Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12819 State: PUBLISHED Published: 2019-06-14T01:24:52 Last Updated: 2024-08-04T23:32:55.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free. This will cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/6ff7b060535e87c2ae14dd8548512abfdda528fb - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6ff7b060535e87c2ae14dd8548512abfdda528fb - http://www.securityfocus.com/b
linux/kernel/git/torvalds/linux.git/commit/?id=6ff7b060535e87c2ae14dd8548512abfdda528fb - http://www.securityfocus.com/bid/108768 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html - https://security.netapp.com/advisory/ntap-20190710-0002/ - https://usn.ubuntu.com/4094-1/ - http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html - https://usn.ubuntu.com/4118-1/
CVE ID: CVE-2019-12820 State: PUBLISHED Published: 2019-07-19T17:18:28 Last Updated: 2024-08-04T23:32:55.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account, the login request is being sent in cleartext. The vulnerability exists in both the Android and iOS version of the app. An attacker could exploit this by using an MiTM attack on the local network to obtain someone's login credentials,
app. An attacker could exploit this by using an MiTM attack on the local network to obtain someone's login credentials, which gives them full access to the robot vacuum cleaner. Additional Analyst Notes: - CVE Program Container: References: - https://www.kth.se/polopoly_fs/1.914058.1561621210%21/Olsson_Larsson-Forsberg_vacuum.pdf
CVE ID: CVE-2019-12821 State: PUBLISHED Published: 2019-07-19T17:20:36 Last Updated: 2024-08-04T23:32:55.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device. Additiona
e device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device. Additional Analyst Notes: - CVE Program Container: References: - https://www.kth.se/polopoly_fs/1.914058.1561621210%21/Olsson_Larsson-Forsberg_vacuum.pdf
CVE ID: CVE-2019-12822 State: PUBLISHED Published: 2019-06-14T13:06:56 Last Updated: 2024-08-04T23:32:55.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory reference, and potential DoS, as demonstrated by a colon on a line by itself. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/embedthis/goahead/issues/285 - https://github.com/embedthis/goahead/compare/5349710...579f21f
CVE ID: CVE-2019-12823 State: PUBLISHED Published: 2019-06-18T12:06:59 Last Updated: 2024-08-04T23:32:55.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md - https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f
CVE ID: CVE-2019-12825 State: PUBLISHED Published: 2020-02-17T13:54:59 Last Updated: 2024-08-04T23:32:55.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no previous access to the repo. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/relea
he repo. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://atomic111.github.io/article/gitlab-Unauthorized-Access-to-Container-Registry
CVE ID: CVE-2019-12826 State: PUBLISHED Published: 2019-07-01T17:56:51 Last Updated: 2024-08-04T23:32:54.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to dynamically determine their visibility) by crafting a malicious POST request that tricks administrators into adding the code. Additional Analyst Notes: - CVE Program Container: References: - https://dannewitz.ninja/posts/widget-logic-csrf-to-rce - https://plugins.trac.wordpress.org/changese
iner: References: - https://dannewitz.ninja/posts/widget-logic-csrf-to-rce - https://plugins.trac.wordpress.org/changeset/2112753/widget-logic - https://wpvulndb.com/vulnerabilities/9413 - https://wpvulndb.com/vulnerabilities/9403
CVE ID: CVE-2019-12827 State: PUBLISHED Published: 2019-07-12T19:19:52 Last Updated: 2024-08-04T23:32:55.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message. Additional Analyst Notes: - CVE Program Container: References: - https://issues.asterisk.org/jira/browse/ASTERISK-28447 - http://downloads.digium.com/pub/security/AST-2019-002.html
CVE ID: CVE-2019-12828 State: PUBLISHED Published: 2019-06-14T19:53:37 Last Updated: 2024-08-04T23:32:55.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share. Additional Analyst Notes: - CVE Program Container: References: - https://zeropwn.github.io/2019-05-22-fun-with-uri-handlers/ - https://www.youtube.com/watch?v=E9vCx
ainer: References: - https://zeropwn.github.io/2019-05-22-fun-with-uri-handlers/ - https://www.youtube.com/watch?v=E9vCx9KsF3c - https://www.bleepingcomputer.com/news/security/qt5-based-gui-apps-susceptible-to-remote-code-execution/ - https://www.zerodayinitiative.com/advisories/ZDI-19-574/ - http://packetstormsecurity.com/files/153385/EA-Origin-Remote-Code-Execution.html
CVE ID: CVE-2019-12829 State: PUBLISHED Published: 2019-06-15T16:32:12 Last Updated: 2024-08-04T23:32:55.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/14303
CVE ID: CVE-2019-12830 State: PUBLISHED Published: 2019-06-15T17:04:50 Last Updated: 2024-08-04T23:32:55.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue. Additional Analyst Notes: - CVE Program Container: References: - https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/ - https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/
CVE ID: CVE-2019-12831 State: PUBLISHED Published: 2019-06-15T17:05:08 Last Updated: 2024-08-04T23:32:55.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE. Additional Analyst Notes: - CVE Program Container: References: - https://blog.ripstech.com/2019/mybb-store
eet name RCE. Additional Analyst Notes: - CVE Program Container: References: - https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/ - https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/
CVE ID: CVE-2019-12834 State: PUBLISHED Published: 2019-07-16T17:55:18 Last Updated: 2024-08-04T23:32:55.404Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AC:L/AV:N/A:L/C:L/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATH_INFO to the dashboards/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miruser/Roche-CVEs/blob/master/CVE-2019-12834.md
CVE ID: CVE-2019-12835 State: PUBLISHED Published: 2019-06-15T18:27:54 Last Updated: 2024-08-04T23:32:55.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escaping. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JayXon/Leanify/issues/52
CVE ID: CVE-2019-12836 State: PUBLISHED Published: 2019-06-21T14:53:58 Last Updated: 2024-08-04T23:32:55.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a request to an out-of-origin domain. This in turn may allow for a forged request that can be invoked in the context of an authenticated user, leading to stealing of session tokens and account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/9lyph/CVE-2019-12836/blob/master/README.md - https://jeditor.zendesk.com/hc/en-us/articles/360029430751-JEdi
/github.com/9lyph/CVE-2019-12836/blob/master/README.md - https://jeditor.zendesk.com/hc/en-us/articles/360029430751-JEditor-3-0-6-release-notes
CVE ID: CVE-2019-12837 State: PUBLISHED Published: 2019-12-31T16:53:35 Last Updated: 2024-08-04T23:32:55.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://vulnz.avm99963.com/T15
CVE ID: CVE-2019-12838 State: PUBLISHED Published: 2019-07-11T12:50:32 Last Updated: 2024-08-04T23:32:55.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/news.php - https://lists.schedmd.com/pipermail/slurm-announce/2019/ - https://www.schedmd.com/news.php?id=218 - https://lists.schedmd.com/pipermail/slurm-announce/2019/000025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ6EV3OWKGMTBWCSXZGS4MYADUBLVXSQ/ - https://lists.fedoraproject.org/archives/list
unce%40lists.fedoraproject.org/message/AQ6EV3OWKGMTBWCSXZGS4MYADUBLVXSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2O47F72FWMYLEGF35QGNYY5VS33SUQS5/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00005.html - https://seclists.org/bugtraq/2019/Nov/30 - https://www.debian.org/security/2019/dsa-4572 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00016.html - https://lists.debian.org/debian-lts-announce/2022/01/msg00011.html
CVE ID: CVE-2019-12839 State: PUBLISHED Published: 2019-06-15T19:27:41 Last Updated: 2024-08-04T23:32:55.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution. Additional Analyst Notes: - CVE Program Container: References: - https://ctrsec.io/index.php/2019/06/11/ace-orangehrm/ - https://github.com/orangehrm/orangehrm/pull/528
CVE ID: CVE-2019-12840 State: PUBLISHED Published: 2019-06-15T19:52:10 Last Updated: 2024-08-04T23:32:55.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46984 - https://pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html - http://www.securityfocus.com/bid/108790 - http://packetstormsecurity.com/files/153372/Webmin-1.910-Remote-Command-Execution.html
CVE ID: CVE-2019-12841 State: PUBLISHED Published: 2019-07-03T19:44:53 Last Updated: 2024-08-04T23:32:55.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12842 State: PUBLISHED Published: 2019-07-03T19:45:58 Last Updated: 2024-08-04T23:32:55.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12843 State: PUBLISHED Published: 2019-07-03T19:43:49 Last Updated: 2024-08-04T23:32:55.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12844 State: PUBLISHED Published: 2019-07-03T19:41:04 Last Updated: 2024-08-04T23:32:55.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12845 State: PUBLISHED Published: 2019-07-03T19:42:34 Last Updated: 2024-08-04T23:32:55.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12846 State: PUBLISHED Published: 2019-07-03T19:46:58 Last Updated: 2024-08-04T23:32:55.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12847 State: PUBLISHED Published: 2019-07-03T18:30:56 Last Updated: 2024-08-04T23:32:55.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12850 State: PUBLISHED Published: 2019-07-03T18:21:51 Last Updated: 2024-08-04T23:32:55.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12851 State: PUBLISHED Published: 2019-07-03T18:18:50 Last Updated: 2024-08-04T23:32:55.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12852 State: PUBLISHED Published: 2019-07-03T19:48:11 Last Updated: 2024-08-04T23:32:55.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12854 State: PUBLISHED Published: 2019-08-15T16:15:23 Last Updated: 2024-08-04T23:32:55.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2019_1.txt - https://bugs.squid-cache.org/show_bug.cgi?id=4937 - http://www.squid-cache.org/Versions/v4/changesets/squid-4-2981a957716c61ff7e21eee1d7d6eb5a237e
rg/show_bug.cgi?id=4937 - http://www.squid-cache.org/Versions/v4/changesets/squid-4-2981a957716c61ff7e21eee1d7d6eb5a237e466d.patch - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/ - https://www.debian.org/security/2019/dsa-4507 - https://seclists.org/bugtraq/2019/Aug/42 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html - https://usn.ubuntu.com/4213-1/
CVE ID: CVE-2019-12855 State: PUBLISHED Published: 2019-06-16T11:11:43 Last Updated: 2024-08-04T23:32:55.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections. Additional Analyst Notes: - CVE Program Container: References: - https://twistedmatrix.com/trac/ticket/9561 - https://github.com/twisted/twisted/pull/1147 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html
/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html - https://usn.ubuntu.com/4308-2/ - https://usn.ubuntu.com/4308-1/ - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2019-12863 State: PUBLISHED Published: 2020-02-25T16:52:09 Last Updated: 2024-08-04T23:32:55.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/network-performance-monitor - https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-12863-stored-html-injection-vulnerability-in-solarwinds-orion-platform-2018-4-hf3-npm-12-4-netpath-1-1-4/
CVE ID: CVE-2019-12864 State: PUBLISHED Published: 2020-05-04T13:30:46 Last Updated: 2024-08-04T23:32:55.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/network-performance-monitor - https://www.esecforte.com/network-performance-monitor-india-esec-forte-technologies/
CVE ID: CVE-2019-12865 State: PUBLISHED Published: 2019-06-17T22:49:04 Last Updated: 2024-08-04T23:32:55.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/14334 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IEXZWAMVKGZKHALV4IVWQS2ORJKRH57U/
CVE ID: CVE-2019-12866 State: PUBLISHED Published: 2019-07-03T18:28:18 Last Updated: 2024-08-04T23:32:55.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE ID: CVE-2019-12867 State: PUBLISHED Published: 2019-07-03T18:24:45 Last Updated: 2024-08-04T23:32:55.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/