Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-9554 State: PUBLISHED Published: 2019-12-31T16:15:00 Last Updated: 2024-08-04T21:54:44.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/151944/Craft-CMS-3.1.12-Pro-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/46496
CVE ID: CVE-2019-9555 State: PUBLISHED Published: 2019-03-05T23:00:00 Last Updated: 2024-08-04T21:54:44.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number of possible PSKs is about 1.78 billion, which is too small. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Mar/12
CVE ID: CVE-2019-9556 State: PUBLISHED Published: 2019-12-31T16:10:44 Last Updated: 2024-08-04T21:54:44.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: FiberHome an5506-04-f RP2669 devices have XSS. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/151959/Fiberhome-AN5506-04-F-RP2669-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/46498
CVE ID: CVE-2019-9557 State: PUBLISHED Published: 2019-03-12T19:00:00 Last Updated: 2024-08-04T21:54:44.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/151958/Ability-Mail-Server-4.2.6-Cross-Site-Scripting.html
CVE ID: CVE-2019-9558 State: PUBLISHED Published: 2019-03-12T20:00:00 Last Updated: 2024-08-04T21:54:44.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/151957/Mailtraq-WebMail-2.17.7.3550-Cross-Site-Scripting.html
CVE ID: CVE-2019-9563 State: PUBLISHED Published: 2019-03-04T08:00:00 Last Updated: 2024-08-04T21:54:44.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: In BlueMind 3.5.x before 3.5.11 Hotfix 7 and 4.x before 4.0-beta3, the contact application mishandles temporary uploads. Additional Analyst Notes: - CVE Program Container: References: - https://forum.bluemind.net/viewtopic.php?pid=8049#p8049 - http://git.bluemind.net/bluemind/commit/b11aa12d3c2f4c5dac4f9059f8b6bac1bf873244 - https://forum.bluemind.net/viewtopic.php?pid=8054#p8054
CVE ID: CVE-2019-9564 State: PUBLISHED Published: 2022-03-30T20:00:17.107406Z Last Updated: 2024-09-16T23:01:19.046Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Wyze Products: Cam Pan v2, Cam v2, Cam v3 Problem Types: authenti Description: A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-wyze
t Notes: - CVE Program Container: References: - https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-wyze-cam-iot-device/
CVE ID: CVE-2019-9565 State: PUBLISHED Published: 2019-03-04T08:00:00Z Last Updated: 2024-09-16T20:43:05.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks upon a direct launch of the product, or upon an indirect launch via an integration such as Chrome, Firefox, Word, Outlook, etc. This occurs because the product attempts to access a share with the PLUG-INS subdomain name; an attacker may be able to use Active Directory Domain Services to register that name. Additional Analyst Notes: - CVE Program Container: References:
Active Directory Domain Services to register that name. Additional Analyst Notes: - CVE Program Container: References: - https://gosecure.net/2019/02/20/abusing-unsafe-defaults-in-active-directory/ - https://www.druide.com/en/news/security-improvement-antidote-windows
CVE ID: CVE-2019-9566 State: PUBLISHED Published: 2019-03-04T18:00:00 Last Updated: 2024-08-04T21:54:44.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlarumChina v0.1.0-beta.7C has SQL injection via a /?q= request. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/127/
CVE ID: CVE-2019-9567 State: PUBLISHED Published: 2019-03-04T18:00:00 Last Updated: 2024-08-04T21:54:44.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll. Additional Analyst Notes: - CVE Program Container: References: - https://lists.openwall.net/full-disclosure/2019/02/05/4 - https://security-consulting.icu/blog/2019/02/wordpress-forminator-persistent-xss-blind-sql-injection/ - https://wordpress.org/plugins/forminator/#developers - https://wpvulndb.com/vulnerabilities/9215
CVE ID: CVE-2019-9568 State: PUBLISHED Published: 2019-03-04T18:00:00 Last Updated: 2024-08-04T21:54:44.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission. Additional Analyst Notes: - CVE Program Container: References: - https://lists.openwall.net/full-disclosure/2019/02/05/4 - https://security-consulting.icu/blog/2019/02/wordpress-forminator-persistent-xss-blind-sql-injection/ - https://wordpress.org/plugins/forminator/#developers - https://wpvulndb.com/vulnerabilities/
-xss-blind-sql-injection/ - https://wordpress.org/plugins/forminator/#developers - https://wpvulndb.com/vulnerabilities/9215
CVE ID: CVE-2019-9569 State: PUBLISHED Published: 2019-08-26T19:35:10 Last Updated: 2024-08-04T21:54:44.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40_B-571848 allows remote unauthenticated users to execute arbitrary code and possibly cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.deltacontrols.com/products/hvac-controls/central-plant-controllers/entelibus - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/hvacking-understanding-the-delta-between-security-and-reality/
CVE ID: CVE-2019-9570 State: PUBLISHED Published: 2019-03-05T14:00:00Z Last Updated: 2024-09-16T17:34:07.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/11
CVE ID: CVE-2019-9572 State: PUBLISHED Published: 2019-03-05T14:00:00Z Last Updated: 2024-09-16T20:21:44.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the _Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of arbitrary PHP code in Public\Home\1_Static.php because of mishandling in the Application\Admin\Controller\ThemeController.class.php Upload() function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com
troller.class.php Upload() function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PearlyNautilus/Security-Code-Review/issues/3
CVE ID: CVE-2019-9573 State: PUBLISHED Published: 2019-03-05T21:00:00 Last Updated: 2024-08-04T21:54:44.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/hrm/#developers - http://www.openwall.com/lists/oss-security/2019/03/17/1 - http://www.securityfocus.com/bid/107464
CVE ID: CVE-2019-9574 State: PUBLISHED Published: 2019-03-05T21:00:00 Last Updated: 2024-08-04T21:54:44.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/hrm/#developers - http://www.openwall.com/lists/oss-security/2019/03/17/1 - http://www.securityfocus.com/bid/107464
CVE ID: CVE-2019-9575 State: PUBLISHED Published: 2019-03-05T21:00:00 Last Updated: 2024-08-04T21:54:44.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/QuizandSurveyMaster/quiz_master_next/blob/master/CHANGELOG.md - https://wordpress.org/plugins/quiz-master-next/#developers - https://security-consulting.icu/blog/2019/02/wordpress-quiz-and-survey-master-xss/ - https://lists.openwall.net/full-disclosure/2019/02/05/5
CVE ID: CVE-2019-9576 State: PUBLISHED Published: 2019-03-05T21:00:00 Last Updated: 2024-08-04T21:54:44.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/blog2social/#developers - https://security-consulting.icu/blog/2019/02/wordpress-blog2social-xss/ - https://lists.openwall.net/full-disclosure/2019/02/05/6
CVE ID: CVE-2019-9578 State: PUBLISHED Published: 2019-03-05T23:00:00 Last Updated: 2024-08-04T21:54:44.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device. Additional Analyst Notes: - CVE Program Container: References: - https://developers.yubico.com/libu2f-host/Release_Notes.html - https://github.com/Yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S4YCFMSNMXZ7XC4U6WXPQA7JCXC6VOAJ/ - https://lists.fedoraproject.org/archives/list/p
ce%40lists.fedoraproject.org/message/S4YCFMSNMXZ7XC4U6WXPQA7JCXC6VOAJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMA4H6AZFYIR3LA5VKKEJZNCCIVMUCFQ/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html - https://blog.inhq.net/posts/yubico-libu2f-host-vuln-part2/ - https://security.gentoo.org/glsa/202004-15
CVE ID: CVE-2019-9579 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T16:23:45.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have unintended access, e.g., an attacker with WRITE_XATTR can change permissions. This occurs because of a combination of three factors: ZFS extended attributes are used to implement NT named streams, the SMB protocol requires implementations to have open handle semantics similar to those of NTFS, and the SMB server passes along certain attribute requests to the underlying object (i.e., they
imilar to those of NTFS, and the SMB server passes along certain attribute requests to the underlying object (i.e., they are not considered to be requests that pertain to the named stream). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.illumos.org/issues/10506 - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2019-9580 State: PUBLISHED Published: 2019-03-09T04:00:00 Last Updated: 2024-08-04T21:54:45.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/StackStorm/st2/releases/tag/v2.9.3 - https://github.com/StackStorm/st2/releases/tag/v2.10.3 - https://stackstorm.com/2019/03/08/stackstorm-2-9-3-2-10-3/
CVE ID: CVE-2019-9581 State: PUBLISHED Published: 2019-03-06T00:00:00 Last Updated: 2024-08-04T21:54:44.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/phpscheduleit/source/ci/c5a86a279d888bd4362e4b4f61acedc054f99c39/ - https://www.exploit-db.com/exploits/46486 - https://pentest.com.tr/exploits/Booked-2-7-5-Remote-Command-Execution-Metasploit.h
//www.exploit-db.com/exploits/46486 - https://pentest.com.tr/exploits/Booked-2-7-5-Remote-Command-Execution-Metasploit.html - http://packetstormsecurity.com/files/165263/Booked-Scheduler-2.7.5-Shell-Upload.html
CVE ID: CVE-2019-9582 State: PUBLISHED Published: 2019-08-14T19:57:14 Last Updated: 2024-08-04T21:54:45.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9582.md - https://psytester.github.io/CVE-2019-9582/
