Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12154 State: PUBLISHED Published: 2019-06-11T20:35:34 Last Updated: 2024-08-04T23:10:30.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions. Additional Analyst Notes: - CVE Program Container: References: - https://www.pdfreactor.com/important-pdfreactor-security-advisory/ - https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/ - https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabil
r-10-maintenance-release-10-1-10722-now-available/ - https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html
CVE ID: CVE-2019-12155 State: PUBLISHED Published: 2019-05-24T15:33:11 Last Updated: 2024-08-04T23:10:30.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2019-05/msg01321.html - http://www.openwall.com/lists/oss-security/2019/05/22/1 - https://www.debian.org/security/2019/dsa-4454 - https://seclists.org/bugtraq/2019/May/76 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BOE3PVFPMWMXV3DGP2R3XIHAF2ZQU3FS/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html - https://access.redhat.com/errata/RHSA-2019:2607 - https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html - https://access.redhat.com/errata/RHSA-2019:2892 - https://access.redhat.com/errata/RHSA-2019:3179 - https://access.redhat.com/errata/RHSA-2019:3345 - https://access.redhat.com/errat
ess.redhat.com/errata/RHSA-2019:3179 - https://access.redhat.com/errata/RHSA-2019:3345 - https://access.redhat.com/errata/RHSA-2019:3742 - https://access.redhat.com/errata/RHSA-2019:3787 - https://usn.ubuntu.com/4191-2/ - https://usn.ubuntu.com/4191-1/ - https://access.redhat.com/errata/RHBA-2019:3723 - https://access.redhat.com/errata/RHSA-2019:4344 - https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3be7eb2f47bf71db5f80fcf8750ea395dd5ffdd2
CVE ID: CVE-2019-12156 State: PUBLISHED Published: 2019-10-02T18:52:29 Last Updated: 2024-08-04T23:10:30.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-12157 State: PUBLISHED Published: 2019-10-02T18:51:36 Last Updated: 2024-08-04T23:10:30.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-12158 State: PUBLISHED Published: 2019-05-17T18:06:23 Last Updated: 2024-08-04T23:10:30.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fekberg/GoHttp/issues/17
CVE ID: CVE-2019-12159 State: PUBLISHED Published: 2019-05-17T18:06:33 Last Updated: 2024-08-04T23:10:30.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fekberg/GoHttp/issues/16
CVE ID: CVE-2019-12160 State: PUBLISHED Published: 2019-05-17T18:06:43 Last Updated: 2024-08-04T23:10:30.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: GoHTTP through 2017-07-25 has a sendHeader use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fekberg/GoHttp/issues/15
CVE ID: CVE-2019-12161 State: PUBLISHED Published: 2019-05-17T18:47:33 Last Updated: 2024-08-04T23:10:30.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1550366
CVE ID: CVE-2019-12162 State: PUBLISHED Published: 2019-07-23T14:07:52 Last Updated: 2024-08-04T23:10:30.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe. Additional Analyst Notes: - CVE Program Container: References: - https://support.upwork.com/hc/en-us/categories/360001180954 - https://vuldb.com/?id.138406
CVE ID: CVE-2019-12163 State: PUBLISHED Published: 2019-05-17T20:17:20 Last Updated: 2024-08-04T23:10:30.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gatshipWs.asmx/SqlVersion request. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/May/29 - http://packetstormsecurity.com/files/152964/GAT-Ship-Web-Module-1.30-Information-Disclosure.html - http://seclists.org/fulldisclosure/2019/May/32
CVE ID: CVE-2019-12164 State: PUBLISHED Published: 2019-07-23T22:16:57 Last Updated: 2024-08-04T23:10:30.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: ubuntu-server.js in Status React Native Desktop before v0.57.8_mobile_ui allows Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/status-im/react-native-desktop/pull/475/commits/f6945f1e4b157c69e414cd94fe5cde1876aabcc1 - https://github.com/status-im/react-native-desktop/pull/475 - https://github.com/status-im/react-native-desktop/compare/e77167f...7477eef
CVE ID: CVE-2019-12165 State: PUBLISHED Published: 2019-05-29T16:56:17 Last Updated: 2024-08-04T23:10:30.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0 (6.0.0.61), and 5.0 (5.0.5.7) have a Command Execution Vulnerability. Successful exploit of this vulnerability could allow an attacker to execute arbitrary system commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/-/media/mitel/pdf/content-entry-pdf/en-security-bulletin-17-0010-004.pdf
