Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Panda Global Protection, Panda Gold Protection, and Panda Internet Security. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SouhailHammou/Panda-Antivirus-LPE - https://www.pandasecurity.com/usa/support/card?id=100063 - https://rce4fun.blogspot.com/2019/05/panda-antivirus-local-privilege.html
CVE ID: CVE-2019-12043 State: PUBLISHED Published: 2019-05-13T13:05:08 Last Updated: 2024-08-04T23:10:30.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jonschlinkert/remarkable/issues/332
CVE ID: CVE-2019-12044 State: PUBLISHED Published: 2019-05-22T15:29:28 Last Updated: 2024-08-04T23:10:30.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow exists in Citrix NetScaler Gateway 10.5.x before 10.5.70.x, 11.1.x before 11.1.59.10, 12.0.x before 12.0.59.8, and 12.1.x before 12.1.49.23 and Citrix Application Delivery Controller 10.5.x before 10.5.70.x, 11.1.x before 11.1.59.10, 12.0.x before 12.0.59.8, and 12.1.x before 12.1.49.23. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/v1/search?searchQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin - https://support.citrix.com/article/CTX2499
archQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin - https://support.citrix.com/article/CTX249976
CVE ID: CVE-2019-12046 State: PUBLISHED Published: 2019-05-22T15:07:06 Last Updated: 2024-08-04T23:10:30.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: LemonLDAP::NG -2.0.3 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/commits/master - https://lemonldap-ng.org/download - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1742 - https://seclists.org/bugtraq/2019/May/38 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1743 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1744 - https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-1-9-19-is-out/ - https://
emonldap-ng/lemonldap-ng/issues/1744 - https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-1-9-19-is-out/ - https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-4-is-out/
CVE ID: CVE-2019-12047 State: PUBLISHED Published: 2019-05-13T14:21:33 Last Updated: 2024-08-04T23:10:30.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gridea v0.8.0 has an XSS vulnerability through which the Nodejs module can be called to achieve arbitrary code execution, as demonstrated by child_process.exec and the "<img src=# onerror='eval(new Buffer(" substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/getgridea/gridea/issues/105
CVE ID: CVE-2019-12067 State: PUBLISHED Published: 2021-06-02T14:18:09 Last Updated: 2024-08-04T23:10:30.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01358.html - https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01487.html - https://bugzilla.suse.com/show_bug.cgi?id=1145642 - https://security-tracker.debian.org/tracker/CVE-2019-12067 - https://security.netapp.com/advisory/ntap-20210727
145642 - https://security-tracker.debian.org/tracker/CVE-2019-12067 - https://security.netapp.com/advisory/ntap-20210727-0001/
CVE ID: CVE-2019-12068 State: PUBLISHED Published: 2019-09-24T19:59:44 Last Updated: 2024-08-04T23:10:30.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/09
l. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html - https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01518.html - https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=de594e47659029316bbf9391efb79da0a1a08e08 - https://security-tracker.debian.org/tracker/CVE-2019-12068 - https://usn.ubuntu.com/4191-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html - https://usn.ubuntu.com/4191-1/ - https://www.debian.org/security/2020/dsa-4665 - https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
CVE ID: CVE-2019-12083 State: PUBLISHED Published: 2019-05-13T19:06:01 Last Updated: 2024-08-04T23:10:30.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/foru
::type_id is unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/rustlang-security-announcements/aZabeCMUv70 - https://blog.rust-lang.org/2019/05/13/Security-advisory.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K6T4BNA5KQYJRIKIGGBOGBMR7TRXPHLR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HG47HYH3AQTUMBUMX3S3G5DNAY4CBW6N/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00076.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00006.html - http://lists.opensuse.org/opensuse-secu
l - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00031.html
CVE ID: CVE-2019-12086 State: PUBLISHED Published: 2019-05-17T16:57:05 Last Updated: 2024-08-04T23:10:30.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdm
allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3E - https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html - https://www.debian.org/security/2019/dsa-4452 - https://seclists.org/bugtraq/2019/May/68 - http://www.securityfocus.com/bid/109227 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/ - https://lists.apache.org/thread.html
kage-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/ - https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/ - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:2937 - https://access.redhat.com/errata/RHSA-2019:2935 - https://access.redhat.com/errata/RHSA-2019:2936 - https://access.re
- https://access.redhat.com/errata/RHSA-2019:2935 - https://access.redhat.com/errata/RHSA-2019:2936 - https://access.redhat.com/errata/RHSA-2019:2938 - https://access.redhat.com/errata/RHSA-2019:2998 - https://access.redhat.com/errata/RHSA-2019:3044 - https://access.redhat.com/errata/RHSA-2019:3045 - https://access.redhat.com/errata/RHSA-2019:3050 - https://access.redhat.com/errata/RHSA-2019:3046 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3149 - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
tps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3200 - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E - https://m
rg/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.netapp.com/advisory/ntap-20190530-0003/ - http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/ - https://github.com/FasterX
ory/ntap-20190530-0003/ - http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/ - https://github.com/FasterXML/jackson-databind/issues/2326 - https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9 - https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2019-12087 State: PUBLISHED Published: 2019-05-14T02:52:52 Last Updated: 2024-08-04T23:10:30.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung S9+, S10, and XCover 4 P(9.0) devices can become temporarily inoperable because of an unprotected intent in the ContainerAgent application. For example, the victim becomes stuck in a launcher with their Secure Folder locked. NOTE: the researcher mentions "the Samsung Security Team considered this issue as no/little security impact. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/fs0c131y/SamsungLocker
CVE ID: CVE-2019-12091 State: PUBLISHED Published: 2019-09-26T15:18:00 Last Updated: 2024-08-04T23:10:30.196Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Netskope Products: Netskope client Problem Types: CWE-78 Description: The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\SYSTEM privilege. Additional Analyst Notes: - CVE Program Container: References: - https://support.netskope.com/hc/article_att
privilege. Additional Analyst Notes: - CVE Program Container: References: - https://support.netskope.com/hc/article_attachments/360033003553/Sprint_62_Release_Notes.pdf - https://support.netskope.com/hc/en-us/articles/360014589894-Netskope-Client - https://airbus-seclab.github.io/advisories/netskope.html
CVE ID: CVE-2019-12094 State: PUBLISHED Published: 2019-10-24T16:49:03 Last Updated: 2024-08-04T23:10:30.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI. Additional Analyst Notes: - CVE Program Container: References: - https://numanozdemir.com/respdisc/horde/horde.mp4 - https://numanozdemir.com/respdisc/horde/horde.txt - https://packetstormsecurity.com/files/152975/Horde-Webmail-5.2.22-XSS-CSRF-SQL-Injection-Code-Execution.html - https://www.exploit-db.com/exploits/46903 - https://cxsecurity.com/i
5.2.22-XSS-CSRF-SQL-Injection-Code-Execution.html - https://www.exploit-db.com/exploits/46903 - https://cxsecurity.com/issue/WLB-2019050199 - https://bugs.horde.org/ticket/14926
CVE ID: CVE-2019-12095 State: PUBLISHED Published: 2019-10-24T17:09:59 Last Updated: 2024-08-04T23:10:30.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload. Additional Analyst Notes: - CVE Program Container: References: - https://numanozdemir.com/respdisc/horde/horde.mp4 - https://numanozdemir.com/respdisc/horde/horde.txt - https://packetstormsecurity.com/files/152975/Horde-Webmail-5.2.22-XSS-CSRF-SQL-Injection-Code-Execu
sc/horde/horde.txt - https://packetstormsecurity.com/files/152975/Horde-Webmail-5.2.22-XSS-CSRF-SQL-Injection-Code-Execution.html - https://www.exploit-db.com/exploits/46903 - https://cxsecurity.com/issue/WLB-2019050199 - https://exchange.xforce.ibmcloud.com/vulnerabilities/161333 - https://bugs.horde.org/ticket/14926 - https://lists.debian.org/debian-lts-announce/2019/12/msg00015.html
CVE ID: CVE-2019-12097 State: PUBLISHED Published: 2019-06-03T20:26:01 Last Updated: 2024-08-04T23:10:30.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of EnableLoopback.exe before running it, which could lead to code execution or local privilege escalation by replacing the original EnableLoopback.exe. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.135671
CVE ID: CVE-2019-12098 State: PUBLISHED Published: 2019-05-15T22:41:11 Last Updated: 2024-08-04T23:10:30.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0 - http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html - https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf - https://github.com/heimdal/heimdal/compa
