Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10849 State: PUBLISHED Published: 2019-05-23T19:05:01 Last Updated: 2024-08-04T22:32:02.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://applied-risk.com/index.php/download_file/view/196/165 - http://packetstormsecurity.com/files/155248/Computrols-CBAS-Web-19.0.0-Information-Disclosure.html
CVE ID: CVE-2019-10850 State: PUBLISHED Published: 2019-05-23T19:03:11 Last Updated: 2024-08-04T22:32:02.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Computrols CBAS 18.0.0 has Default Credentials. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://applied-risk.com/index.php/download_file/view/196/165
CVE ID: CVE-2019-10851 State: PUBLISHED Published: 2019-05-23T18:58:23 Last Updated: 2024-08-04T22:32:02.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Computrols CBAS 18.0.0 has hard-coded encryption keys. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://applied-risk.com/index.php/download_file/view/196/165
CVE ID: CVE-2019-10852 State: PUBLISHED Published: 2019-05-23T18:56:52 Last Updated: 2024-08-04T22:32:02.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=start_pulling&id= substring. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://applied-risk.com/index.php/download_file/view/196/165 - http://packetstormsecurity.com/files/155251/Computrols-CBAS-Web-19.0.0-Blind-SQL-Injection.html
CVE ID: CVE-2019-10853 State: PUBLISHED Published: 2019-05-23T18:53:14 Last Updated: 2024-08-04T22:32:02.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Computrols CBAS 18.0.0 allows Authentication Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://applied-risk.com/index.php/download_file/view/196/165
CVE ID: CVE-2019-10854 State: PUBLISHED Published: 2019-05-23T18:45:13 Last Updated: 2024-08-04T22:32:02.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: Computrols CBAS 18.0.0 allows Authenticated Command Injection. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://applied-risk.com/index.php/download_file/view/196/165
CVE ID: CVE-2019-10855 State: PUBLISHED Published: 2019-05-23T18:43:28 Last Updated: 2024-08-04T22:32:02.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database. Additional Analyst Notes: - CVE Program Container: References: - https://applied-risk.com/labs/advisories - https://applied-risk.com/index.php/download_file/view/196/165
CVE ID: CVE-2019-10856 State: PUBLISHED Published: 2019-04-04T15:48:33 Last Updated: 2024-08-04T22:32:02.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4 - https://github.com/jupyter/notebook/compare/16cf97c...b8e30ea
CVE ID: CVE-2019-10863 State: PUBLISHED Published: 2019-04-04T17:07:13 Last Updated: 2024-08-04T22:32:02.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46641/ - https://www.exploit-db.com/exploits/46641 - https://pentest.com.tr/exploits/TeemIp-IPAM-2-4-0-new-config-Command-Injection-Metasploit.html
CVE ID: CVE-2019-10864 State: PUBLISHED Published: 2019-04-23T17:42:48 Last Updated: 2024-08-04T22:32:02.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wp-statistics/wp-statistics/commit/5aec0a08680f0afea387267a8d1b9fbb3379247c - https://medium.com/%40aramburu/cve-2019-10864-wordpress-7aebc24751c4
CVE ID: CVE-2019-10866 State: PUBLISHED Published: 2019-05-23T18:34:28 Last Updated: 2024-08-04T22:32:02.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/form-maker/#developers - http://seclists.org/fulldisclosure/2019/May/8 - https://wpvulndb.com/vulnerabilities/9286
CVE ID: CVE-2019-10867 State: PUBLISHED Published: 2019-04-04T17:51:16 Last Updated: 2024-08-04T22:32:02.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998 - https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73 - h
/SNYK-PHP-PIMCOREPIMCORE-173998 - https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73 - http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html - http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce - https://www.exploit-db.com/exploits/46783/ - https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce
CVE ID: CVE-2019-10868 State: PUBLISHED Published: 2019-04-05T00:25:41 Last Updated: 2024-08-04T22:32:02.074Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.tryton.org/t/security-release-for-issue8189/1262 - https://hg.tryton.org/trytond/rev/f58bbfe0aefb - http
https://discuss.tryton.org/t/security-release-for-issue8189/1262 - https://hg.tryton.org/trytond/rev/f58bbfe0aefb - https://www.debian.org/security/2019/dsa-4426 - https://seclists.org/bugtraq/2019/Apr/14
CVE ID: CVE-2019-10869 State: PUBLISHED Published: 2019-05-07T17:07:57 Last Updated: 2024-08-04T22:32:02.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.onvio.nl/nieuws/ninjaforms-vulnerability - https://wpvulndb.com/vulnerabilities/9272
CVE ID: CVE-2019-10871 State: PUBLISHED Published: 2019-04-05T03:16:23 Last Updated: 2024-08-04T22:32:02.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/751 - http://www.securityfocus.com/bid/107862 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.o
AWV24KRXTFODLVT46RXI27XIQFX2QR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWS7NVFFCUY3YSTMEKZEJEU6JVUUBKHB/ - https://access.redhat.com/errata/RHSA-2019:2713 - https://lists.debian.org/debian-lts-announce/2019/10/msg00024.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00025.html