CVE ID: CVE-2019-12167 State: PUBLISHED Published: 2019-05-22T17:42:43 Last Updated: 2024-08-04T23:10:30.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.emerson.com/en-us/support - https://seclists.org/bugtraq/2019/May/51 - http://www.securityfocus.com/bid/108420
CVE ID: CVE-2019-12168 State: PUBLISHED Published: 2019-05-17T21:31:21 Last Updated: 2024-08-04T23:10:30.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40bertinjoseb/four-faith-industrial-routers-command-injection-rce-reverse-shell-121c4dedb0d8
CVE ID: CVE-2019-12169 State: PUBLISHED Published: 2019-06-03T20:00:28 Last Updated: 2024-08-04T23:10:30.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fuzzlove - https://github.com/fuzzlove/ATutor-2.2.4-Language-Exploit - http://incidentsecurity.com/atutor-2-2-4-language_import-arbitrary-file-upload-rce/ - http://pac
.2.4-Language-Exploit - http://incidentsecurity.com/atutor-2-2-4-language_import-arbitrary-file-upload-rce/ - http://packetstormsecurity.com/files/153870/ATutor-2.2.4-Arbitrary-File-Upload-Command-Execution.html - http://packetstormsecurity.com/files/158246/ATutor-2.2.4-Directory-Traversal-Remote-Code-Execution.html
CVE ID: CVE-2019-12170 State: PUBLISHED Published: 2019-05-17T21:52:18 Last Updated: 2024-08-04T23:10:30.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fuzzlove/ATutor-Instructor-Backup-Arbitrary-File - http://inci
- CVE Program Container: References: - https://github.com/fuzzlove/ATutor-Instructor-Backup-Arbitrary-File - http://incidentsecurity.com/atutor-2-2-4-backup-remote-command-execution/ - http://packetstormsecurity.com/files/153869/ATutor-2.2.4-Backup-Remote-Command-Execution.html
CVE ID: CVE-2019-12171 State: PUBLISHED Published: 2019-07-08T12:44:11 Last Updated: 2024-08-04T23:10:30.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account creation. These are not securely freed in the running process. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/open?id=1msz6pb08crPC0VT7s_Z_KTsKm9CbLJEXNsmRwzoNLy8 - https://drive.google.com/open?id=1DCGurwRTu0HsUpTglVR0jgItZNqqDm_5
CVE ID: CVE-2019-12172 State: PUBLISHED Published: 2019-05-17T22:30:13 Last Updated: 2024-08-04T23:10:30.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/typora/typora-issues/issues/2166
CVE ID: CVE-2019-12173 State: PUBLISHED Published: 2019-05-17T22:30:23 Last Updated: 2024-08-04T23:10:30.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MacDownApp/macdown/issues/1050
CVE ID: CVE-2019-12174 State: PUBLISHED Published: 2019-07-08T13:03:17 Last Updated: 2024-08-04T23:10:30.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileName method of the me_hide_vpnhelper.Helper class in the me.hide.vpnhelper macOS privilege helper tool. This method takes user-supplied input and can be used to escalate privileges, as well as obtain the ability to run any application on the system in the root context. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P
itional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2
CVE ID: CVE-2019-12175 State: PUBLISHED Published: 2019-07-17T16:40:14 Last Updated: 2024-08-04T23:10:30.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser leads to DoS because a case-type index is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zeek/zeek/releases/tag/v2.6.2
CVE ID: CVE-2019-12176 State: PUBLISHED Published: 2019-06-03T19:25:49 Last Updated: 2024-08-04T23:10:30.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation in the "HTC Account Service" and "ViveportDesktopService" in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate privileges to SYSTEM via reconfiguration of either service. Additional Analyst Notes: - CVE Program Container: References: - https://community.viveport.com/ - https://huskersec.com/privilege-escalation-via-htc-viveport-desktop-c93471ff87c8
CVE ID: CVE-2019-12177 State: PUBLISHED Published: 2019-06-03T19:22:04 Last Updated: 2024-08-04T23:10:30.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate privileges via DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://community.viveport.com/ - https://huskersec.com/privilege-escalation-via-htc-viveport-desktop-c93471ff87c8 - https://posts.specterops.io/razer-synapse-3-elevation-of-privilege-6d2802bd0585
CVE ID: CVE-2019-12180 State: PUBLISHED Published: 2020-02-05T16:06:44 Last Updated: 2024-08-04T23:10:30.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project. Additional Analyst Notes: - CVE Program Container: References: - https://lab.mediaservice.n
cally when saving a project. Additional Analyst Notes: - CVE Program Container: References: - https://lab.mediaservice.net/advisory/2020-04-readyapi-soapui.txt
CVE ID: CVE-2019-12181 State: PUBLISHED Published: 2019-06-17T15:16:26 Last Updated: 2024-08-04T23:10:30.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-1-7_release_notes.htm - https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-Potential-elevation-of-privileges-on-Linux-systems - http://packetstormsecurity.com/files/153333/Serv-U-FTP-Server-15.1.6-Privilege-Escalation.html - https://blog.vastart.dev/2019/06/cve-2019-12181-
y.com/files/153333/Serv-U-FTP-Server-15.1.6-Privilege-Escalation.html - https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html - http://packetstormsecurity.com/files/153505/Serv-U-FTP-Server-prepareinstallation-Privilege-Escalation.html
CVE ID: CVE-2019-12182 State: PUBLISHED Published: 2020-03-13T16:11:13 Last Updated: 2024-08-04T23:10:30.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API. Additional Analyst Notes: - CVE Program Container: References: - https://safescan.com/ - https://github.com/ProCheckUp/SafeScan - https://procheckup.com/blogs/posts/2020/february/remote-code-execution-on-biometric-iot-devices/ - https://support.timemoto.com/en/s/safescan-time-clock-systems/a/firmware-update-7-dot-03-dot-100-ta8000-14
CVE ID: CVE-2019-12183 State: PUBLISHED Published: 2020-03-02T15:12:05 Last Updated: 2024-08-04T23:10:30.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ProCheckUp/SafeScan - https://procheckup.com/blogs/posts/2020/february/remote-code-execution-on-biometric-iot-devices/ - https://support.timemoto.com/en/s/safescan-time-clock-systems/a/firmware-update-7-dot-03-dot-100-ta8000-14
CVE ID: CVE-2019-12184 State: PUBLISHED Published: 2019-05-19T19:00:19 Last Updated: 2024-08-04T23:10:30.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/rebirthwyw/9836b2445abd4c1358e3d68ff2415247
CVE ID: CVE-2019-12185 State: PUBLISHED Published: 2019-05-19T23:05:41 Last Updated: 2024-08-04T23:10:30.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. Additional Analyst Notes: - CVE Program Container: References: - http://incidentsecurity.com/elabftw-1-8-5-entitycontroller-arbitrary-file-upload-rce/ - https://github.com/fuzzlove
s: - http://incidentsecurity.com/elabftw-1-8-5-entitycontroller-arbitrary-file-upload-rce/ - https://github.com/fuzzlove/eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCE
CVE ID: CVE-2019-12186 State: PUBLISHED Published: 2019-12-31T14:21:39 Last Updated: 2024-08-04T23:10:30.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with m
jecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object. Additional Analyst Notes: - CVE Program Container: References: - https://sylius.com/blog/cve-2019-12186/
CVE ID: CVE-2019-12189 State: PUBLISHED Published: 2019-05-21T17:30:14 Last Updated: 2024-08-04T23:10:30.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://github.com/tuyenhva/CVE-2019-12189 - http://packetstormsecurity.com/files/153028/Zoho-ManageEngine-ServiceDesk-Plus-9.3-Cross-Site-Scripting.html
CVE ID: CVE-2019-12190 State: PUBLISHED Published: 2019-05-21T17:29:14 Last Updated: 2024-08-04T23:10:30.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tuyenhva/CVE-2019-12190
CVE ID: CVE-2019-12193 State: PUBLISHED Published: 2019-07-19T15:52:31 Last Updated: 2024-08-04T23:10:30.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter. Additional Analyst Notes: - CVE Program Container: References: - https://laolisafe.com/h3cloud-sql-injection-vulnerability/
CVE ID: CVE-2019-12195 State: PUBLISHED Published: 2019-05-24T15:24:45 Last Updated: 2024-08-04T23:10:30.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the internet connection was disconnected. All the users become disconnected from the internet. Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/security - http://packetstormsecurity.com/files/153027/TP-LINK-TL-WR840N-Cr
er: References: - https://www.tp-link.com/us/security - http://packetstormsecurity.com/files/153027/TP-LINK-TL-WR840N-Cross-Site-Scripting.html
CVE ID: CVE-2019-12196 State: PUBLISHED Published: 2019-06-05T17:37:40 Last Updated: 2024-08-04T23:10:30.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/netflow/readme.html#124029 - http://www.securityfocus.com/bid/108672
CVE ID: CVE-2019-12198 State: PUBLISHED Published: 2019-05-20T03:18:15 Last Updated: 2024-08-04T23:17:38.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fekberg/GoHttp/issues/18
CVE ID: CVE-2019-12203 State: PUBLISHED Published: 2019-09-25T18:45:44 Last Updated: 2024-08-04T23:17:38.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: SilverStripe through 4.3.3 allows session fixation in the "change password" form. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/CVE-2019-12203
CVE ID: CVE-2019-12204 State: PUBLISHED Published: 2019-09-25T18:25:06 Last Updated: 2024-08-04T23:17:38.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/CVE-2019-12204