Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBA3TFZSP3TB5N4G24SO6BI64RJZXE3D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMDUQ7XFONY3BWTAQQUD3QUGZT6NFZUF/ - https://usn.ubuntu.com/4375-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00045.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00033.html - https://www.debian.org/security/202
msg00045.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00033.html - https://www.debian.org/security/2020/dsa-4717 - https://www.debian.org/security/2020/dsa-4719 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugs.php.net/bug.php?id=78875 - https://bugs.php.net/bug.php?id=78876 - https://security.netapp.com/advisory/ntap-20200528-0006/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.tenable.com/security/tns-2021-14
CVE ID: CVE-2019-11049 State: PUBLISHED Published: 2019-12-23T02:40:18.474776Z Last Updated: 2024-09-16T20:47:57.583Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: PHP Group Products: PHP Problem Types: CWE-415 Description: In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=78943 - https://security.netapp.com/advisory/ntap-20200103
gram Container: References: - https://bugs.php.net/bug.php?id=78943 - https://security.netapp.com/advisory/ntap-20200103-0002/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/ - https://seclists.org/bugtraq/2020/Feb/27 - https://www.debian.org/security/2020/dsa-4626 - https://www.tenable.com/security/tns-2021-14
CVE ID: CVE-2019-11050 State: PUBLISHED Published: 2019-12-23T02:40:18.861517Z Last Updated: 2024-09-16T18:33:19.281Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: PHP Group Products: PHP Problem Types: CWE-125 Description: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=78793 - https://lists.debian.org/
Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=78793 - https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html - https://security.netapp.com/advisory/ntap-20200103-0002/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/ - https://usn.ubuntu.com/4239-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html - https://seclists.org/bugtraq/2020/Feb/27 - https://www.debian.org/security/2020/dsa-4626 - https://ww
CVE ID: CVE-2019-11057 State: PUBLISHED Published: 2019-05-17T16:36:24 Last Updated: 2024-08-04T22:40:16.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: References: - http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html - https://medium.com/%40mohnishdhage/sql-injection-vtiger-crm-v7-1-0-cve-2019-11057-245f84fc5c2c - https://cybersecurityworks.com/zerodays/cve-2019-11057-vtiger.html
CVE ID: CVE-2019-11059 State: PUBLISHED Published: 2019-05-10T19:36:12 Last Updated: 2024-08-04T22:40:16.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/u-boot/u-boot/commits/master - https://git.denx.de/?p=u-boot.git%3Ba=commit%3Bh=febbc583319b567fe3d83e521cc2ace9be8d1501
CVE ID: CVE-2019-11060 State: PUBLISHED Published: 2019-08-29T00:19:45.655070Z Last Updated: 2024-09-16T17:49:18.209Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: ASUS Products: HG100 firmware Problem Types: CWE-400 Description: The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time. CVSS 3.0 Base score 7.4 (Availability impacts). CVSS vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). Additional Analyst Notes: - C
e 7.4 (Availability impacts). CVSS vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201906002 - http://surl.twcert.org.tw/aarVJ - https://www.exploit-db.com/exploits/46720
CVE ID: CVE-2019-11061 State: PUBLISHED Published: 2019-08-29T00:18:59.682474Z Last Updated: 2024-09-16T20:22:13.629Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ASUS Products: HG100 firmware Problem Types: Boken Access Control Description: A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Additional Analyst Notes: - CVE
and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201906003 - http://surl.twcert.org.tw/5df6x - https://github.com/tim124058/ASUS-SmartHome-Exploit/
CVE ID: CVE-2019-11062 State: PUBLISHED Published: 2019-07-11T18:22:06.876236Z Last Updated: 2024-09-17T00:40:32.733Z Vendors: SUNNET Products: WMPro Problem Types: CWE-78 Description: The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201906001 - http://surl.twcert.org.tw/hLFFM - https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0
CVE ID: CVE-2019-11063 State: PUBLISHED Published: 2019-08-29T00:19:09.478452Z Last Updated: 2024-09-16T18:18:18.823Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ASUS Products: SmartHome Android app, SmartHome ios app Problem Types: Boken Access Control Description: A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability
/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tim124058/ASUS-SmartHome-Exploit/ - https://tvn.twcert.org.tw/taiwanvn/TVN-201908014 - http://surl.twcert.org.tw/5LWQJ
CVE ID: CVE-2019-11064 State: PUBLISHED Published: 2019-08-29T00:19:17.490658Z Last Updated: 2024-09-17T00:36:59.288Z Vendors: AndroVideo Products: Advan VD-1 firmware Problem Types: CWE-200 Description: A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201906005 - http://surl.twcert.org.tw/gCDQN - https://gist.github.com/keniver/f5155b42eb27
vn.twcert.org.tw/taiwanvn/TVN-201906005 - http://surl.twcert.org.tw/gCDQN - https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md
CVE ID: CVE-2019-11065 State: PUBLISHED Published: 2019-04-09T23:37:04 Last Updated: 2024-08-04T22:40:16.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/pull/8927 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO/ - https://lists.
