Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-1010003 State: PUBLISHED Published: 2019-07-11T12:32:21 Last Updated: 2024-08-05T03:07:18.346Z Vendors: Leanote Products: Leanote Problem Types: Cross Site Scripting (XSS) Description: Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leanote/leanote/issues/719
CVE ID: CVE-2019-1010004 State: PUBLISHED Published: 2019-07-15T01:44:34 Last Updated: 2024-08-05T03:07:18.416Z Vendors: Sourceforge Products: SoX - Sound eXchange Problem Types: Out-of-bounds Read Description: SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/sox/bugs/299/ - https://sourceforge.net/p/sox/code/ci/master/tree/src/xa.c#l219
CVE ID: CVE-2019-1010005 State: PUBLISHED Published: 2019-07-15T01:45:28 Last Updated: 2024-08-05T03:07:17.979Z Vendors: HexoEditor Products: HexoEditor Problem Types: XSS to code execution Description: HexoEditor v1.1.8-beta is affected by: XSS to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhuzhuyule/HexoEditor/issues/3 - https://github.com/Moeditor/Moeditor/issues/156
CVE ID: CVE-2019-1010006 State: PUBLISHED Published: 2019-07-15T01:50:17 Last Updated: 2024-08-05T03:07:18.014Z Vendors: Evince Team Products: Evince Problem Types: Buffer Overflow Description: Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.gnome.org/show_bug.cgi?id=788980 - http://bugzilla.maptools.org/show_bug.cgi?id=2745 - ht
References: - https://bugzilla.gnome.org/show_bug.cgi?id=788980 - http://bugzilla.maptools.org/show_bug.cgi?id=2745 - https://usn.ubuntu.com/4067-1/ - https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00046.html - https://www.debian.org/security/2020/dsa-4624 - https://seclists.org/bugtraq/2020/Feb/18
CVE ID: CVE-2019-1010008 State: PUBLISHED Published: 2019-07-15T01:54:52 Last Updated: 2024-08-05T03:07:18.143Z Vendors: OpenEnergyMonitor Project Products: Emoncms Problem Types: Cross Site Scripting (XSS) Description: OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). The impact is: Theoretically low, but might potentially enable persistent XSS (user could embed mal. code). The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "My Account" page. File: Lib/listjs/list.js, line 67. The attack vector is: unknown, victim must open profile page if persistent was possible. Additional Analyst Notes: - CVE Progra
ack vector is: unknown, victim must open profile page if persistent was possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/emoncms/emoncms/issues/763
CVE ID: CVE-2019-1010009 State: PUBLISHED Published: 2019-07-15T02:00:46 Last Updated: 2024-08-05T03:07:18.213Z Vendors: DGLogik Inc Products: DGLux Server Problem Types: Insecure Permissions Description: DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote Execution, Credential Leaks. The component is: IoT API. The attack vector is: Any Accessible Server. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/kaendfinger/3ad1dbeb62f902cc3ac2867f4e01ae38
CVE ID: CVE-2019-1010011 State: REJECTED Published: 2019-07-15T02:14:07 Last Updated: 2019-07-16T19:38:49 Description: No description available.
