Container: References: - https://exagrid.com/exagrid-products/resources/ - https://www.inquisitllc.com/exagrid-directory-traversal-vulnerability-to-support-credential-extraction/
CVE ID: CVE-2019-12311 State: PUBLISHED Published: 2019-11-18T18:23:02 Last Updated: 2024-08-04T23:17:39.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Nov/9 - https://medium.com/insidersec0x42/centraleyezer-unrestricted-file-upload-cve-2019-12311-7cad12e95165
CVE ID: CVE-2019-12312 State: PUBLISHED Published: 2019-05-24T13:06:41 Last Updated: 2024-08-04T23:17:40.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.p
a restart of libreswan. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/218/ - https://github.com/libreswan/libreswan/issues/246 - https://github.com/libreswan/libreswan/compare/9b1394e...3897683 - https://libreswan.org/security/CVE-2019-12312/CVE-2019-12312.txt - https://libreswan.org/security/CVE-2019-12312/libreswan-3.27-CVE-2019-12312.patch
CVE ID: CVE-2019-12313 State: PUBLISHED Published: 2019-05-24T13:30:50 Last Updated: 2024-08-04T23:17:39.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/advisories/822 - https://github.com/dollarshaveclub/shave/commit/da7371b0531ba14eae48ef1bb1456a3de4cfa954#diff-074799b511e4b61923dfd3f2a3bf9b54R67 - https://github.com/dollarshaveclub/shave/compare/852b537...da7371b
CVE ID: CVE-2019-12314 State: PUBLISHED Published: 2019-05-24T13:46:44 Last Updated: 2024-08-04T23:17:39.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JameelNabbo/exploits/blob/master/Maconomy%20Erp%20local%20file%20include.txt - http://packetstormsecurity.com/files/153079/Deltek-Maconomy-2.2.5-Local-File-Inclusion.html - https://github.com/ras313/CVE-2019-12314/security/advisories/GHSA-8762-rf4g-23xm
CVE ID: CVE-2019-12315 State: PUBLISHED Published: 2019-05-24T15:23:08 Last Updated: 2024-08-04T23:17:39.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the "print from file" feature, as demonstrated by the sws/swsAlert.sws?popupid=successMsg msg parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/med0x2e/2715d32602ba688ea3bc239a3d5f8214
CVE ID: CVE-2019-12321 State: REJECTED Published: 2019-05-28T12:06:18 Last Updated: 2019-05-28T12:06:18 Description: No description available.
CVE ID: CVE-2019-12323 State: PUBLISHED Published: 2019-06-24T15:53:07 Last Updated: 2024-08-04T23:17:39.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org - https://help.hostingcontroller.com/OnlineHelp/default.aspx?pageid=hc_release_notes - http://seclists.org/fulldisclosure/2019/Jun/28
CVE ID: CVE-2019-12324 State: PUBLISHED Published: 2019-07-22T15:35:12 Last Updated: 2024-08-04T23:17:39.768Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf
CVE ID: CVE-2019-12325 State: PUBLISHED Published: 2019-07-22T15:54:16 Last Updated: 2024-08-04T23:17:39.871Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AC:L/AV:A/A:H/C:L/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device (DoS) without authentication or execute code (authenticated as a user) to spawn a remote shell as a root user. Additional Analyst Notes: - CVE Program Container: References: - https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Htek_UC902.pdf
CVE ID: CVE-2019-12326 State: PUBLISHED Published: 2019-07-22T16:05:13 Last Updated: 2024-08-04T23:17:39.683Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf
CVE ID: CVE-2019-12327 State: PUBLISHED Published: 2019-07-22T17:30:45 Last Updated: 2024-08-04T23:17:39.562Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed. Additional Analyst Notes: - CVE Program Container: References: - https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf
CVE ID: CVE-2019-12328 State: PUBLISHED Published: 2019-07-22T17:55:50 Last Updated: 2024-08-04T23:17:39.835Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Atcom_A10W.pdf
CVE ID: CVE-2019-12331 State: PUBLISHED Published: 2019-11-07T14:03:43 Last Updated: 2024-08-04T23:17:39.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PHPOff
tity processing (XXE) attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md#180---2019-07-01 - https://herolab.usd.de/security-advisories/usd-2019-0046/
CVE ID: CVE-2019-12345 State: PUBLISHED Published: 2019-05-27T20:17:30 Last Updated: 2024-08-04T23:17:39.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/hostel/#developers - https://wpvulndb.com/vulnerabilities/9289
CVE ID: CVE-2019-12346 State: PUBLISHED Published: 2019-06-24T20:25:25 Last Updated: 2024-08-04T23:17:39.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post. Additional Analyst Notes: - CVE Program Container: References: - https://zeroauth.ltd/blog/2019/05/27/cve-2019-12346-miniorange-saml-sp-single-sign-on-wordpress-plugin-xss/ - https://wpvulndb.com/vulnerabilities/9397
CVE ID: CVE-2019-12347 State: PUBLISHED Published: 2019-05-29T18:29:16 Last Updated: 2024-08-04T23:17:39.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.pfsense.org/issues/9554#change-40729 - https://www.pfsense.org/download/ - https://ctrsec.io/index.php/2019/05/28/stored-xss-acme-pfsense-2-4-4-p3/ - http://packetstormsecurity.com/files/153112/pfSense-2.4.4-p3-Cross-Site-Scriptin
/28/stored-xss-acme-pfsense-2-4-4-p3/ - http://packetstormsecurity.com/files/153112/pfSense-2.4.4-p3-Cross-Site-Scripting.html - https://github.com/pfsense/FreeBSD-ports/commit/504909564079e540689dbdbed3a579483c614275
CVE ID: CVE-2019-12348 State: PUBLISHED Published: 2021-05-24T15:03:24 Last Updated: 2024-08-04T23:17:39.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/1