Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-9105 State: PUBLISHED Published: 2019-05-31T21:21:15 Last Updated: 2024-08-04T21:38:46.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/REST_API.php?command=CallAPI&customurl=alladminusers call. Additional Analyst Notes: - CVE Program Container: References: - https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf - https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/
CVE ID: CVE-2019-9106 State: PUBLISHED Published: 2019-05-31T21:22:41 Last Updated: 2024-08-04T21:38:46.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or include local .php files, as demonstrated by menu=php://filter/convert.base64-encode/resource=index.php to read index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.saet.org/wp-content/uploads/2017/04/Depliant_TEBE-TEBE_Small.pdf - https://members.backbox.org/saet-tebe-small-supervisor-multiple-vulnerabilities/
CVE ID: CVE-2019-9107 State: PUBLISHED Published: 2019-02-25T01:00:00 Last Updated: 2024-08-04T21:38:46.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/redeye5/ccbbc43330cc9821062249b78c916317 - https://github.com/wuzhicms/wuzhicms/issues/169
CVE ID: CVE-2019-9108 State: PUBLISHED Published: 2019-02-25T01:00:00 Last Updated: 2024-08-04T21:38:46.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/171 - https://gist.github.com/redeye5/ebfef23f0a063b82779151f9cde8e480
CVE ID: CVE-2019-9109 State: PUBLISHED Published: 2019-02-25T01:00:00 Last Updated: 2024-08-04T21:38:46.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/172 - https://gist.github.com/redeye5/57ccafea7263efec67c82b0503c72480
CVE ID: CVE-2019-9110 State: PUBLISHED Published: 2019-02-25T01:00:00 Last Updated: 2024-08-04T21:38:46.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/170 - https://gist.github.com/redeye5/470708bd27ed115b29d0434255b9f7a0
CVE ID: CVE-2019-9111 State: PUBLISHED Published: 2019-02-25T04:00:00 Last Updated: 2024-08-04T21:38:46.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS because of missing checks of the count argument in sde_evtlog_filter_write in drivers/gpu/drm/msm/sde_dbg.c. This is exploitable for a device crash via a syscall by a crafted application on a rooted device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MiCode/Xiaomi_Kernel_OpenSource/issues/1001
CVE ID: CVE-2019-9112 State: PUBLISHED Published: 2019-02-25T04:00:00 Last Updated: 2024-08-04T21:38:46.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer overflow and OOPS because of missing checks of the count argument in _sde_debugfs_conn_cmd_tx_write in drivers/gpu/drm/msm/sde/sde_connector.c. This is exploitable for a device crash via a syscall by a crafted application on a rooted device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MiCode/Xiaomi_Kernel_OpenSource/issues/1000
CVE ID: CVE-2019-9113 State: PUBLISHED Published: 2019-02-25T04:00:00 Last Updated: 2024-08-04T21:38:46.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ming (aka libming) 0.4.8 has a NULL pointer dereference in the function getString() in the decompile.c file in libutil.a. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/171
CVE ID: CVE-2019-9114 State: PUBLISHED Published: 2019-02-25T04:00:00 Last Updated: 2024-08-04T21:38:46.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ming (aka libming) 0.4.8 has an out of bounds write vulnerability in the function strcpyext() in the decompile.c file in libutil.a. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/170
CVE ID: CVE-2019-9115 State: PUBLISHED Published: 2019-02-25T04:00:00 Last Updated: 2024-08-04T21:38:46.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/irisnet/irisnet-crypto/issues/60
CVE ID: CVE-2019-9116 State: PUBLISHED Published: 2019-02-25T07:00:00 Last Updated: 2024-08-04T21:38:46.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or api-ms-win-core-localization-l1-2-1.dll file may be loaded if a victim uses sublime_text.exe to open a .txt file within an attacker's %LOCALAPPDATA%\Temp\sublime_text folder. NOTE: the vendor's position is "This does not appear to be a bug with Sublime Text, but rather one with Windows that has been patched. Additional Analyst Notes: - CVE Program Container: References: -
xt, but rather one with Windows that has been patched. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SublimeTextIssues/Core/issues/2544
CVE ID: CVE-2019-9117 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:38:46.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetNetworkTomographySettings API function, as demonstrated by shell metacharac
