Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
is no supported way to enable it when building portable OpenSSH. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssh.com/releasenotes.html - https://www.openwall.com/lists/oss-security/2019/10/09/1 - https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5&r2=1.6&f=h - https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c - https://bugzilla.suse.com/show_bug.cgi?id=1153537 - https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow - https://security.netapp.com/advisory/ntap-20191024-0003/ - https://security.gentoo.org/glsa/201911-01 - https://cert-portal.siemens.com/productcert/
advisory/ntap-20191024-0003/ - https://security.gentoo.org/glsa/201911-01 - https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
CVE ID: CVE-2019-16906 State: PUBLISHED Published: 2019-10-31T21:36:56 Last Updated: 2024-08-05T01:24:48.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with a modified username, a different user's notifications can be read without authentication/authorization. These notifications are then no longer displayed to the normal user. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/154991/Infosysta-Jira-1.6.13_J8-Push-Notification-Authentication-Bypass.html - https://seclists.o
tormsecurity.com/files/154991/Infosysta-Jira-1.6.13_J8-Push-Notification-Authentication-Bypass.html - https://seclists.org/bugtraq/2019/Nov/0
CVE ID: CVE-2019-16907 State: PUBLISHED Published: 2019-10-31T21:43:35 Last Updated: 2024-08-05T01:24:48.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/154993/Infosysta-Jira-1.6.13_J8-User-Name-Disclosure.html - https://seclists.org/bugtraq/2019/Nov/0
CVE ID: CVE-2019-16908 State: PUBLISHED Published: 2019-11-01T11:30:06 Last Updated: 2024-08-05T01:24:48.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects without authentication/authorization via the plugins/servlet/nfj/ProjectFilter?searchQuery= URI. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/1217434/in-app-desktop-notifications-for-jira - http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List-Authentication-Bypass.html
CVE ID: CVE-2019-16909 State: PUBLISHED Published: 2019-11-01T11:36:50 Last Updated: 2024-08-05T01:24:48.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects (with authentication as a Jira user, but without authorization for specific projects) via the plugins/servlet/nfj/NotificationSettings URI. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/1217434/in-app-desktop-notifications-for-jira - http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List
n-app-desktop-notifications-for-jira - http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List-Authentication-Bypass.html
CVE ID: CVE-2019-16910 State: PUBLISHED Published: 2019-09-26T00:00:00 Last Updated: 2024-08-05T01:24:48.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.) Additional Analyst Notes: - CVE Program Container: References: - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10 - https://lists.fedoraproject
- https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEHHH2DOBXB25CAU3Q6E66X723VAYTB5/ - https://github.com/ARMmbed/mbedtls/commit/298a43a77ec0ed2c19a8c924ddd8571ef3e65dfd - https://github.com/ARMmbed/mbedtls/commit/33f66ba6fd234114aa37f0209dac031bb2870a9b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSFFOROD6IVLADZHNJC2LPDV7FQRP7XB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGSKQSGR5SOBRBXDSSPTCDSBB5K3GMPF/ - https://lists.debian.org/debian-lts-an
ge-announce%40lists.fedoraproject.org/message/CGSKQSGR5SOBRBXDSSPTCDSBB5K3GMPF/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2019-16913 State: PUBLISHED Published: 2019-10-07T21:47:19 Last Updated: 2024-08-05T01:24:48.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: (F)" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as LocalSystem. This allows any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a Trojan horse. Additional Analyst Notes: - CVE Program Container: References: - https://flipflopsecurity.
s binary with a Trojan horse. Additional Analyst Notes: - CVE Program Container: References: - https://flipflopsecurity.wordpress.com/2019/10/07/pc-protect-v4-14-31-privilege-esclation/
CVE ID: CVE-2019-16914 State: PUBLISHED Published: 2019-09-26T17:38:53 Last Updated: 2024-08-05T01:24:48.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.pfsense.org/issues/9609 - https://github.com/pfsense/pfsense/commit/d31362b69d5d52dc196dc72f66e830cd1e6e9a4f - https://www.seebug.org/vuldb/ssvid-98023
CVE ID: CVE-2019-16915 State: PUBLISHED Published: 2019-09-26T17:38:42 Last Updated: 2024-08-05T01:24:48.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a basename call) for a pathname to file_get_contents or file_put_contents. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.pfsense.org/issues/9610 - https://github.com/pfsense/pfsense/commit/2c544ac61ce98f716d50b8e5961d7dfba66804b5 - https://www.seebug.org/vuldb/ssvid-98024
CVE ID: CVE-2019-16916 State: REJECTED Published: 2019-09-30T13:20:25 Last Updated: 2019-09-30T13:20:25 Description: No description available.
