Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12454 State: PUBLISHED Published: 2019-05-30T03:04:34 Last Updated: 2024-08-04T23:17:40.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in wcd9335_codec_enable_dec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instead of kmemdup_nul, which allows attackers to have an unspecified impact via unknown vectors. NOTE: The vendor disputes this issues as not being a vulnerability because switching to kmemdup_nul() would only fix a security issue if the source string wasn't NUL-terminated, which is not the case Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://l
hich is not the case Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lkml.org/lkml/2019/5/29/705 - https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git/commit/?h=for-5.3&id=a54988113985ca22e414e132054f234fc8a92604 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI/ - https://bugzilla.suse.com/show_bug.cgi?id=1136963#c1 - https://support.f5.com/csp/article/K13523672 - https://support.f5.com/csp/article/K13523672?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-12455 State: PUBLISHED Published: 2019-05-30T03:04:52 Last Updated: 2024-08-04T23:17:40.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is an unchecked kstrndup of derived_name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This id is disputed as not being an issue because “The memory allocation that was not checked is part of a code that only runs at boot time, before user processes are started. Therefore, there is no possibility for an unprivileged user to control it, and no
me, before user processes are started. Therefore, there is no possibility for an unprivileged user to control it, and no denial of service.” Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg2010240.html - https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux.git/commit/?h=sunxi/clk-for-5.3&id=fcdf445ff42f036d22178b49cf64e92d527c1330 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI/ - https://security.netapp.com/advisory/ntap-20190710-0002/
CVE ID: CVE-2019-12456 State: PUBLISHED Published: 2019-05-30T11:38:24 Last Updated: 2024-08-04T23:17:40.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a "double fetch" vulnerability. NOTE: a third party reports that this is unexploitable because the doubly fetched value is not used Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.or
doubly fetched value is not used Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=5.3/scsi-queue&id=86e5aca7fa2927060839f3e3b40c8bd65a7e8d1e - https://lkml.org/lkml/2019/5/29/1164 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDURACJVGIBIYBSGDZJTRDPX46H5WPZW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBJHGQXA4PQ5EOGCOXEH3KFDNVZ2I4X7/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html - http://lis
announce/2019-06/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html - https://bugzilla.redhat.com/show_bug.cgi?id=1717182 - https://support.f5.com/csp/article/K84310302 - https://support.f5.com/csp/article/K84310302?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-12457 State: PUBLISHED Published: 2019-05-30T12:30:24 Last Updated: 2024-08-04T23:17:40.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EmreOvunc/FileRun-Vulnerabilities/ - https://emreovunc.com/blog/en/FileRun-DirectoryListing-1.png - https://filerun.com/changelog - https://github.com/EmreOvunc/FileRun-Vulnerabilities/issues/3
CVE ID: CVE-2019-12458 State: PUBLISHED Published: 2019-05-30T12:30:36 Last Updated: 2024-08-04T23:17:40.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EmreOvunc/FileRun-Vulnerabilities/ - https://filerun.com/changelog - https://emreovunc.com/blog/en/FileRun-DirectoryListing-2.png - https://github.com/EmreOvunc/FileRun-Vulnerabilities/issues/3
CVE ID: CVE-2019-12459 State: PUBLISHED Published: 2019-05-30T12:30:46 Last Updated: 2024-08-04T23:17:40.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EmreOvunc/FileRun-Vulnerabilities/ - https://filerun.com/changelog - https://emreovunc.com/blog/en/FileRun-DirectoryListing-3.png - https://github.com/EmreOvunc/FileRun-Vulnerabilities/issues/3
CVE ID: CVE-2019-12460 State: PUBLISHED Published: 2019-05-30T12:30:58 Last Updated: 2024-08-04T23:17:40.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web Port 1.19.1 allows XSS via the /access/setup type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS/ - https://emreovunc.com/blog/en/WebPort-Reflected-XSS-01.png - http://packetstormsecurity.com/files/158174/WebPort-1.19.1-Cross-Site-Scripting.html
CVE ID: CVE-2019-12461 State: PUBLISHED Published: 2019-05-30T12:31:08 Last Updated: 2024-08-04T23:17:40.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web Port 1.19.1 allows XSS via the /log type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS/ - https://emreovunc.com/blog/en/WebPort-Reflected-XSS-02.png - http://packetstormsecurity.com/files/158174/WebPort-1.19.1-Cross-Site-Scripting.html