usted input from the request body for the SetNetworkTomographySettings API function, as demonstrated by shell metacharacters in the tomography_ping_number field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/motorola/M2_C1/SetNetworkTomographySettings.md
CVE ID: CVE-2019-9118 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:38:46.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetNTPServerSettings API function, as demonstrated by shell metacharacters in
usted input from the request body for the SetNTPServerSettings API function, as demonstrated by shell metacharacters in the system_time_timezone field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/motorola/M2_C1/SetNTPServerSettings.md
CVE ID: CVE-2019-9119 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:38:46.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteSettings API function, as demonstrated by shell metacharacters i
usted input from the request body for the SetStaticRouteSettings API function, as demonstrated by shell metacharacters in the staticroute_list field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/motorola/M2_C1/SetStaticRouteSettings.md
CVE ID: CVE-2019-9120 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:38:46.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWLanACLSettings API function, as demonstrated by shell metacharacters in th
usted input from the request body for the SetWLanACLSettings API function, as demonstrated by shell metacharacters in the wl(0).(0)_maclist field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/motorola/M2_C1/SetWLanACLSettings.md
CVE ID: CVE-2019-9121 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:38:46.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetSmartQoSSettings API function, as demonstrated by shell metacharacters in t
usted input from the request body for the SetSmartQoSSettings API function, as demonstrated by shell metacharacters in the smartqos_priority_devices field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/motorola/M2_C1/SetSmartQoSSettings.md
CVE ID: CVE-2019-9122 State: PUBLISHED Published: 2019-02-25T05:00:00 Last Updated: 2024-08-04T21:38:46.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntp_server parameter in an ntp_sync.cgi POST request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-825/command%20injection.md
CVE ID: CVE-2019-9123 State: PUBLISHED Published: 2019-02-25T05:00:00 Last Updated: 2024-08-04T21:38:46.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-825/Permission%20access%20control.md
CVE ID: CVE-2019-9124 State: PUBLISHED Published: 2019-02-25T05:00:00 Last Updated: 2024-08-04T21:38:46.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/blankpassword.md
CVE ID: CVE-2019-9125 State: PUBLISHED Published: 2019-02-25T05:00:00 Last Updated: 2024-08-04T21:38:46.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not require authentication via the HNAP_AUTH HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/overflow2.md - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-878/overflow1.md
CVE ID: CVE-2019-9126 State: PUBLISHED Published: 2019-02-25T05:00:00 Last Updated: 2024-08-04T21:38:46.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is an information disclosure vulnerability via requests for the router_info.xml document. This will reveal the PIN code, MAC address, routing table, firmware version, update time, QOS information, LAN information, and WLAN information of the device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-825/information%20disclosure.md
CVE ID: CVE-2019-9132 State: PUBLISHED Published: 2019-04-01T16:52:46 Last Updated: 2024-08-04T21:38:46.549Z Vendors: KaKao Products: Kakaotalk Windows PC Messenger Description: Remote code execution vulnerability exists in KaKaoTalk PC messenger when user clicks specially crafted link in the message window. This affects KaKaoTalk windows version 2.7.5.2024 or lower. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34981
CVE ID: CVE-2019-9133 State: PUBLISHED Published: 2019-04-09T17:33:27 Last Updated: 2024-08-04T21:38:46.358Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Pandora.tv Products: KMPlayer Problem Types: CWE-190 Description: When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn't check object size correctly, which leads to integer underflow then to memory out-of-bound read/write. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34991 - https://li
ram Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34991 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4D55BLGBNWNIMNI5N57WDPAFQCUIM6XX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT5HBIKH64YRZFFAPXGOTHIQJHSTQJF7/