CVE ID: CVE-2019-16917 State: PUBLISHED Published: 2019-10-17T17:42:46 Last Updated: 2024-08-05T01:24:48.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. The uid and domain parameters are used, unsanitized, in a SQL query constructed in the buildSearchWhereClause function. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-sql-injection - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-
-injection - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html
CVE ID: CVE-2019-16919 State: PUBLISHED Published: 2019-10-18T11:59:57 Last Updated: 2024-08-05T01:24:48.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account. Additional Analyst Notes: - CVE Program Container: References: - https://landscape.cncf.io/selected=harbor - http://www.vmware.com/security/advis
- CVE Program Container: References: - https://landscape.cncf.io/selected=harbor - http://www.vmware.com/security/advisories/VMSA-2019-0016.html - https://github.com/goharbor/harbor/security/advisories/GHSA-x2r2-w9c7-h624
CVE ID: CVE-2019-16920 State: PUBLISHED Published: 2019-09-27T11:34:12.000Z Last Updated: 2025-10-21T23:45:29.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. Additional Analyst Notes: - CVE Program Con
also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/zeroday/FG-VD-19-117 - https://www.seebug.org/vuldb/ssvid-98079 - https://medium.com/%4080vul/determine-the-device-model-affected-by-cve-2019-16920-by-zoomeye-bf6fec7f9bb3 - https://www.kb.cert.org/vuls/id/766427
CVE ID: CVE-2019-16921 State: PUBLISHED Published: 2019-09-27T12:07:23 Last Updated: 2024-08-05T01:24:48.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which might allow attackers to obtain sensitive information from kernel stack memory, aka CID-df7e40425813. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/df7e40425813c50cd252e6f5e348a81ef1acae56 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=df7e40425813c50cd252e6f5e348a81ef1acae56
CVE ID: CVE-2019-16922 State: PUBLISHED Published: 2019-09-27T15:12:33 Last Updated: 2024-08-05T01:24:48.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files. Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_8
CVE ID: CVE-2019-16923 State: PUBLISHED Published: 2019-09-27T16:51:24 Last Updated: 2024-08-05T01:24:48.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: kkcms 1.3 has jx.php?url= XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wangyifani/kkcms/issues/2
CVE ID: CVE-2019-16924 State: PUBLISHED Published: 2019-09-27T17:05:28 Last Updated: 2024-08-05T01:24:48.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers (after sniffing the network) to take control of the lock. Additional Analyst Notes: - CVE Program Container: References: - http://www.netfairy.net/?post=311
CVE ID: CVE-2019-16925 State: PUBLISHED Published: 2019-09-27T23:32:28 Last Updated: 2024-08-05T01:24:48.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full access Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2019/09/flower-100-has-xss-via-name-parameter.html
CVE ID: CVE-2019-16926 State: PUBLISHED Published: 2019-09-27T23:31:04 Last Updated: 2024-08-05T01:24:48.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full access Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2019/09/flower-100-has-xss-via-crafted-worker.html
CVE ID: CVE-2019-16927 State: PUBLISHED Published: 2019-09-27T19:57:04 Last Updated: 2024-08-05T01:24:48.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc, a different vulnerability than CVE-2019-9877. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41885
CVE ID: CVE-2019-16928 State: PUBLISHED Published: 2019-09-27T20:07:12.000Z Last Updated: 2025-10-21T23:45:29.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html - https://bugs.exim.org/show_bug.cgi?id=2449 - https://git.exim.org/exim.git/commit/478effbfd9c3cc5a627fc671d4bf94d13670d65f - http://www.openwall.com/lists/oss-sec
- https://git.exim.org/exim.git/commit/478effbfd9c3cc5a627fc671d4bf94d13670d65f - http://www.openwall.com/lists/oss-security/2019/09/28/1 - http://www.openwall.com/lists/oss-security/2019/09/28/2 - http://www.openwall.com/lists/oss-security/2019/09/28/3 - https://www.debian.org/security/2019/dsa-4536 - https://usn.ubuntu.com/4141-1/ - http://www.openwall.com/lists/oss-security/2019/09/28/4 - https://seclists.org/bugtraq/2019/Sep/60 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3TJW4HPYH3O5HZCWGD6NSHTEBTTAPDC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UY6HPRW7MR3KBQ5JFHH6OXM7YCZBJCO