CVE ID: CVE-2019-1010016 State: PUBLISHED Published: 2019-07-15T02:23:30 Last Updated: 2024-08-05T03:07:18.200Z Vendors: Dolibarr ERP & CRM Products: Dolibarr Problem Types: Cross Site Scripting (XSS) Description: Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/issues/7962
CVE ID: CVE-2019-1010017 State: PUBLISHED Published: 2019-07-15T02:25:52 Last Updated: 2024-08-05T03:07:18.214Z Vendors: libnmap Products: libnmap Problem Types: XML Injection Description: libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/savon-noir/python-libnmap/issues/87
CVE ID: CVE-2019-1010018 State: PUBLISHED Published: 2019-07-16T12:35:14 Last Updated: 2024-08-05T03:07:18.312Z Vendors: Zammad GmbH Products: Zammad Problem Types: CWE-80 Description: Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zammad/zammad/compare/ea50d0c...238784d - https://github.com/zammad/zammad/compare/5c983f6...1a9af7d - https://github.com/zammad/zammad/issues/1869
CVE ID: CVE-2019-1010022 State: PUBLISHED Published: 2019-07-15T03:00:51 Last Updated: 2024-11-15T15:04:27.415Z Vendors: GNU C Library Products: glibc Problem Types: Mitigation bypass Description: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22850 - h
CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22850 - https://security-tracker.debian.org/tracker/CVE-2019-1010022 - https://ubuntu.com/security/CVE-2019-1010022 - https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3
CVE ID: CVE-2019-1010023 State: PUBLISHED Published: 2019-07-15T03:09:37 Last Updated: 2024-08-05T03:07:18.214Z Vendors: GNU Libc Products: glibc Problem Types: Re-mapping current loaded libray with malicious ELF file Description: GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
security bug and no real threat. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22851 - http://www.securityfocus.com/bid/109167 - https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS - https://security-tracker.debian.org/tracker/CVE-2019-1010023 - https://ubuntu.com/security/CVE-2019-1010023
CVE ID: CVE-2019-1010024 State: PUBLISHED Published: 2019-07-15T03:06:26 Last Updated: 2024-08-05T03:07:18.291Z Vendors: GNU Libc Products: glibc Problem Types: Mitigation bypass Description: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22852 - http://www.securityfocus.com/bid/109162 - https://support.f5.com/csp/article/K06046097 - https://support.f5.com/csp/article/K06046097?
urityfocus.com/bid/109162 - https://support.f5.com/csp/article/K06046097 - https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS - https://security-tracker.debian.org/tracker/CVE-2019-1010024 - https://ubuntu.com/security/CVE-2019-1010024
CVE ID: CVE-2019-1010025 State: PUBLISHED Published: 2019-07-15T03:11:46 Last Updated: 2024-08-05T03:07:18.221Z Vendors: GNU Libc Products: glibc Problem Types: Mitigation bypass Description: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22853 - https://support.f5.com/csp/article/K06046097 - https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS - https://security-tr
K06046097 - https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS - https://security-tracker.debian.org/tracker/CVE-2019-1010025 - https://ubuntu.com/security/CVE-2019-1010025
CVE ID: CVE-2019-1010028 State: PUBLISHED Published: 2019-07-15T03:24:19 Last Updated: 2024-08-05T03:07:18.274Z Vendors: PHP Scripts Mall Pvt. Ltd. Products: School College Portal with ERP Script Problem Types: Cross Site Scripting (XSS) Description: phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/send_reply/. The attack vector is: <img src=x onerror=alert(document.domain) />. Additional Analyst Notes: - CVE Program Container: References: - https://whitehatck01.blogspot.com/2018/02/school-college-p
itional Analyst Notes: - CVE Program Container: References: - https://whitehatck01.blogspot.com/2018/02/school-college-portal-with-erp-script.html
CVE ID: CVE-2019-1010030 State: REJECTED Published: 2019-07-15T03:27:07 Last Updated: 2019-07-15T04:06:49 Description: No description available.
CVE ID: CVE-2019-1010034 State: PUBLISHED Published: 2019-07-15T12:39:12 Last Updated: 2024-08-05T03:07:17.921Z Vendors: Deepwoods Software Products: WebLibrarian Problem Types: SQL Injection Description: Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. This function call can be triggered by any user logged-in with at least Volunteer role or manage_circulation capabilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC. Additional Analyst
bilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/browser/weblibrarian/trunk/includes/database_code.php - https://wpvulndb.com/vulnerabilities/9553
CVE ID: CVE-2019-1010038 State: PUBLISHED Published: 2019-07-15T12:50:14 Last Updated: 2024-08-05T03:07:18.159Z Vendors: OpenModelica Products: OMCompiler Problem Types: Buffer Overflow Description: OpenModelica OMCompiler is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: OPENMODELICAHOME parameter changeable via environment variable. The attack vector is: Changing an environment variable. Additional Analyst Notes: - CVE Program Container: References: - https://trac.openmodelica.org/OpenModelica/ticket/4787#trac-add-comment
CVE ID: CVE-2019-1010039 State: PUBLISHED Published: 2019-07-15T13:01:45 Last Updated: 2024-08-05T03:07:18.292Z Vendors: uLaunchELF Products: uLaunchELF Problem Types: Buffer Overflow Description: uLaunchELF < commit 170827a is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Loader program (loader.c) overly trusts the arguments provided via command line. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AKuHAK/uLaunchELF/issues/14
CVE ID: CVE-2019-1010042 State: REJECTED Published: 2019-07-15T15:33:26 Last Updated: 2019-07-16T18:19:37 Description: No description available.
CVE ID: CVE-2019-1010043 State: PUBLISHED Published: 2019-07-16T13:11:34 Last Updated: 2024-08-05T03:07:18.064Z Vendors: Quake3e Products: Quake3e Problem Types: Buffer Overflow Description: Quake3e < 5ed740d is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Argument string creation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ec-/Quake3e/issues/9
CVE ID: CVE-2019-1010044 State: PUBLISHED Published: 2019-07-15T15:25:11 Last Updated: 2024-08-05T03:07:18.079Z Vendors: borg-reducer Products: borg-reducer Problem Types: Buffer Overflow Description: borg-reducer c6d5240 is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Output parameter within the executable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/archivesunleashed/borg-reducer/issues/4
CVE ID: CVE-2019-1010048 State: REJECTED Published: 2019-07-16T13:30:53 Last Updated: 2019-07-17T13:19:51 Description: No description available.
CVE ID: CVE-2019-1010054 State: PUBLISHED Published: 2019-07-18T12:52:13 Last Updated: 2024-08-05T03:07:18.176Z Vendors: Dolibarr ERP & CRM Products: Dolibarr Problem Types: Cross ite Request Forgery (CSRF) Description: Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lucasgcilento/CVE/blob/master/Dolibarr_CSRF
CVE ID: CVE-2019-1010057 State: PUBLISHED Published: 2019-07-16T12:04:30 Last Updated: 2024-08-05T03:07:18.388Z Vendors: nfdump Products: nfdump Problem Types: Buffer Overflow Description: nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The component is: nfx.c:546, nffile_inline.c:83, minilzo.c (redistributed). The attack vector is: nfdump must read and process a specially crafted file. The fixed version is: after commit 9f0fe9563366f62a71d34c92229da3432ec5cf0e. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phaag/nfdump/issues/104 - https://lists.fedoraproj
lyst Notes: - CVE Program Container: References: - https://github.com/phaag/nfdump/issues/104 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULSZMKA7P7REJMANVL7D6WMZ2L7IRSET/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTONOGJU5FSMFNRCT6OHXYUMDRKH4RPA/ - https://security.gentoo.org/glsa/202003-17 - https://lists.debian.org/debian-lts-announce/2020/09/msg00021.html
CVE ID: CVE-2019-1010060 State: PUBLISHED Published: 2019-07-16T12:16:38 Last Updated: 2024-08-05T03:07:18.244Z Vendors: NASA Products: CFITSIO Problem Types: Buffer Overflow Description: NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846, CVE-2018-3847, CVE-2018-3848, and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character. Additional Analyst Notes: - CVE Program Container: Referen
t.c mishandling a long string beginning with a '4' character. Additional Analyst Notes: - CVE Program Container: References: - https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/docs/changes2.txt - https://github.com/astropy/astropy/pull/7274 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892458 - https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio3420.tar.gz - https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio3430.tar.gz
CVE ID: CVE-2019-1010061 State: REJECTED Published: 2019-07-16T12:20:12 Last Updated: 2019-07-16T18:47:30 Description: No description available.