CVE ID: CVE-2019-12463 State: PUBLISHED Published: 2019-09-09T13:02:52 Last Updated: 2024-08-04T23:17:40.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. RRDt
tacker to inject RRDtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, disclosing file content, denial of service, or writing arbitrary files. NOTE: relative to CVE-2019-10665, this requires authentication and the pathnames differ. Additional Analyst Notes: - CVE Program Container: References: - https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-022/
CVE ID: CVE-2019-12464 State: PUBLISHED Published: 2019-09-09T13:04:19 Last Updated: 2024-08-04T23:17:40.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.darkmatter.ae/xen1thlabs/librenms-limited-local-file-inclusion-via-directory-traversal-vulnerability-xl-19-019/
CVE ID: CVE-2019-12465 State: PUBLISHED Published: 2019-09-09T13:05:55 Last Updated: 2024-08-04T23:17:40.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajax_rulesuggest.php?debug=1&term= request. Additional Analyst Notes: - CVE Program Container: References: - https://www.darkmatter.ae/xen1thlabs/librenms-sql-injection-vulnerability-xl-19-024/
CVE ID: CVE-2019-12466 State: PUBLISHED Published: 2019-07-10T15:31:50 Last Updated: 2024-08-04T23:17:40.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wikimedia MediaWiki through 1.32.1 allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4460 - https://seclists.org/bugtraq/2019/Jun/12 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html - https://phabricator.wikimedia.org/T25227
CVE ID: CVE-2019-12467 State: PUBLISHED Published: 2019-07-10T14:45:01 Last Updated: 2024-08-04T23:24:37.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4460 - https://seclists.org/bugtraq/2019/Jun/12 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html - https://phabricator.wikimedia.org/T209794
CVE ID: CVE-2019-12468 State: PUBLISHED Published: 2019-07-10T14:58:15 Last Updated: 2024-08-04T23:24:37.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://lists.wikimedia.org/pipermail/mediawiki-announce/ - https://www.debian.org/security/2019/dsa-4460 - https://seclists.org/bugtraq/2019/Jun/12 - https://phabricator.wikimedia.org/T197279 - https://lists.wikimedia.org/pipermail/wikitech-
ts.org/bugtraq/2019/Jun/12 - https://phabricator.wikimedia.org/T197279 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
CVE ID: CVE-2019-12469 State: PUBLISHED Published: 2019-07-10T16:01:53 Last Updated: 2024-08-04T23:24:37.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4460 - https://seclists.org/bugtraq/2019/Jun/12 - https://phabricator.wikimedia.org/T222036 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
CVE ID: CVE-2019-12470 State: PUBLISHED Published: 2019-07-10T16:04:55 Last Updated: 2024-08-04T23:24:37.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4460 - https://seclists.org/bugtraq/2019/Jun/12 - https://phabricator.wikimedia.org/T222038 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
CVE ID: CVE-2019-12471 State: PUBLISHED Published: 2019-07-10T15:49:21 Last Updated: 2024-08-04T23:24:37.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4460 - https://seclists.org/bugtraq/2019/Jun/12 - https://phabricator.wikimedia.org/T207603 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
CVE ID: CVE-2019-12472 State: PUBLISHED Published: 2019-07-10T15:55:03 Last Updated: 2024-08-04T23:24:38.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T199540 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
CVE ID: CVE-2019-12473 State: PUBLISHED Published: 2019-07-10T15:43:45 Last Updated: 2024-08-04T23:24:37.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4460 - https://seclists.org/bugtraq/2019/Jun/12 - https://phabricator.wikimedia.org/T204729 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
CVE ID: CVE-2019-12474 State: PUBLISHED Published: 2019-07-10T15:58:05 Last Updated: 2024-08-04T23:24:38.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4460 - https://seclists.org/bugtraq/2019/Jun/12 - https://phabricator.wikimedia.org/T212118 - https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
CVE ID: CVE-2019-12475 State: PUBLISHED Published: 2019-07-17T16:10:34 Last Updated: 2024-08-04T23:24:37.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/undefinedmode/CVE-2019-12475 - https://community.microstrategy.com/s/article/Defects-and-Enhancements-Addressed-in-MicroStrategy-10-4-6-Secure-Enterprise-Platform?language=en_US
CVE ID: CVE-2019-12476 State: PUBLISHED Published: 2019-06-17T17:02:28 Last Updated: 2024-08-04T23:24:38.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/0katz/54167ba30ea361f3776e269bb7b1afb3 - https://github.com/0katz/CVE-2019-12476 - http://www.securityfocus.com/bid/108813
CVE ID: CVE-2019-12477 State: PUBLISHED Published: 2019-06-07T14:51:07 Last Updated: 2024-08-04T23:24:38.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri&uri= URI. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1ZVHn_bPE-3kqYd2D-3AJpXZdd4dlmzVh/view?usp=sharing - http://packetstormsecurity.com/files/153191/Supra-Smart-Cloud-TV-Remote-File-Inclusion.html