.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQ5CGOV5QVQCSPGE3WRZDKUGIXLHSZDR/
CVE ID: CVE-2019-11066 State: PUBLISHED Published: 2019-05-10T19:18:47 Last Updated: 2024-08-04T22:40:16.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=openid-security&m=155477050605610&w=2
CVE ID: CVE-2019-11068 State: PUBLISHED Published: 2019-04-10T19:38:18 Last Updated: 2024-08-04T22:40:16.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6 - https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html - https://usn.ubuntu.com/3947-2/ - http:/
f6fca2fd6 - https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html - https://usn.ubuntu.com/3947-2/ - http://www.openwall.com/lists/oss-security/2019/04/22/1 - https://usn.ubuntu.com/3947-1/ - http://www.openwall.com/lists/oss-security/2019/04/23/5 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K
ists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://security.netapp.com/advisory/ntap-20191017-0001/
CVE ID: CVE-2019-11069 State: PUBLISHED Published: 2019-04-10T00:00:00 Last Updated: 2024-08-04T22:40:16.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sequelize/sequelize/pull/10746/files - https://github.com/sequelize/sequelize/releases/tag/v5.3.0 - https://github.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js#L158-L160 - https://github.com/sequelize/sequelize/commit/850c7fd04669e0fef9238b6dc4f8d6ee93ed71e9
CVE ID: CVE-2019-11070 State: PUBLISHED Published: 2019-04-10T20:15:06 Last Updated: 2024-08-04T22:40:16.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.webkit.org/show_bug.cgi?id=193718 - https://trac.webkit.org/changeset/243197/webkit - https://seclists.org/bugtraq/2019/Apr/21 - http://www.openwall.com/lists/oss-secur
.webkit.org/changeset/243197/webkit - https://seclists.org/bugtraq/2019/Apr/21 - http://www.openwall.com/lists/oss-security/2019/04/11/1 - http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Code-Execution.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ/ - https://usn.ubuntu.com/3948-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html - https://security.gentoo.org/glsa/201909-05
CVE ID: CVE-2019-11071 State: PUBLISHED Published: 2019-04-10T20:36:43 Last Updated: 2024-08-04T22:40:16.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-10-et-SPIP-3-2-4.html - https://github.com/spip/SPIP/commit/3ef87c525bc0768c926646f999a54222b37b5d36 - https://github.com/spip/SPIP/commit/824d17f424bf77d17af89c18c3dc807a3199567e - https://github.com/spip/SPIP/compare/1e3872c...9861a47 -
com/spip/SPIP/commit/824d17f424bf77d17af89c18c3dc807a3199567e - https://github.com/spip/SPIP/compare/1e3872c...9861a47 - https://www.debian.org/security/2019/dsa-4429 - https://usn.ubuntu.com/4536-1/
CVE ID: CVE-2019-11072 State: PUBLISHED Published: 2019-04-10T21:04:57 Last Updated: 2024-08-04T22:40:16.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain inp
50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://redmine.lighttpd.net/issues/2945 - https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354 - http://www.securityf
es/2945 - https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354 - http://www.securityfocus.com/bid/107907
CVE ID: CVE-2019-11073 State: PUBLISHED Published: 2020-03-16T18:41:58 Last Updated: 2024-08-04T22:40:16.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insufficient sanitization when passing arguments to the HttpTransactionSensor.exe binary. In order to exploit the vulnerability, remote authenticated administrators need to create a new HTTP Transaction Sensor and set specific settings when the sensor is executed. Additional Analyst Notes: - CVE Program Container: References: - https://www.paessler.com/prtg/history/stable - https://sensepost.co
nalyst Notes: - CVE Program Container: References: - https://www.paessler.com/prtg/history/stable - https://sensepost.com/blog/2019/being-stubborn-pays-off-pt.-1-cve-2018-19204/ - https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/11/warnmeldung_cb-k19-1019.html