CVE ID: CVE-2019-9134 State: PUBLISHED Published: 2019-04-09T17:53:54 Last Updated: 2024-08-04T21:38:46.427Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Solideo Systems Co,Ltd Products: Architectural Information System Problem Types: CWE-120 Description: Architectural Information System 1.0 and earlier versions have a Stack-based buffer overflow, allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34993
CVE ID: CVE-2019-9135 State: PUBLISHED Published: 2019-04-25T16:49:13 Last Updated: 2024-08-04T21:38:46.414Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: HumanTalk Co,Ltd Products: DaviewIndy Problem Types: CWE-122 Description: DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malformed DIB format file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE ID: CVE-2019-9136 State: PUBLISHED Published: 2019-04-25T16:57:29 Last Updated: 2024-08-04T21:38:46.484Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: HumanTalk Co,Ltd Products: DaviewIndy Problem Types: CWE-122 Description: DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malformed JPEG2000 format file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE ID: CVE-2019-9137 State: PUBLISHED Published: 2019-04-25T17:11:58 Last Updated: 2024-08-04T21:38:46.554Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: HumanTalk Co,Ltd Products: DaviewIndy Problem Types: CWE-190 Description: DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed Image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE ID: CVE-2019-9138 State: PUBLISHED Published: 2019-04-25T17:19:01 Last Updated: 2024-08-04T21:38:46.543Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: HumanTalk Co,Ltd Products: DaviewIndy Problem Types: CWE-190 Description: DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed PhotoShop file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE ID: CVE-2019-9139 State: PUBLISHED Published: 2019-04-25T17:22:31 Last Updated: 2024-08-04T21:38:46.558Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: HumanTalk Co,Ltd Products: DaviewIndy Problem Types: CWE-190 Description: DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE ID: CVE-2019-9140 State: PUBLISHED Published: 2019-08-01T16:54:17.745926Z Last Updated: 2024-09-17T03:12:56.656Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SPC CLOUD Products: Happypoint mobile app Problem Types: CWE-94 Description: When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeVi
alicious URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35103
CVE ID: CVE-2019-9141 State: PUBLISHED Published: 2019-08-02T15:52:45.558145Z Last Updated: 2024-09-16T18:03:06.693Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IMGTech Co,Ltd Products: ZInsVX.dll ActiveX Control Problem Types: CWE-20 Description: ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary files by setting the arguments to the ActiveX method. This can be leveraged for remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35104
CVE ID: CVE-2019-9142 State: PUBLISHED Published: 2019-02-25T15:00:00Z Last Updated: 2024-09-16T20:52:36.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/b3log/symphony/issues/860
CVE ID: CVE-2019-9143 State: PUBLISHED Published: 2019-02-25T15:00:00 Last Updated: 2024-08-04T21:38:46.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://research.loginsoft.com/bugs/uncontrolled-recursion-loop-in-exiv2imageprinttiffstructure-exiv2-0-27/ - https://github.com/Exiv2/exiv2/issues/711 - http://www.securityfocus.com/bid/
exiv2imageprinttiffstructure-exiv2-0-27/ - https://github.com/Exiv2/exiv2/issues/711 - http://www.securityfocus.com/bid/107161
CVE ID: CVE-2019-9144 State: PUBLISHED Published: 2019-02-25T15:00:00 Last Updated: 2024-08-04T21:38:46.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://research.loginsoft.com/bugs/uncontrolled-recursion-loop-in-exiv2anonymous-namespacebigtiffimageprintifd-exiv2-0-27/ - https://github.com/Exiv2/exiv2/issues/712 - http://www.securityf
v2anonymous-namespacebigtiffimageprintifd-exiv2-0-27/ - https://github.com/Exiv2/exiv2/issues/712 - http://www.securityfocus.com/bid/107161
CVE ID: CVE-2019-9145 State: PUBLISHED Published: 2019-02-25T17:00:00Z Last Updated: 2024-09-16T18:23:49.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnblogs.com/7bit/articles/10389939.html
CVE ID: CVE-2019-9146 State: PUBLISHED Published: 2019-02-25T18:00:00 Last Updated: 2024-08-04T21:38:46.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PAGalaxyLab/VulInfo/blob/master/JAMF/JAMF%20software%20%20local%20permission%20promotion%20vulnerability.md