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UY6HPRW7MR3KBQ5JFHH6OXM7YCZBJCOB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EED7HM3MFIBAP5OIMJAFJ35JAJABTVSC/ - https://security.gentoo.org/glsa/202003-47
CVE ID: CVE-2019-16929 State: PUBLISHED Published: 2019-10-08T12:06:31 Last Updated: 2024-08-05T01:24:48.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens. Additional Analyst Notes: - CVE Program Container: References: - https://auth0.com/docs/security/bulletins/cve-2019-16929
CVE ID: CVE-2019-16930 State: PUBLISHED Published: 2019-09-28T21:07:07 Last Updated: 2024-08-05T01:24:48.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during deserialization of note plaintexts. This affects anyone who has disclosed their zaddr to a third party. Additional Analyst Notes: - CVE Program Container: References: - https://z.cash/support/security/announcements/security-announcement-2019-09-24/ - https://github.com/zcash/zcash/commit/c1fbf8ab5d73cff5e1f45236995857c75ba4128d - https://github.com/zcash/zcash/releases/tag/
://github.com/zcash/zcash/commit/c1fbf8ab5d73cff5e1f45236995857c75ba4128d - https://github.com/zcash/zcash/releases/tag/v2.0.7-3 - http://duke.leto.net/2019/10/01/zcash-metadata-leakage-cve-2019-16930.html
CVE ID: CVE-2019-16931 State: PUBLISHED Published: 2019-10-03T18:34:45 Last Updated: 2024-08-05T01:24:48.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/visualizer/#develo
ation. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/visualizer/#developers - https://wpvulndb.com/vulnerabilities/9893 - https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf
CVE ID: CVE-2019-16932 State: PUBLISHED Published: 2019-09-30T15:08:55 Last Updated: 2024-08-05T01:24:48.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9892 - https://wordpress.org/plugins/visualizer/#developers - https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf
CVE ID: CVE-2019-16935 State: PUBLISHED Published: 2019-09-28T01:33:02 Last Updated: 2024-08-05T01:24:48.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4151-1/ - https://usn.ubuntu.com/4151-2/ - http://lists.opensuse.or
gram Container: References: - https://usn.ubuntu.com/4151-1/ - https://usn.ubuntu.com/4151-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/ - https://lists.fedoraproject.or
st/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap
ssage/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://bugs.python.org/issue38243 - https://github.com/python/cpython/pull/16373 - https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213 - https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a
e0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213 - https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897 - https://security.netapp.com/advisory/ntap-20191017-0004/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
CVE ID: CVE-2019-16941 State: PUBLISHED Published: 2019-09-28T15:49:09 Last Updated: 2024-08-05T01:24:48.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call). Additional Analyst Notes: - CVE Program
ly modified by an attacker (for example, to make a java.lang.Runtime.exec call). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NationalSecurityAgency/ghidra/issues/1090 - https://github.com/NationalSecurityAgency/ghidra/blob/79d8f164f8bb8b15cfb60c5d4faeb8e1c25d15ca/Ghidra/Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java#L187-L188 - https://github.com/purpleracc00n/CVE-2019-16941 - https://github.com/NationalSecurityAgency/ghidra/commit/a17728f8c12effa171b17a25ccfb7e7d9528c5d0 - https://www.symantec.com/security-center/vulnerabilities/writeup/110223?om_rssid=sr-advisories - https://twitter.com/NSAGov/status/1178812
ec.com/security-center/vulnerabilities/writeup/110223?om_rssid=sr-advisories - https://twitter.com/NSAGov/status/1178812792159248385
CVE ID: CVE-2019-16942 State: PUBLISHED Published: 2019-10-01T16:04:26 Last Updated: 2024-08-05T01:24:48.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUse