Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-3474 State: PUBLISHED Published: 2019-02-20T22:00:00 Last Updated: 2024-08-04T19:12:09.398Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Micro Focus Products: Filr Problem Types: CWE-22 Description: A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46450/ - https://download.novell.com/Download?buildid=nZUCSDkvpxk
ner: References: - https://www.exploit-db.com/exploits/46450/ - https://download.novell.com/Download?buildid=nZUCSDkvpxk~ - https://support.microfocus.com/kb/doc.php?id=7023726
CVE ID: CVE-2019-3475 State: PUBLISHED Published: 2019-02-20T22:00:00 Last Updated: 2024-08-04T19:12:09.660Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Micro Focus Products: Filr Problem Types: CWE-264 Description: A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46450/ - https://support.microfocus.com/kb/doc.php?id=7023727 - https://download.novell.com/Do
w.exploit-db.com/exploits/46450/ - https://support.microfocus.com/kb/doc.php?id=7023727 - https://download.novell.com/Download?buildid=nZUCSDkvpxk~
CVE ID: CVE-2019-3476 State: PUBLISHED Published: 2019-03-25T16:07:28 Last Updated: 2024-08-04T19:12:09.291Z Vendors: n/a Products: Micro Focus Data Protector Problem Types: Remote Arbitrary Code Execution Description: Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03337614
CVE ID: CVE-2019-3477 State: PUBLISHED Published: 2019-06-07T16:17:00 Last Updated: 2024-08-04T19:12:09.415Z Vendors: Micro Focus Products: Solutions Business Manager Problem Types: open redirect. Description: Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect. Additional Analyst Notes: - CVE Program Container: References: - http://help.serena.com/doc_center/sbm/ver11_4_2/sbm_release_notes.htm
CVE ID: CVE-2019-3479 State: PUBLISHED Published: 2019-03-25T16:01:14 Last Updated: 2024-08-04T19:12:09.503Z Vendors: n/a Products: ArcSight Logger Problem Types: remote code execution Description: Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03355866
CVE ID: CVE-2019-3480 State: PUBLISHED Published: 2019-03-25T16:03:37 Last Updated: 2024-08-04T19:12:09.599Z Vendors: n/a Products: ArcSight Logger Problem Types: stored/reflected XSS Description: Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03355866
CVE ID: CVE-2019-3481 State: PUBLISHED Published: 2019-03-25T16:04:29 Last Updated: 2024-08-04T19:12:09.469Z Vendors: n/a Products: ArcSight Logger Problem Types: XML External Entity Parsing Description: Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03355866
CVE ID: CVE-2019-3482 State: PUBLISHED Published: 2019-03-25T16:05:03 Last Updated: 2024-08-04T19:12:09.362Z Vendors: n/a Products: ArcSight Logger Problem Types: directory traversal Description: Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03355866
CVE ID: CVE-2019-3483 State: PUBLISHED Published: 2019-03-25T16:05:48 Last Updated: 2024-08-04T19:12:09.454Z Vendors: n/a Products: ArcSight Logger Problem Types: information leakage Description: Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03355866
CVE ID: CVE-2019-3484 State: PUBLISHED Published: 2019-03-25T16:06:24 Last Updated: 2024-08-04T19:12:09.470Z Vendors: n/a Products: ArcSight Logger Problem Types: remote code execution Description: Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03355866
CVE ID: CVE-2019-3485 State: PUBLISHED Published: 2019-07-24T15:30:12.893311Z Last Updated: 2024-09-17T02:06:16.452Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Micro Focus Products: ArcSight Logger Problem Types: stored cross site script Description: Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1 Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109363 - https://community.microfocus.com/t5/Logger/Logger-Release-Notes-6-71/ta-p/1790256?attachment-id=75011
CVE ID: CVE-2019-3486 State: PUBLISHED Published: 2019-07-25T14:30:16.486220Z Last Updated: 2024-09-16T22:35:08.353Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Micro Focus Products: Arcsight Security Management Center Problem Types: stored cross site script Description: Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1 Additional Analyst Notes: - CVE Program Container: References: - https://community.microfocus.com/t5/ArcSight-Management-Center-ArcMC/ArcSight-Management-Center-2-91-Release-Notes/ta-p/1790266?attachment-id=74671
CVE ID: CVE-2019-3489 State: PUBLISHED Published: 2019-04-01T19:12:43 Last Updated: 2024-08-04T19:12:09.499Z Vendors: Micro Focus Products: Micro Focus Content Manager Problem Types: Remote upload content to arbitrary locations Description: An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to arbitrary locations on the Content Manager server. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM0335
ver. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03359911