CVE ID: CVE-2019-11074 State: PUBLISHED Published: 2020-03-17T14:06:41 Last Updated: 2024-08-04T22:40:16.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary locations with SYSTEM privileges (although not controlling the contents of such files) due to insufficient sanitisation when passing arguments to the phantomjs.exe binary. In order to exploit the vulnerability, remote authenticated administrators need to create a new HTTP Full Web Page Sensor and set specific settings when executing the sensor. Additional Analyst Notes: - CVE P
e a new HTTP Full Web Page Sensor and set specific settings when executing the sensor. Additional Analyst Notes: - CVE Program Container: References: - https://www.paessler.com/prtg/history/stable - https://sensepost.com/blog/2019/being-stubborn-pays-off-pt.-1-cve-2018-19204/ - https://how2itsec.blogspot.com/2019/10/security-fixes-in-prtg-1935152.html
CVE ID: CVE-2019-11076 State: PUBLISHED Published: 2019-04-23T17:32:05 Last Updated: 2024-08-04T22:40:16.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/livehybrid/poc-cribl-rce - https://docs.cribl.io/blog/release-v151
CVE ID: CVE-2019-11077 State: PUBLISHED Published: 2019-04-11T01:10:56 Last Updated: 2024-08-04T22:40:16.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/191/
CVE ID: CVE-2019-11078 State: PUBLISHED Published: 2019-04-11T01:11:10 Last Updated: 2024-08-04T22:40:16.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/193/
CVE ID: CVE-2019-11080 State: PUBLISHED Published: 2019-06-06T13:33:43 Last Updated: 2024-08-04T22:40:16.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object. Additional Analyst Notes: - CVE Program Container: References: - https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes - https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE
ce%20Platform%2091%20Update1/Release%20Notes - https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE - http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html
CVE ID: CVE-2019-11081 State: PUBLISHED Published: 2019-04-24T14:40:23 Last Updated: 2024-08-04T22:40:16.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: A default username and password in Dentsply Sirona Sidexis 4.3.1 and earlier allows an attacker to gain administrative access to the application server. Additional Analyst Notes: - CVE Program Container: References: - https://bastolino.de/sidexis4vuln.html
CVE ID: CVE-2019-11082 State: PUBLISHED Published: 2019-05-10T15:39:46 Last Updated: 2024-08-04T22:40:16.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dkpro/dkpro-core/issues/1325
CVE ID: CVE-2019-11084 State: PUBLISHED Published: 2019-04-18T18:07:34 Last Updated: 2024-08-04T22:40:16.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gbraad/gauth/issues/110
CVE ID: CVE-2019-11085 State: PUBLISHED Published: 2019-05-17T15:41:37 Last Updated: 2024-08-04T22:40:16.359Z Vendors: n/a Products: Intel(R) i915 Graphics for Linux Problem Types: Escalation of Privilege Description: Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00249.html - https://support.f5.com/csp/article/K09376613 - http://www.securityfocus.com/bid/108488 - http://lists.opensuse.org/opensuse-sec
/support.f5.com/csp/article/K09376613 - http://www.securityfocus.com/bid/108488 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html - https://usn.ubuntu.com/4068-1/ - https://usn.ubuntu.com/4068-2/ - https://access.redhat.com/errata/RHSA-2019:1873 - https://access.redhat.com/errata/RHSA-2019:1891 - https://access.redhat.com/errata/RHSA-2019:1959 - https://access.redhat.com/errata/RHSA-2019:1971 - https://usn.ubuntu.com/4118-1/ - https://access.redhat.com/errata/RHSA-2020:0543 - https://access.redhat.com/errata/RHSA-2020:0592 - https://access.redhat.com/errata/RHSA-2020:0609