Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17531 State: PUBLISHED Published: 2019-10-12T20:07:34 Last Updated: 2024-08-05T01:40:16.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/b3c90d38f99db546de60
ditional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5%40%3Ccommits.pulsar.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:4192 - https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html - https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0164 - https://access.redhat.com/errata/RHSA-2020:0159 - https://access.redhat.com/errata/RHSA-2020:0160 - https://access.redhat.com/errata/RHSA-2020:0161 - https://access.redhat.com/errata/RHSA-2020:0445 - https://
2020:0160 - https://access.redhat.com/errata/RHSA-2020:0161 - https://access.redhat.com/errata/RHSA-2020:0445 - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://github.com/FasterXML/jackson-databind/issues/2498 - https://security.netapp.com/advisory/ntap-20191024-0005/ - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94
a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2019-17532 State: PUBLISHED Published: 2019-10-12T20:23:59 Last Updated: 2024-08-05T01:40:15.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Belkin Wemo Switch 28B WW_2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service (persistent rules-processing outage) via a crafted ruleDbBody element in a StoreRules request to the upnp/control/rules1 URI, because database corruption occurs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/badnack/wemo_dos
CVE ID: CVE-2019-17533 State: PUBLISHED Published: 2019-10-13T02:00:33 Last Updated: 2024-08-05T01:40:15.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/commit/651a8e28099edb5fbb9e4e1d4d3238848f446c9a - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856 - https://lists.debian.org/debian-lts-announce/2020/06/msg00037.html
CVE ID: CVE-2019-17534 State: PUBLISHED Published: 2019-10-13T01:59:34 Last Updated: 2024-08-05T01:40:15.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to a use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libvips/libvips/compare/v8.8.1...v8.8.2 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16796 - https://github.com/libvips/libvips/commit/ce684dd008532ea0bf9d4a1d89bacb35f4a83f4d
CVE ID: CVE-2019-17535 State: PUBLISHED Published: 2019-10-13T17:52:21 Last Updated: 2024-08-05T01:40:15.895Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647. Additional Analyst Notes: - CVE Program Container: References: - https://rastating.github.io/gila-cms-reflected-xss/ - https://github.com/GilaCMS/gila/pull/48
CVE ID: CVE-2019-17536 State: PUBLISHED Published: 2019-10-13T17:52:39 Last Updated: 2024-08-05T01:40:15.793Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AC:L/AV:N/A:L/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move. Additional Analyst Notes: - CVE Program Container: References: - https://rastating.github.io/gila-cms-upload-filter-bypass-and-rce/ - https://github.com/GilaCMS/gila/pull/49
CVE ID: CVE-2019-17537 State: PUBLISHED Published: 2019-10-13T18:08:36 Last Updated: 2024-08-05T01:40:15.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shi-yang/jnoj/issues/53
CVE ID: CVE-2019-17538 State: PUBLISHED Published: 2019-10-13T18:08:27 Last Updated: 2024-08-05T01:40:15.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shi-yang/jnoj/issues/53
CVE ID: CVE-2019-17539 State: PUBLISHED Published: 2019-10-14T01:09:40 Last Updated: 2024-08-05T01:40:15.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/8df6884832ec413cf032dfaa45c23b1c7876670c - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15733 - https://security.gentoo.org/glsa/202003-65 - https://www.debian.org/security/2020/dsa-4722 - https://usn.ubuntu.com/4431-1/ - https://lists.debi
org/glsa/202003-65 - https://www.debian.org/security/2020/dsa-4722 - https://usn.ubuntu.com/4431-1/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html
CVE ID: CVE-2019-17540 State: PUBLISHED Published: 2019-10-14T01:09:28 Last Updated: 2024-08-05T01:40:15.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/compare/7.0.8-53...7.0.8-54 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15826 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942578 - https://security-tracker.debian.org/tracker/CVE-2019-17540 - https://github.com/ImageMagick/ImageMagick/compare/master%40%7B2019-07-15%7D...master%40%7B2019-07-17%7D
CVE ID: CVE-2019-17541 State: PUBLISHED Published: 2019-10-14T01:06:43 Last Updated: 2024-08-05T01:40:15.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1641 - https://github.com/ImageMagick/ImageMagick/commit/39f226a9c137f547e12afde972eeba7551124493 - https://github.com/ImageMagick/ImageMagick/compare/7.0.8-54...7.0.8-55 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15827