CVE ID: CVE-2019-12479 State: PUBLISHED Published: 2019-08-13T20:46:14 Last Updated: 2024-08-04T23:24:37.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in the LocalStorageProvider allows creating and reading files outside of the specified basepath. If the application using this library does not sanitize user-supplied filenames, then this issue may be exploited to read or write arbitrary files. This affects LocalStorageProvider.cs. Additional Analyst Notes: - CVE Program Container: References: - https://security401.com/twentytwenty-storage-path-traversal/
CVE ID: CVE-2019-12480 State: PUBLISHED Published: 2019-05-30T21:53:09 Last Updated: 2024-08-04T23:24:38.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. An unauthenticated remote attacker could cause a denial of service (bacserv daemon crash) because there is an invalid read in bacdcode.c during parsing of alarm tag numbers. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/bacnet/bugs/62/ - https://sourceforge.net/p/bacnet/code
- CVE Program Container: References: - https://sourceforge.net/p/bacnet/bugs/62/ - https://sourceforge.net/p/bacnet/code/3220 - https://sourceforge.net/p/bacnet/code/3223 - https://sourceforge.net/p/bacnet/code/3224 - https://sourceforge.net/p/bacnet/code/3225 - http://packetstormsecurity.com/files/153716/BACnet-Stack-0.8.6-Denial-Of-Service.html - https://1modm.github.io/CVE-2019-12480.html
CVE ID: CVE-2019-12481 State: PUBLISHED Published: 2019-05-30T22:40:36 Last Updated: 2024-08-04T23:24:37.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function GetESD at isomedia/track.c in libgpac.a, as demonstrated by MP4Box. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1249 - https://lists.debian.org/debian-lts-announce/2019/06/msg00030.html
CVE ID: CVE-2019-12482 State: PUBLISHED Published: 2019-05-30T22:40:44 Last Updated: 2024-08-04T23:24:38.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function gf_isom_get_original_format_type at isomedia/drm_sample.c in libgpac.a, as demonstrated by MP4Box. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1249 - https://lists.debian.org/debian-lts-announce/2019/06/msg00030.html
CVE ID: CVE-2019-12483 State: PUBLISHED Published: 2019-05-30T22:40:57 Last Updated: 2024-08-04T23:24:38.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC 0.7.1. There is a heap-based buffer overflow in the function ReadGF_IPMPX_RemoveToolNotificationListener in odf/ipmpx_code.c in libgpac.a, as demonstrated by MP4Box. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1249 - https://lists.debian.org/debian-lts-announce/2019/06/msg00030.html
CVE ID: CVE-2019-12489 State: PUBLISHED Published: 2019-11-26T14:42:40 Last Updated: 2024-08-04T23:24:38.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices. By using the usb_remove service through an HTTP request, it is possible to inject and execute a command between two & characters in the mount parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/garis/Fastgate - https://www.exploit-db.com/exploits/47654
CVE ID: CVE-2019-12490 State: PUBLISHED Published: 2020-01-22T05:10:39 Last Updated: 2024-08-04T23:24:38.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. Reverse tabnabbing can occur because of use of _blank for external links. Additional Analyst Notes: - CVE Program Container: References: - https://www.simplemachines.org/community/index.php?topic=570986.0 - https://www.youtube.com/watch?v=gCVeFoxZ1DI
CVE ID: CVE-2019-12491 State: PUBLISHED Published: 2019-06-19T15:42:37 Last Updated: 2024-08-04T23:24:38.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors. To exploit the vulnerability an attacker has to have control of a single server on a given cloud (e.g. by renting one). From the source server, the attacker can craft any command and trigger the OnApp platform to execute that command with root privileges on a target server. Additional Analyst Notes: - CVE Program Container: References: - https://docs.onapp.com/rn
rivileges on a target server. Additional Analyst Notes: - CVE Program Container: References: - https://docs.onapp.com/rn/general-security-advisory - https://skylightcyber.com/2019/06/07/all-your-cloud-are-belong-to-us-cve-2019-12491/
CVE ID: CVE-2019-12492 State: PUBLISHED Published: 2019-06-06T19:29:20 Last Updated: 2024-08-04T23:24:37.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information disclosure via the FT Command Centre Service and FT Controller Service services. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/CVE-2019-12492 - https://security.gallagher.com/security-advisories
CVE ID: CVE-2019-12493 State: PUBLISHED Published: 2019-05-31T01:12:02 Last Updated: 2024-08-04T23:24:38.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace mishandle tint transform functions. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41806 - https://lists.debian.org/debian-lts-announce/2019/
eferences: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41806 - https://lists.debian.org/debian-lts-announce/2019/09/msg00033.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/