CVE ID: CVE-2019-3490 State: PUBLISHED Published: 2019-05-02T16:46:37 Last Updated: 2024-08-04T19:12:09.334Z Vendors: OES Products: Netstorage component of Open Enterprise Server Problem Types: DOM based XSS Description: A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and OES2018SP1. Older versions may be affected but were not tested as they are out of support. Additional Analyst Notes: - CVE Program Container: References: - https://support.microfoc
ed as they are out of support. Additional Analyst Notes: - CVE Program Container: References: - https://support.microfocus.com/kb/doc.php?id=7023828
CVE ID: CVE-2019-3493 State: PUBLISHED Published: 2019-04-29T15:47:08 Last Updated: 2024-08-04T19:12:09.509Z Vendors: Micro Focus Products: Micro Focus Network Automation and Micro Focus Network Operations Management (NOM) Problem Types: Remote Code Execution Description: A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20, 9.21, 10.00, 10.10, 10.20, 10.30, 10.40, 10.50, 2018.05, 2018.08, 2018.11, and Micro Focus Network Operations Management (NOM) all versions. The vulnerability could be remotely exploited to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/K
xecution. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03407763
CVE ID: CVE-2019-3494 State: PUBLISHED Published: 2019-01-01T15:00:00Z Last Updated: 2024-09-16T16:28:54.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simply-Blog through 2019-01-01 has SQL Injection via the admin/deleteCategories.php delete parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Paroxyste/Simply-Blog/issues/1
CVE ID: CVE-2019-3495 State: PUBLISHED Published: 2019-03-18T17:14:33 Last Updated: 2024-08-04T19:12:09.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. network/mesh/edit-nds.php is vulnerable to arbitrary file upload, allowing an attacker to upload .php files and execute code on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html - http://seclists.org/fulldi
acketstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html - http://seclists.org/fulldisclosure/2019/Jan/23 - https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x/
CVE ID: CVE-2019-3496 State: PUBLISHED Published: 2019-03-18T17:35:55 Last Updated: 2024-08-04T19:12:09.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Wifi-soft UniBox controller 3.x devices. The tools/controller/diagnostic_tools_controller Diagnostic Tools Controller is vulnerable to Remote Command Execution, allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-In
Program Container: References: - http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html - http://seclists.org/fulldisclosure/2019/Jan/23 - https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x/
CVE ID: CVE-2019-3497 State: PUBLISHED Published: 2019-03-18T17:40:31 Last Updated: 2024-08-04T19:12:09.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diagnostic Tools component is vulnerable to Remote Command Execution, allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injec
gram Container: References: - http://packetstormsecurity.com/files/151077/Wifi-soft-Unibox-2.x-Remote-Command-Code-Injection.html - http://seclists.org/fulldisclosure/2019/Jan/23 - https://sahildhar.github.io/blogpost/Multiple-RCE-Vulnerabilties-in-Unibox-Controller-0.x-3.x/
CVE ID: CVE-2019-3498 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-04T19:12:09.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/django-announce/VYU7xQQTEPQ - https://docs.djangoproject.com/en/dev/releases/secur
s://groups.google.com/forum/#%21topic/django-announce/VYU7xQQTEPQ - https://docs.djangoproject.com/en/dev/releases/security/ - https://usn.ubuntu.com/3851-1/ - http://www.securityfocus.com/bid/106453 - https://lists.debian.org/debian-lts-announce/2019/01/msg00005.html - https://www.djangoproject.com/weblog/2019/jan/04/security-releases/ - https://www.debian.org/security/2019/dsa-4363 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ/
CVE ID: CVE-2019-3500 State: PUBLISHED Published: 2019-01-02T07:00:00 Last Updated: 2024-08-04T19:12:09.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aria2/aria2/issues/1329 - https://lists.debian.org/debian-lts-announce/2019/01/msg00012.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/ - https://lists.fedora
rchives/list/package-announce%40lists.fedoraproject.org/message/7MUUYDELHRLVE2AFNVR3OJ6ILUKVLY4B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/532M22TAOOIY3J4XX4R7BLZHXJRUSBQ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5OLPTVYHJZJ2MVEXJCNPXBSFPVPE4XX/ - https://usn.ubuntu.com/3965-1/ - https://lists.debian.org/debian-lts-announce/2021/12/msg00039.html
CVE ID: CVE-2019-3501 State: PUBLISHED Published: 2019-01-02T13:00:00 Last Updated: 2024-08-04T19:12:09.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46080/ - https://github.com/Sama34/OUGC-Awards/pull/31 - https://github.com/Sama34/OUGC-Awards/issues/29
CVE ID: CVE-2019-3552 State: PUBLISHED Published: 2019-05-06T15:15:02 Last Updated: 2024-08-04T19:12:09.356Z Vendors: Facebook Products: Facebook Thrift Problem Types: CWE-834 Description: C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62b - http://www.securityfoc
