Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-18602 State: PUBLISHED Published: 2019-10-29T13:41:48 Last Updated: 2024-08-05T01:54:14.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over the network to a peer. Additional Analyst Notes: - CVE Program Container: References: - https://openafs.org/pages/security/OPENAFS-SA-2019-002.txt - https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html
CVE ID: CVE-2019-18603 State: PUBLISHED Published: 2019-10-29T13:41:35 Last Updated: 2024-08-05T01:54:14.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output variables are sent over the network to a peer. Additional Analyst Notes: - CVE Program Container: References: - https://openafs.org/pages/security/OPENAFS-SA-2019-001.txt - https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html
CVE ID: CVE-2019-18604 State: PUBLISHED Published: 2019-10-29T00:00:00 Last Updated: 2024-08-05T01:54:14.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in TeXLive and other collections, sprintf is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeX-Live/texlive-source/commit/9216833a3888a4105a18e8c349f65b045ddb1079#diff-987e40c0e27ee43f6a2414ada73a191a - https://lists.debian.org/debian-lts-announce/2023/05/msg00033.html
CVE ID: CVE-2019-18608 State: PUBLISHED Published: 2019-10-29T14:56:33 Last Updated: 2024-08-05T01:54:14.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or shipping fee) by adding additional attributes to user-input during the PUT /ajax/cart operation for a checkout, because of getValidDocumentForUpdate in api/server/services/orders/orders.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com
pi/server/services/orders/orders.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cl0udz/vulnerabilities/blob/master/cezerin-manipulate_order_information/README.md
CVE ID: CVE-2019-18609 State: PUBLISHED Published: 2019-12-01T21:50:08 Last Updated: 2024-08-05T01:54:14.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alanxz/rabbitmq-c/blob/master/ChangeLog.m
ional Analyst Notes: - CVE Program Container: References: - https://github.com/alanxz/rabbitmq-c/blob/master/ChangeLog.md - https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a - https://news.ycombinator.com/item?id=21681976 - https://usn.ubuntu.com/4214-1/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WA7CPNVYMF6OQNIYNLWUY6U2GTKFOKH3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQER6XTKYMHNQR7QTHW7DJAH645WQROU/ - https://usn.ubuntu.com/4214-2/ - https://security.gentoo.org/glsa/202003-
rg/message/XQER6XTKYMHNQR7QTHW7DJAH645WQROU/ - https://usn.ubuntu.com/4214-2/ - https://security.gentoo.org/glsa/202003-07
CVE ID: CVE-2019-18610 State: PUBLISHED Published: 2019-11-22T17:31:16 Last Updated: 2024-08-05T01:54:14.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.asterisk.org/downloads/security-advisories - http://downloads.asterisk.org/pub/security/AST-2019-007.html - https://lists.debian.org/debian-lt
/security-advisories - http://downloads.asterisk.org/pub/security/AST-2019-007.html - https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html - https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
CVE ID: CVE-2019-18611 State: PUBLISHED Published: 2019-10-29T15:41:24 Last Updated: 2024-08-05T01:54:14.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within oversighted edit summaries made available via the MediaWiki API was potentially visible to users with various levels of access to this extension. Said users should not have been able to view these oversighted edit summaries via the MediaWiki API. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T234862 - https://gerrit.wikimedia.org/r/q/Ie0aa0df2b3f03d8b910733f1b
r: References: - https://phabricator.wikimedia.org/T234862 - https://gerrit.wikimedia.org/r/q/Ie0aa0df2b3f03d8b910733f1b5e600a0dc978765
CVE ID: CVE-2019-18612 State: PUBLISHED Published: 2019-10-29T15:41:04 Last Updated: 2024-08-05T01:54:14.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously hidden (restricted) AbuseFilter filters were viewable (or their differences were viewable) to unprivileged users, thus disclosing potentially sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T104807 - https://gerrit.wikimedia.org/r/q/Ie23e8234ae550273bf3f6f9c5ac45b7fc54eec2a
CVE ID: CVE-2019-18614 State: PUBLISHED Published: 2020-06-16T13:42:29 Last Updated: 2024-08-05T01:54:14.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending "l2ping -s 600" to t
r send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending "l2ping -s 600" to the target address prior to any pairing. Locally, the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because, in WICED Studio 6.2 and 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_18614.md
CVE ID: CVE-2019-18615 State: PUBLISHED Published: 2019-12-19T16:39:44 Last Updated: 2024-08-05T01:54:14.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API calls, potentially leading to user password exposure. This only affects CVP environments where: 1. Devices have enable mode passwords which are different from the user's login password, OR 2. There are configlet builders that use the Device class and specify username and password explicitly Application logs are not accessible or visible from the CVP GUI. Application logs
ecify username and password explicitly Application logs are not accessible or visible from the CVP GUI. Application logs can only be read by authorized users with privileged access to the VM hosting the CVP application. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/9002-security-advisory-45
CVE ID: CVE-2019-18618 State: PUBLISHED Published: 2020-07-22T13:21:29 Last Updated: 2024-08-05T01:54:14.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table. Additional Analyst Notes: - CVE Program Container: References: - https://www.synaptics.com/company/blog/ - https://support.lenovo.com/us/en/product_security/LEN-31372 - https://www.synaptics.com/sites/default/files/fingerprint-senso
://support.lenovo.com/us/en/product_security/LEN-31372 - https://www.synaptics.com/sites/default/files/fingerprint-sensor-VFS7500-security-brief-2020-07-14.pdf - https://support.hp.com/us-en/document/c06696474
CVE ID: CVE-2019-18619 State: PUBLISHED Published: 2020-07-22T13:15:53 Last Updated: 2024-08-05T01:54:14.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers. Additional Analyst Notes: - CVE Program Container: References: - https://www.synaptics.com/company/blog/ - https://www.synaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdf - https://www.syssec.wiwi.uni-due.
ynaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdf - https://www.syssec.wiwi.uni-due.de/en/research/research-projects/analysis-of-tee-software/ - https://support.lenovo.com/us/en/product_security/LEN-31372 - https://support.hp.com/hk-en/document/c06696568
CVE ID: CVE-2019-18622 State: PUBLISHED Published: 2019-11-22T20:32:52 Last Updated: 2024-08-05T01:54:14.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2019-5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEB
ps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html - https://security.gentoo.org/glsa/202003-39
CVE ID: CVE-2019-18623 State: PUBLISHED Published: 2019-11-08T17:48:43 Last Updated: 2024-08-05T01:54:14.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user clicks on a link on the public dashboard, the resource opens in EnergyCAP with access rights matching the user who created the dashboard. Additional Analyst Notes: - CVE Program Container: References: - https://energycap.freshdesk.com/support/solutions/articles/31000152837-2019-october-24-security-incident-notification-issue-with-public-dashboards-found-and-resolved - https://energycap.freshdesk.com/helpdesk/att
ity-incident-notification-issue-with-public-dashboards-found-and-resolved - https://energycap.freshdesk.com/helpdesk/attachments/31016649523
CVE ID: CVE-2019-18624 State: PUBLISHED Published: 2019-10-29T17:12:22 Last Updated: 2024-08-05T01:54:14.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO (aka Right to Left Override) approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and 44.1.2254.143214. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40YoKoKho/illegal-rendered-at-download-feature-in-opera-mini-that-lead-to-extension-manipulation-with-rtlo-685bf2d77d51 - http://f
illegal-rendered-at-download-feature-in-opera-mini-that-lead-to-extension-manipulation-with-rtlo-685bf2d77d51 - http://firstsight.me/2019/10/illegal-rendered-at-download-feature-in-several-apps-including-opera-mini-that-lead-to-extension-manipulation-with-rtlo/
CVE ID: CVE-2019-18625 State: PUBLISHED Published: 2020-01-06T20:09:13 Last Updated: 2024-08-05T01:54:14.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and the FIN ACK packets because of the bad TCP Timestamp option. Both linux and windows client are ignoring the injected packets. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.openinfosecfoundat
he injected packets. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.openinfosecfoundation.org/issues/3286 - https://github.com/OISF/suricata/commit/9f0294fadca3dcc18c919424242a41e01f3e8318 - https://redmine.openinfosecfoundation.org/issues/3395 - https://github.com/OISF/suricata/commit/ea0659de7640cf6a51de5bbd1dbbb0414e4623a0 - https://lists.debian.org/debian-lts-announce/2020/01/msg00032.html
CVE ID: CVE-2019-18626 State: PUBLISHED Published: 2020-03-25T17:01:30 Last Updated: 2024-08-05T01:54:14.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/Data/PY/T4W2Service.svc/RetrieveW2EntriesForEmployee URI, thus exposing sensitive information including employee tax information, social security numbers, home addresses, and more. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0011/FEYE-2019-0011.md
CVE ID: CVE-2019-18628 State: PUBLISHED Published: 2021-03-04T06:09:30 Last Updated: 2024-08-05T01:54:14.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow a user with administrative privileges to turn off data encryption on the device, thus leaving it open to potential cryptographic information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://security.business.xerox.com - https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX20I_for_ALB80xx-C80xx
https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX20I_for_ALB80xx-C80xx_v1.1.pdf
CVE ID: CVE-2019-18629 State: PUBLISHED Published: 2021-03-04T06:12:03 Last Updated: 2024-08-05T01:54:14.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a compromised private key. Additional Analyst Notes: - CVE Program Container: References: - https://security.business.xerox.com - https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX19AI_for
s.xerox.com - https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX19AI_for_ALB80xx-C80xx_v1.1.pdf