CVE ID: CVE-2019-10872 State: PUBLISHED Published: 2019-04-05T03:16:40 Last Updated: 2024-08-04T22:32:02.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/750 - http://www.securityfocus.com/bid/107862 - https://lists.debian.org/debian-lts-announce/2019/06/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/ - https://lists.fedor
archives/list/package-announce%40lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWS7NVFFCUY3YSTMEKZEJEU6JVUUBKHB/ - https://usn.ubuntu.com/4042-1/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html
CVE ID: CVE-2019-10873 State: PUBLISHED Published: 2019-04-05T03:17:06 Last Updated: 2024-08-04T22:32:02.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/748 - http://www.securityfocus.com/bid/107862 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MAWV24KRXTFODLVT46RXI27XIQFX2QR/ - https://usn.ubuntu.com/4042-1/
CVE ID: CVE-2019-10874 State: PUBLISHED Published: 2019-04-05T04:42:32 Last Updated: 2024-08-04T22:32:02.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://fgsec.net/from-csrf-to-rce-bolt-cms/ - https://github.com/bolt/bolt/pull/7768/commits/91187aef36363a870d60b0a3c1bf8507af34c9e4 - https://www.exploit-db.com/exploits/46664/ - http://packetstormsecuri
commits/91187aef36363a870d60b0a3c1bf8507af34c9e4 - https://www.exploit-db.com/exploits/46664/ - http://packetstormsecurity.com/files/152429/Bolt-CMS-3.6.6-Cross-Site-Request-Forgery-Code-Execution.html
CVE ID: CVE-2019-10875 State: PUBLISHED Published: 2019-04-05T12:36:49 Last Updated: 2024-08-04T22:32:02.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MIUI native browser) and Mint Browser 1.5.3 due to the way they handle the "q" query parameter. The portion of an https URL before the ?q= substring is not shown to the user. Additional Analyst Notes: - CVE Program Container: References: - https://sec.xiaomi.com/bug/5bedef67a31ec71e - https://thehackernews.com/2019/04/xiaomi-browser-vulnerability.html - https://www.andmp.com/2019/04/xiaomi-url-spoofing-w-ssl-vulnerabili
news.com/2019/04/xiaomi-browser-vulnerability.html - https://www.andmp.com/2019/04/xiaomi-url-spoofing-w-ssl-vulnerability.html - http://packetstormsecurity.com/files/152497/Xiaomi-Mi-Browser-Mint-Browser-URL-Spoofing.html
CVE ID: CVE-2019-10876 State: PUBLISHED Published: 2019-04-05T04:01:40 Last Updated: 2024-08-04T22:32:02.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launc
tron-openvswitch-agent are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ossa/+bug/1813007 - https://review.openstack.org/#/q/topic:bug/1813007 - https://security.openstack.org/ossa/OSSA-2019-002.html - http://www.openwall.com/lists/oss-security/2019/04/09/2 - https://access.redhat.com/errata/RHSA-2019:0935 - https://access.redhat.com/errata/RHSA-2019:0879
CVE ID: CVE-2019-10877 State: PUBLISHED Published: 2019-04-05T04:31:14 Last Updated: 2024-08-04T22:32:02.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/teeworlds/teeworlds/issues/2071 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KCS2CFDYJFBLZ4QKVPNJWHOZEGQ2LBC/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00046.html - http://lists.opensu
LZ4QKVPNJWHOZEGQ2LBC/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00046.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00077.html
CVE ID: CVE-2019-10878 State: PUBLISHED Published: 2019-04-05T04:31:38 Last Updated: 2024-08-04T22:32:02.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Teeworlds 0.7.2, there is a failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions in engine/shared/datafile.cpp that can lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/teeworlds/teeworlds/issues/2073 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KCS2CFDYJFBLZ4QKVPNJWHOZEGQ2LBC/ -
s.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KCS2CFDYJFBLZ4QKVPNJWHOZEGQ2LBC/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00046.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00077.html
CVE ID: CVE-2019-10879 State: PUBLISHED Published: 2019-04-05T04:31:49 Last Updated: 2024-08-04T22:32:02.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Teeworlds 0.7.2, there is an integer overflow in CDataFileReader::Open() in engine/shared/datafile.cpp that can lead to a buffer overflow and possibly remote code execution, because size-related multiplications are mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/teeworlds/teeworlds/issues/2070 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KCS2CFDYJFBLZ4QKVPNJWHOZEGQ2LBC/ - http://lists.opensuse.org/opensuse-security-announ
40lists.fedoraproject.org/message/5KCS2CFDYJFBLZ4QKVPNJWHOZEGQ2LBC/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00046.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00077.html
CVE ID: CVE-2019-10880 State: PUBLISHED Published: 2019-04-12T17:37:54 Last Updated: 2024-08-04T22:32:02.151Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: XEROX Products: AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070, WorkCentre 3655, WorkCentre 5845/5855/5865/5875/5890, WorkCentre 5945/5955, WorkCentre 6655, WorkCentre 7220/7225, WorkCentre 7830/7835/7845/7855, WorkCentre 7970, WorkCentre EC7836/EC7856, ColorQube 9301/9302/9303, ColorQube 8700/8900, WorkCentre 6400, Phaser 6700, Phaser 7800, WorkCentre 5735/5740/5745/5755/5765/5775/5790, WorkCentre 7525/7530/7535/7545/7556, WorkCentre 7755/7765/7775 Problem Types: CWE-7