://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf - https://github.com/heimdal/heimdal/compare/3e58559...bbafe72 - https://seclists.org/bugtraq/2019/Jun/1 - https://www.debian.org/security/2019/dsa-4455 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIXEDVVMPD6ZAJSMI2EZ7FNEIVNWE5PD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLXXIF
Z7FNEIVNWE5PD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLXXIF4LOQEAEDAF4UGP2AO6WDNTDFUB/
CVE ID: CVE-2019-12099 State: PUBLISHED Published: 2019-05-14T20:55:38 Last Updated: 2024-08-04T23:10:30.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46839 - https://www.pentest.com.tr/exploits/PHP-Fusion-9-03-00-Edit-Profile-Remote-Code-Execution.html - https://github.com/php-fusion/PHP-Fusion/commit/943432028b9
PHP-Fusion-9-03-00-Edit-Profile-Remote-Code-Execution.html - https://github.com/php-fusion/PHP-Fusion/commit/943432028b9e674433bb3f2a128b2477134110e6
CVE ID: CVE-2019-12101 State: PUBLISHED Published: 2019-05-15T04:04:11 Last Updated: 2024-08-04T23:10:30.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: coap_decode_option in coap.c in LibNyoci 0.07.00rc1 mishandles certain packets with "Uri-Path: (null)" and consequently allows remote attackers to cause a denial of service (segmentation fault). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/darconeous/libnyoci/issues/21
CVE ID: CVE-2019-12102 State: PUBLISHED Published: 2019-05-22T14:54:24 Last Updated: 2024-11-15T15:24:49.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx URI. NOTE: The vendor disputes the report because the researcher did not configure the media library permissions correctly. The vendor states that by default all users can read/modify/upload files, and it’s up to the administrator to decide who should have access to the media library and set the permissions accordingly. See the vendor documentation i
o decide who should have access to the media library and set the permissions accordingly. See the vendor documentation in the references for more information Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.kentico.com/k12/release-notes-kentico-12 - https://devnet.kentico.com/download/hotfixes - https://github.com/Gr4y21/My-CVE-IDs/blob/master/Kentico%20CMS%20Unauthenticated%20File%20Upload%20and%20File%20Exposure - https://docs.kentico.com/k12/configuring-kentico/configuring-the-environment-for-content-editors/configuring-media-libraries/assigning-permissions-to-media-libraries
CVE ID: CVE-2019-12103 State: PUBLISHED Published: 2019-08-14T20:29:31 Last Updated: 2024-08-04T23:10:30.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.pentestpartners.com/security-blog/cve-2019-12103-analysis-of-a-pre-auth-rce-on-the-tp-link-m7350-with-ghidra/ - https://www.tp-link.com/uk/support/download/m7350/v3/#Firmware
CVE ID: CVE-2019-12104 State: PUBLISHED Published: 2019-08-14T20:32:43 Last Updated: 2024-08-04T23:10:30.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://www.pentestpartners.com/security-blog/cve-2019-12103-analysis-of-a-pre-auth-rce-on-the-tp-link-m7350-with-ghidra/ - https://www.tp-link.com/uk/support/download/m7350/v3/#Firmware
CVE ID: CVE-2019-12105 State: PUBLISHED Published: 2019-09-10T16:18:27 Last Updated: 2024-08-04T23:10:30.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.c
documentation Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Supervisor/supervisor/commit/4e334d9cf2a1daff685893e35e72398437df3dcb - https://github.com/Supervisor/supervisor/issues/1245 - http://supervisord.org/configuration.html#inet-http-server-section-settings
CVE ID: CVE-2019-12106 State: PUBLISHED Published: 2019-05-15T22:22:44 Last Updated: 2024-08-04T23:10:30.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp - https://github.com/miniupnp/miniupnp/commit/cd506a67e174a45c6a202eff182a712955ed6d6f - https://lists.debian.org/debian-lts-announce/2019/05/msg00037.html
CVE ID: CVE-2019-12107 State: PUBLISHED Published: 2019-05-15T22:22:54 Last Updated: 2024-08-04T23:10:30.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper validation of an snprintf return value. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp - https://github.com/miniupnp/miniupnp/commit/bec6ccec63cadc95655721bc0e1dd49dac759d94 - https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html - https://usn.ubuntu.com/4542-1/
CVE ID: CVE-2019-12108 State: PUBLISHED Published: 2019-05-15T22:23:03 Last Updated: 2024-08-04T23:10:30.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp - https://github.com/miniupnp/miniupnp/commit/13585f15c7f7dc28bbbba1661efb280d530d114c - https://github.com/miniupnp/miniupnp/commit/86030db849260dd8fb2ed975b9890aef1b62b692 - https://lists.debian.org/debian-lts-announce/2019/05/msg000
p/miniupnp/commit/86030db849260dd8fb2ed975b9890aef1b62b692 - https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html - https://usn.ubuntu.com/4542-1/