CVE ID: CVE-2019-18630 State: PUBLISHED Published: 2021-03-04T22:07:44 Last Updated: 2024-08-05T01:54:14.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, portions of the drive containing executable code were not encrypted thus leaving it open to potential cryptographic information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX20I_for_ALB80xx-C80xx_v1.2.pdf
CVE ID: CVE-2019-18631 State: PUBLISHED Published: 2019-11-05T15:30:33 Last Updated: 2024-08-05T01:54:14.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1 (18.8), 3.5.2 (18.11), and 3.6.0 (19.6) does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data, which allows attackers to execute arbitrary code inside the Centrify process via (1) a crafted application that makes a pipe connection to the process and sends malicious serialized data or (2) a crafted Microsoft Management Console snap-in control f
ction to the process and sends malicious serialized data or (2) a crafted Microsoft Management Console snap-in control file. Additional Analyst Notes: - CVE Program Container: References: - https://centrify.force.com/support/Article/KB-22420-Centrify-Agent-for-Windows-Remote-Code-Execution-Vulnerability
CVE ID: CVE-2019-18632 State: PUBLISHED Published: 2019-10-30T21:16:38 Last Updated: 2024-08-05T01:54:14.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/en/blog/advisories/15587/
CVE ID: CVE-2019-18633 State: PUBLISHED Published: 2019-10-30T21:16:47 Last Updated: 2024-08-05T01:54:14.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/en/blog/advisories/15587/
CVE ID: CVE-2019-18634 State: PUBLISHED Published: 2020-01-29T17:23:26 Last Updated: 2024-08-05T01:54:14.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/kb/HT210919 - https://s
ss.c. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/kb/HT210919 - https://seclists.org/bugtraq/2020/Jan/44 - https://www.sudo.ws/security.html - https://www.sudo.ws/alerts/pwfeedback.html - http://www.openwall.com/lists/oss-security/2020/01/30/6 - http://www.openwall.com/lists/oss-security/2020/01/31/1 - http://seclists.org/fulldisclosure/2020/Jan/40 - https://www.debian.org/security/2020/dsa-4614 - https://lists.debian.org/debian-lts-announce/2020/02/msg00002.html - https://seclists.org/bugtraq/2020/Feb/3 - https://seclists.org/bugtraq/2020/Feb/2 - http://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.html - http://
bugtraq/2020/Feb/2 - http://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.html - http://packetstormsecurity.com/files/156189/Sudo-1.8.25p-Buffer-Overflow.html - http://www.openwall.com/lists/oss-security/2020/02/05/2 - http://www.openwall.com/lists/oss-security/2020/02/05/5 - https://usn.ubuntu.com/4263-1/ - https://security.netapp.com/advisory/ntap-20200210-0001/ - https://usn.ubuntu.com/4263-2/ - https://access.redhat.com/errata/RHSA-2020:0487 - https://access.redhat.com/errata/RHSA-2020:0509 - https://access.redhat.com/errata/RHSA-2020:0540 - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00029.html - https://lists.fedoraproject.org/archive
0 - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00029.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/ - https://access.redhat.com/errata/RHSA-2020:0726 - https://security.gentoo.org/glsa/202003-12 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/
CVE ID: CVE-2019-18635 State: PUBLISHED Published: 2019-10-30T21:58:14 Last Updated: 2024-08-05T01:54:14.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing. There is a NULL pointer dereference in MPDevice_win.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://securiteam.io/2019/10/27/a-null-pointer-dereference/ - https://github.com/mooltipass/moolticute/pull/483
CVE ID: CVE-2019-18636 State: PUBLISHED Published: 2019-11-01T11:37:51 Last Updated: 2024-08-05T01:54:14.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Jitbit .NET Forum (aka ASP.NET forum) 8.3.8 allows remote attackers to inject arbitrary web script or HTML via the gravatar URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.jitbit.com/asp-net-forum/versionhistory/ - https://reallinkers.github.io/CVE-2019-18636/
CVE ID: CVE-2019-18641 State: PUBLISHED Published: 2020-03-20T20:35:18 Last Updated: 2024-08-05T01:54:14.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SparkDevNetwork/Rock/compare/1.7.6...1.8.6 - https://github.com/SparkDevNetwork/Rock/commit/576f5ec22b1c43f123a377612981c68538167c61 - http://seclists.org/fulldisclosure/2021/Jan/1 - http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html