5735/5740/5745/5755/5765/5775/5790, WorkCentre 7525/7530/7535/7545/7556, WorkCentre 7755/7765/7775 Problem Types: CWE-78 Description: Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary. Additional Analyst Notes: - CVE Program Container: References: - https://airbus-seclab.github.io/ - https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf
CVE ID: CVE-2019-10881 State: PUBLISHED Published: 2021-04-13T20:58:01 Last Updated: 2024-08-04T22:32:02.132Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: XEROX Products: AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070, WorkCentre 3655, WorkCentre 5845/5855/5865/5875/5890, WorkCentre 5945/5955, WorkCentre 6655, WorkCentre 7220/7225, WorkCentre 7830/7835/7845/7855, WorkCentre 7970, WorkCentre EC7836/EC7856, ColorQube 9301/9302/9303, ColorQube 8700/8900, WorkCentre 6400, Phaser 6700, Phaser 7800, WorkCentre 5735/5740/5745/5755/5765/5775/5790, WorkCentre 7525/7530/7535/7545/7556, WorkCentre 7755/7765/7775 Problem Types: CWE-2
5735/5740/5745/5755/5765/5775/5790, WorkCentre 7525/7530/7535/7545/7556, WorkCentre 7755/7765/7775 Problem Types: CWE-259 Description: Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded passwords which can be exploited and allow unauthorized access which cannot be disabled. Additional Analyst Notes: - CVE Program Container: References: - https://airbus-seclab.github.io/
CVE ID: CVE-2019-10882 State: PUBLISHED Published: 2019-09-26T15:16:09.626407Z Last Updated: 2024-09-16T23:00:47.885Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Netskope Products: Netskope client Problem Types: CWE-120 Description: The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from a stack based buffer overflow in "doHandshakefromServer" function. Local users can use this vulnerability to trigger a crash of the service and potentially cause additional impact on the system. Additional Analy
vulnerability to trigger a crash of the service and potentially cause additional impact on the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.netskope.com/hc/article_attachments/360033003553/Sprint_62_Release_Notes.pdf - https://support.netskope.com/hc/en-us/articles/360014589894-Netskope-Client - https://airbus-seclab.github.io/advisories/netskope.html
CVE ID: CVE-2019-10883 State: PUBLISHED Published: 2019-06-03T20:37:36 Last Updated: 2024-08-04T22:32:02.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research - https://support.citrix.com/v1/search?searchQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin - https://www.tenable.com/security/research/tra-2019-18 - https://support.citrix.com/article/CTX247737
CVE ID: CVE-2019-10884 State: PUBLISHED Published: 2019-04-05T16:45:27 Last Updated: 2024-08-04T22:32:02.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vulnerability means that passwords saved for example.com will be recommended for usersite.example.com. This could lead to successful phishing campaigns and create a sense of false security. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.133069
CVE ID: CVE-2019-10885 State: PUBLISHED Published: 2019-04-05T16:57:14 Last Updated: 2024-08-04T22:40:14.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Workspace Control before 10.3.90.0. Local authenticated users with low privileges in a Workspace Control managed session can bypass Workspace Control security features configured for this session by resetting the session context. Additional Analyst Notes: - CVE Program Container: References: - https://community.ivanti.com/docs/DOC-74552 - http://packetstormsecurity.com/files/156792/Ivanti-Workspace-Manager-Security-Bypass.html
CVE ID: CVE-2019-10886 State: PUBLISHED Published: 2019-04-19T17:51:49 Last Updated: 2024-08-04T22:40:14.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable TVs). This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is running. This may allow an attacker to browse a particular directory (e.g. images) inside the private network. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Apr/32 - http://
dditional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Apr/32 - http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html - https://www.sony.com/electronics/support/downloads/00016043 - https://seclists.org/bugtraq/2019/Apr/34 - http://www.securityfocus.com/bid/108072
CVE ID: CVE-2019-10887 State: PUBLISHED Published: 2019-04-05T17:26:00 Last Updated: 2024-08-04T22:40:15.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected HTML injection vulnerability on Salicru SLC-20-cube3(5) devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name= request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/Salicru-%20UPS-Reflected%20HTML%20Injection - https://www.exploit-db.com/exploits/46667/ - http://pack
ities/blob/master/Salicru-%20UPS-Reflected%20HTML%20Injection - https://www.exploit-db.com/exploits/46667/ - http://packetstormsecurity.com/files/152435/SaLICru-SLC-20-cube3-5-HTML-Injection.html