CVE ID: CVE-2019-17542 State: PUBLISHED Published: 2019-10-14T01:09:18 Last Updated: 2024-08-05T01:40:15.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/02f909dc24b1f05cfbba75077c7707b905e63cd2 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15919 - https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html - https://security.gentoo.org/glsa/202003-65 - https://www.debian.org/security/2020/dsa-4722 - https://l
2/msg00003.html - https://security.gentoo.org/glsa/202003-65 - https://www.debian.org/security/2020/dsa-4722 - https://lists.debian.org/debian-lts-announce/2020/07/msg00022.html - https://usn.ubuntu.com/4431-1/
CVE ID: CVE-2019-17543 State: PUBLISHED Published: 2019-10-14T01:09:00 Last Updated: 2024-08-05T01:40:15.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk." Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3%40%3Cissues.arrow.apache.org%3E - https://lists.apache.org/thread
f0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3%40%3Cissues.arrow.apache.org%3E - https://lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0def2d7d3%40%3Cdev.arrow.apache.org%3E - https://lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d75412099c357%40%3Cissues.arrow.apache.org%3E - https://lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87b36316%40%3Cissues.arrow.apache.org%3E - https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17%40%3Cissues.arrow.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html - http://lists.opensuse.org
w.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html - https://lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be3407aa2d6%40%3Cissues.arrow.apache.org%3E - https://lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff66d8960%40%3Cissues.kudu.apache.org%3E - https://lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c1904af5720%40%3Cissues.kudu.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/lz4/lz4/pull/756 - https://github.com/lz4/lz4/pull/760 - https://git
ecurity-alerts/cpuoct2020.html - https://github.com/lz4/lz4/pull/756 - https://github.com/lz4/lz4/pull/760 - https://github.com/lz4/lz4/compare/v1.9.1...v1.9.2 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941 - https://github.com/lz4/lz4/issues/801 - https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26%40%3Cissues.kudu.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210723-0001/
CVE ID: CVE-2019-17544 State: PUBLISHED Published: 2019-10-14T01:07:53 Last Updated: 2024-08-05T01:40:15.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GNUAspell/aspell/commit/80fa26c74279fced8d778351cff19d1d8f44fe4e - https://github.com/GNUAspell/aspell/compare/rel-0.60.7...rel-0.60.8 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16109 - https://usn.ubuntu.com/4155-1/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00027.html -
/detail?id=16109 - https://usn.ubuntu.com/4155-1/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00027.html - https://usn.ubuntu.com/4155-2/ - https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html - https://www.debian.org/security/2021/dsa-4948
CVE ID: CVE-2019-17545 State: PUBLISHED Published: 2019-10-14T01:07:41 Last Updated: 2024-08-05T01:40:15.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/11/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00022.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVRC3EBQBFBVQC26XJE3AI3KQXC2NGTP/ - https://lists.fedoraproject.org/archives/list/package-announc
oraproject.org/message/XVRC3EBQBFBVQC26XJE3AI3KQXC2NGTP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CB7RRPCQP253XA5MYUOLHLRPKNGKVZNT/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://github.com/OSGeo/gdal/commit/148115fcc40f1651a5d15fa34c9a8c528e7147bb - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16178 - https://lists.debian.org/debian-lts-announce/2022/01/msg00004.html - https://lists.debian.org/debian-lts-announce/2022/09/msg00040.html
CVE ID: CVE-2019-17546 State: PUBLISHED Published: 2019-10-14T01:07:02 Last Updated: 2024-12-20T13:06:38.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf - https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443
f/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443 - https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html - https://seclists.org/bugtraq/2020/Jan/32 - https://www.debian.org/security/2020/dsa-4608 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5ZW7E3IEW7LT2BPJP7D3RN6OUOE3MX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3S4WNIMZ7XSLY2LD5FPRPZMGNUBVKOG/ - https://security.gentoo.org/glsa/202003-25 - https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html - https://www.debian.org/security/2020/d
/202003-25 - https://lists.debian.org/debian-lts-announce/2020/03/msg00020.html - https://www.debian.org/security/2020/dsa-4670
CVE ID: CVE-2019-17547 State: PUBLISHED Published: 2019-10-14T01:07:25 Last Updated: 2024-08-05T01:40:15.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/ecf7c6b288e11e7e7f75387c5e9e93e423b98397 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16537 - https://github.com/ImageMagick/ImageMagick/compare/7.0.8-51...7.0.8-62
CVE ID: CVE-2019-17549 State: PUBLISHED Published: 2020-03-03T14:25:02 Last Updated: 2024-08-05T01:40:15.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: ESET Cyber Security before 6.8.1.0 is vulnerable to a denial-of-service allowing any user to stop (kill) ESET processes. An attacker can abuse this bug to stop the protection from ESET and launch his attack. Additional Analyst Notes: - CVE Program Container: References: - https://danishcyberdefence.dk/blog/esets-cyber-security
CVE ID: CVE-2019-17550 State: PUBLISHED Published: 2019-11-13T20:23:14 Last Updated: 2024-08-05T01:40:15.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2s_id parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/blog2social/#developers - https://plugins.trac.wordpress.org/changese
ainer: References: - https://wordpress.org/plugins/blog2social/#developers - https://plugins.trac.wordpress.org/changeset/2186043 - https://plugins.trac.wordpress.org/log/blog2social/ - https://wpvulndb.com/vulnerabilities/9948
CVE ID: CVE-2019-17551 State: PUBLISHED Published: 2019-10-31T02:55:26 Last Updated: 2024-08-05T01:40:15.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes section. Although versions 6.31.8.3 and 6.31.8.5 are confirmed to be affected, all versions with the vulnerable WYSIWYG editor in the Notes section are likely affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.apakgroup.co
s section are likely affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.apakgroup.com/products/wholesale-floorplanning-finance/ - https://www2.deloitte.com/de/de/pages/risk/articles/wholesale-finance-xss.html
CVE ID: CVE-2019-17552 State: PUBLISHED Published: 2019-10-14T12:32:41 Last Updated: 2024-08-05T01:40:15.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/77
CVE ID: CVE-2019-17553 State: PUBLISHED Published: 2019-10-14T12:32:31 Last Updated: 2024-08-05T01:40:15.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sari3l/cve-test/issues/1
CVE ID: CVE-2019-17554 State: PUBLISHED Published: 2019-12-04T16:54:22 Last Updated: 2024-08-05T01:40:15.799Z Vendors: Apache Products: Olingo Problem Types: XML External Entity resolution attack Description: The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d7Ty%3DL-n_iAzT6vcQp65BY29XZDS5tMoM8MdDrb1moM7A%40mail.gmail.com%3E - https://
mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d7Ty%3DL-n_iAzT6vcQp65BY29XZDS5tMoM8MdDrb1moM7A%40mail.gmail.com%3E - https://seclists.org/bugtraq/2019/Dec/11 - http://packetstormsecurity.com/files/155619/Apache-Olingo-OData-4.6.x-XML-Injection.html - https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
CVE ID: CVE-2019-17555 State: PUBLISHED Published: 2019-12-04T17:06:18 Last Updated: 2024-08-05T01:40:15.978Z Vendors: Apache Products: Olingo Problem Types: DoS via Retry-After header vulnerability Description: The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d65UmudJ_MQkFXEv9YY_wwZbRA3sgtNDzMoLM51Qh%3DRCA%40mail.gmail.com%3E
CVE ID: CVE-2019-17556 State: PUBLISHED Published: 2019-12-04T16:59:49 Last Updated: 2024-08-05T01:40:15.833Z Vendors: Apache Products: Olingo Problem Types: Deserialization vulnerability Description: Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d4vbSYaVh3aUWAvcVHK2qcFxxCZd3WAx3xbwZXskPX8nw%40mail.gmail.com%3E
CVE ID: CVE-2019-17557 State: PUBLISHED Published: 2020-05-04T12:27:31 Last Updated: 2024-08-05T01:40:15.982Z Vendors: n/a Products: Apache Syncope Problem Types: Information Disclosure Description: It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string. Additional Analyst Notes: - CVE Program Container: References: - http://syncope.apache.org/security
CVE ID: CVE-2019-17558 State: PUBLISHED Published: 2019-12-30T16:36:08.000Z Last Updated: 2025-10-21T23:35:54.150Z Vendors: n/a Products: Apache Solr Problem Types: Information Disclosure Description: Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`
can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread.html/rb964fe5c4e3fc05f75e8f74bf6b885f456b7a7750c36e9a8045c627a%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/r9271d030452170ba6160c022757e1b5af8a4c9ccf9e04164dec02e7f%40%3Cissue