CVE ID: CVE-2019-1010062 State: PUBLISHED Published: 2019-07-16T12:24:15 Last Updated: 2024-08-05T03:07:18.171Z Vendors: pluck-cms Products: PluckCMS Problem Types: CWE-434 Description: PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8 - https://github.com/pluck-cms/pl
: - https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8 - https://github.com/pluck-cms/pluck/issues/44
CVE ID: CVE-2019-1010065 State: PUBLISHED Published: 2019-07-18T16:05:46 Last Updated: 2024-08-05T03:07:18.187Z Vendors: The Sleuth Kit Products: The Sleuth Kit Problem Types: Integer Overflow Description: The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image. Additional Analyst Notes: - CVE Program Container: References: - https://issuetracker.google.com/issues/77809383 - https://github.com/s
yst Notes: - CVE Program Container: References: - https://issuetracker.google.com/issues/77809383 - https://github.com/sleuthkit/sleuthkit/commit/114cd3d0aac8bd1aeaf4b33840feb0163d342d5b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGWCQIZKTDCJO4YGL5LGPYFNOVU7SJRX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VXDAP6SEO3RCDCZITTFGNZGSVPE5CTY/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html
CVE ID: CVE-2019-1010066 State: PUBLISHED Published: 2019-07-18T13:26:25 Last Updated: 2024-08-05T03:07:18.278Z Vendors: Lawrence Livermore National Laboratory Products: msr-safe Problem Types: Incorrect Access Control Description: Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registers. The component is: ioctl handling. The attack vector is: An attacker could exploit a bug in ioctl interface whitelist checking, in order to write to model specific registers, normally a function reserved for the root user. The fixed version is: v1.2.0. Additional Analyst Notes: - CVE Program Container: Re
function reserved for the root user. The fixed version is: v1.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LLNL/msr-safe/compare/v1.1.0...v1.2.0 - https://www.tldp.org/LDP/lkmpg/2.4/html/x856.html
CVE ID: CVE-2019-1010069 State: PUBLISHED Published: 2019-07-18T13:47:25 Last Updated: 2024-08-05T03:07:18.381Z Vendors: moinejf Products: abcm2ps Problem Types: Incorrect Access Control Description: moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txt_add. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/drive/u/2/folders/1Y2IbtEr9v4l4Ruie_AY9BFJOHOGiDt7S - https://github.com/leesavide/abcm2ps/issues/18 - https://lists.debian.org
/2/folders/1Y2IbtEr9v4l4Ruie_AY9BFJOHOGiDt7S - https://github.com/leesavide/abcm2ps/issues/18 - https://lists.debian.org/debian-lts-announce/2022/04/msg00015.html
CVE ID: CVE-2019-1010073 State: REJECTED Published: 2019-07-18T13:51:37 Last Updated: 2019-10-07T20:30:03 Description: No description available.
CVE ID: CVE-2019-1010083 State: PUBLISHED Published: 2019-07-17T13:59:09 Last Updated: 2024-08-05T03:07:18.278Z Vendors: The Pallets Project Products: Flask Problem Types: unexpected memory usage Description: The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656. Additional Analyst Notes: - CVE Program Container: References: - https://www.palletsprojects.com/blog/flask-1-0-released/
CVE ID: CVE-2019-1010084 State: PUBLISHED Published: 2019-07-17T13:05:11 Last Updated: 2024-08-05T03:07:18.178Z Vendors: Dancer::Plugin::SimpleCRUD Products: Dancer::Plugin::SimpleCRUD Problem Types: Incorrect Access Control Description: Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is: Incorrect calls to _ensure_auth() wrapper result in authentication-checking not being applied to al routes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigpresh/Dancer-Plugin-SimpleCRUD/pull/109
CVE ID: CVE-2019-1010091 State: PUBLISHED Published: 2019-07-17T16:35:10 Last Updated: 2024-08-05T03:07:18.162Z Vendors: tinymce Products: tinymce Problem Types: CWE-79 Description: tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tinymce/tinymce/issues/4394
CVE ID: CVE-2019-1010094 State: PUBLISHED Published: 2019-07-18T12:31:15 Last Updated: 2024-08-05T03:07:18.274Z Vendors: DomainMOD Products: DomainMOD Problem Types: Cross ite Request Forgery (CSRF) Description: domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/domainmod/domainmod/issues/65