erences: - https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62b - http://www.securityfocus.com/bid/108279 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2019-3553 State: PUBLISHED Published: 2020-03-10T20:30:21 Last Updated: 2024-08-04T19:12:09.503Z Vendors: Facebook Products: Facebook Thrift Problem Types: CWE-770 Description: C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/fbthrift/commit/c9a903e5902834e95bbd4ab0e9fa53ba0189f351 - https://github.com/facebook/
s: - https://github.com/facebook/fbthrift/commit/c9a903e5902834e95bbd4ab0e9fa53ba0189f351 - https://github.com/facebook/fbthrift/commit/3f156207e8a6583d88999487e954320dc18955e6 - https://www.facebook.com/security/advisories/cve-2019-3553
CVE ID: CVE-2019-3554 State: PUBLISHED Published: 2019-01-15T22:00:00 Last Updated: 2024-08-04T19:12:09.432Z Vendors: Facebook Products: Wangle Problem Types: CWE-400 Description: Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/wangle/commit/3b17ba10a82c71e7808760e027ac6af687e06074
CVE ID: CVE-2019-3556 State: PUBLISHED Published: 2021-10-26T20:05:10 Last Updated: 2024-08-04T19:12:09.554Z Vendors: Facebook Products: HHVM Problem Types: CWE-22 Description: HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions
rary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0. Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2020/11/12/security-update.html - https://github.com/facebook/hhvm/commit/abe0b29e4d3a610f9bc920b8be4ad8403364c2d4 - https://www.facebook.com/security/advisories/cve-2019-3556
CVE ID: CVE-2019-3557 State: PUBLISHED Published: 2019-01-15T22:00:00 Last Updated: 2024-08-04T19:12:09.545Z Vendors: Facebook Products: HHVM Problem Types: CWE-125 Description: The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below). Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2019/01/14/hhvm-
27.4 and below). Additional Analyst Notes: - CVE Program Container: References: - https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html - https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994
CVE ID: CVE-2019-3558 State: PUBLISHED Published: 2019-05-06T15:15:02 Last Updated: 2024-08-04T19:12:09.557Z Vendors: Facebook Products: Facebook Thrift Problem Types: CWE-834 Description: Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62b - https://www.facebook.com/securit
https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62b - https://www.facebook.com/security/advisories/cve-2019-3558 - http://www.securityfocus.com/bid/108274 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2019-3559 State: PUBLISHED Published: 2019-05-06T15:15:02 Last Updated: 2024-08-04T19:12:09.476Z Vendors: Facebook Products: Facebook Thrift Problem Types: CWE-834 Description: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/fbthrift/commit/a56346ceacad28bf470017a6bda1d5518d0bd943 - https://www.facebook.com/security/
ttps://github.com/facebook/fbthrift/commit/a56346ceacad28bf470017a6bda1d5518d0bd943 - https://www.facebook.com/security/advisories/cve-2019-3559 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2019-3560 State: PUBLISHED Published: 2019-04-29T00:00:00.000Z Last Updated: 2025-02-13T16:27:24.219Z Vendors: Facebook Products: fizz Problem Types: CWE-835 Description: An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on user input. This issue affected versions of fizz prior to v2019.03.04.00. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebookincubator/fizz/commit/40bbb161e72fb609608d53b9d64c56bb961a6ee2 - http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html - http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-
y.com/files/172836/polkit-Authentication-Bypass.html - http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html
CVE ID: CVE-2019-3561 State: PUBLISHED Published: 2019-04-29T15:32:45 Last Updated: 2024-08-04T19:12:09.501Z Vendors: Facebook Products: HHVM Problem Types: CWE-119 Description: Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM (4.0.3, 3.30.4, and 3.27.7 and below). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hhvm/commit/46003b4ab564b2abcd8470035fc324fe36aa8c75 - https://hhvm.com/blog/2019/04/03/hhvm-4.0.4.html
CVE ID: CVE-2019-3562 State: PUBLISHED Published: 2019-04-29T15:32:45 Last Updated: 2024-08-04T19:12:09.679Z Vendors: Oculus Products: Oculus Browser Problem Types: CWE-74 Description: A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11. Additional Analyst Notes: - CVE Program Container: References: - https://www.facebook.com/security/advisories/cve-2019-3562
CVE ID: CVE-2019-3563 State: PUBLISHED Published: 2019-04-29T15:32:45 Last Updated: 2024-08-04T19:12:09.559Z Vendors: Facebook Products: Wangle Problem Types: CWE-126 Description: Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow. This affects versions of Wangle prior to v2019.04.22.00 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/wangle/commit/5b3bceca875e4ea4ed9d14c20b20ce46c92c13c6