CVE ID: CVE-2019-9583 State: PUBLISHED Published: 2019-08-14T19:47:54 Last Updated: 2024-08-04T21:54:44.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9583.md - https://psytester.git
ter/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9583.md - https://psytester.github.io/CVE-2019-9583/
CVE ID: CVE-2019-9584 State: PUBLISHED Published: 2019-08-14T20:03:06 Last Updated: 2024-08-04T21:54:44.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9584.md - https://psytester.github.io/CVE-2019-9584/
CVE ID: CVE-2019-9585 State: PUBLISHED Published: 2019-08-14T20:10:17 Last Updated: 2024-08-04T21:54:44.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in the ability to read, set and deletion of Metadata. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9585.md - https://psytester.github.io/CVE-2019-9585/
CVE ID: CVE-2019-9587 State: PUBLISHED Published: 2019-03-06T08:00:00 Last Updated: 2024-08-04T21:54:44.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to Catalog::countPageTree. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41263 - https://research.loginsoft.com/bugs/stack-based-buffer-overflow-vulnerability-i
dfreader.com/viewtopic.php?f=3&t=41263 - https://research.loginsoft.com/bugs/stack-based-buffer-overflow-vulnerability-in-function-md5round1-xpdf-4-01/
CVE ID: CVE-2019-9588 State: PUBLISHED Published: 2019-03-06T08:00:00 Last Updated: 2024-08-04T21:54:44.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://research.loginsoft.com/bugs/invalid-memory-access-in-gatomiccounter-gatomicincrement-xpdf-4-01/ - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41261
CVE ID: CVE-2019-9589 State: PUBLISHED Published: 2019-03-06T08:00:00 Last Updated: 2024-08-04T21:54:44.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a NULL pointer dereference vulnerability in PSOutputDev::setupResources() located in PSOutputDev.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-psoutputdevsetupresources-xpdf-4-01/ - https://forum.xpdf
ft.com/bugs/null-pointer-dereference-vulnerability-in-function-psoutputdevsetupresources-xpdf-4-01/ - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41262
CVE ID: CVE-2019-9590 State: PUBLISHED Published: 2019-03-06T16:00:00 Last Updated: 2024-08-04T21:54:44.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service (persistent failure mode) by sending a series of \x19\xb2\x00\x00\x00\x06\x43\x01\x00\xac\xff\x00 (aka UID 0x43) requests to TCP port 502. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ni9htMar3/vulnerability/blob/master/PLC/%E8%85%BE%E6%8E%A7/T920_PLC_DOS.md
CVE ID: CVE-2019-9591 State: PUBLISHED Published: 2019-03-06T16:00:00 Last Updated: 2024-08-04T21:54:44.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/Shoretel%20Connect%20Multiple%20Vulnerability - https://www.exploit-db.com/exploits/46666/ - http://packetstormsecurity.com/files/152431/ShoreTel-Connect-ONSITE-Cross-Site-Scripting-Session-Fixation.html
CVE ID: CVE-2019-9592 State: PUBLISHED Published: 2019-03-06T16:00:00 Last Updated: 2024-08-04T21:54:44.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/Shoretel%20Connect%20Multiple%20Vulnerability - https://www.exploit-db.com/exploits/46666/ - http://packetstormsecurity.com/files/152431/ShoreTel-Connect-ONSITE-Cross-Site-Scripting-Session-Fixation.html
CVE ID: CVE-2019-9593 State: PUBLISHED Published: 2019-03-06T16:00:00 Last Updated: 2024-08-04T21:54:44.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/Shoretel%20Connect%20Multiple%20Vulnerability - https://www.exploit-db.com/exploits/46666/ - http://packetstormsecurity.com/files/152431/ShoreTel-Connect-ONSITE-Cross-Site-Scripting-Session-Fixation.html
CVE ID: CVE-2019-9594 State: PUBLISHED Published: 2019-03-06T16:00:00 Last Updated: 2024-08-04T21:54:44.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/8test/pentest/issues/1
CVE ID: CVE-2019-9595 State: PUBLISHED Published: 2019-03-06T16:00:00 Last Updated: 2024-08-04T21:54:44.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/source-trace/appcms/issues/1
CVE ID: CVE-2019-9596 State: PUBLISHED Published: 2019-10-23T18:23:17 Last Updated: 2024-08-04T21:54:44.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Darktrace Enterprise Immune System before 3.1 allows CSRF via the /whitelisteddomains endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/May/54 - http://packetstormsecurity.com/files/152986/Darktrace-Enterpise-Immune-System-3.0.9-3.0.10-Cross-Site-Request-Forgery.html - https://www.peerlyst.com/posts/exploiting-two-zero-days-in-a-darktrace-appliance-cve-2019-9596-and-cve-2019-9597-gerwout-van-der-veen - https://github.com/gerwout/CVE-2019-9596-and-CVE-2019-9597/blob/mas
e-2019-9596-and-cve-2019-9597-gerwout-van-der-veen - https://github.com/gerwout/CVE-2019-9596-and-CVE-2019-9597/blob/master/poc.html