Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15300 State: PUBLISHED Published: 2019-11-27T13:23:56 Last Updated: 2024-08-05T00:42:03.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://www.certilience.fr/2019/08/CVE-2019-15300-vulnerabilit%C3%A9-centreon-sql-injection - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html - https://github.com/centreon/ce
://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html - https://github.com/centreon/centreon/pull/8008 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html - https://github.com/centreon/centreon/pull/8009 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html
CVE ID: CVE-2019-15301 State: PUBLISHED Published: 2019-09-18T20:59:18 Last Updated: 2024-08-05T00:42:03.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to execute arbitrary SQL commands via the value parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40sorokinpf/bpmonline-sql-injection-607916447e30
CVE ID: CVE-2019-15302 State: PUBLISHED Published: 2019-09-11T20:38:31 Last Updated: 2024-08-05T00:42:03.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki-labs/cryptpad/commits/staging - https://github.com/xwiki-labs/cryptpad/releases/tag/3.0.0
CVE ID: CVE-2019-15304 State: PUBLISHED Published: 2019-08-26T12:35:53 Last Updated: 2024-08-05T00:42:03.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented access-point configuration page located on the device. This wifi thermometer app requests and requires excessive permissions to operate such as Fine GPS location, camera, applists, Serial number, IMEI. In addition to the "backdoor" login access for "admin" purposes, this accompanying app also establishes connections with several
ion to the "backdoor" login access for "admin" purposes, this accompanying app also establishes connections with several china based URLs to include Alibaba cloud computing. NOTE: this device also ships with ProGrade branding. Additional Analyst Notes: - CVE Program Container: References: - http://progradegrill.com/wifi-grilling-thermometer/ - http://seclists.org/fulldisclosure/2019/Aug/24 - http://packetstormsecurity.com/files/154221/ProGrade-Lierda-Grill-Temperature-1.00_50006-Hardcoded-Credentials.html - https://www.joesandbox.com/analysis/287596/0/html
CVE ID: CVE-2019-15310 State: PUBLISHED Published: 2020-07-01T19:18:50 Last Updated: 2024-08-05T00:42:03.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attacker could retrieve the AWS key from the firmware and obtain full control over Linkplay's AWS estate, including S3 buckets containing device firmware. When combined with an OS command injection vulnerability within the XML Parsing logic of the firmware update process, an attacker would be able to gain code execution on any device that attempted to update. Note that by default all devices te
ttacker would be able to gain code execution on any device that attempted to update. Note that by default all devices tested had automatic updates enabled. Additional Analyst Notes: - CVE Program Container: References: - https://labs.mwrinfosecurity.com/advisories/ - https://linkplay.com/featured-products/ - https://labs.f-secure.com/advisories/linkplay-firmware-wanlan-remote-code-execution/
CVE ID: CVE-2019-15311 State: PUBLISHED Published: 2020-07-01T19:21:52 Last Updated: 2024-08-05T00:42:03.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command execution vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://labs.mwrinfosecurity.com/advisories/ - https://linkplay.com/featured-products/ - https://labs.f-secure.com/advisories/linkplay-firmware-wa
ty.com/advisories/ - https://linkplay.com/featured-products/ - https://labs.f-secure.com/advisories/linkplay-firmware-wanlan-remote-code-execution/
CVE ID: CVE-2019-15312 State: PUBLISHED Published: 2020-07-01T19:23:25 Last Updated: 2024-08-05T00:42:03.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The device was found to be vulnerable to DNS rebinding. Combined with one of the many /httpapi.asp endpoint command-execution security issues, the DNS rebinding attack could allow an attacker to compromise the victim device from the Internet. Additional Analyst Notes: - CVE Program Container: References: - https://labs.mwrinfosecurity.com/advisories/ - https://linkplay.com/featured-products/ - https://labs.f-secu
ferences: - https://labs.mwrinfosecurity.com/advisories/ - https://linkplay.com/featured-products/ - https://labs.f-secure.com/advisories/linkplay-firmware-wanlan-remote-code-execution/
CVE ID: CVE-2019-15313 State: PUBLISHED Published: 2020-01-27T18:20:27 Last Updated: 2024-08-05T00:42:03.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://bugzilla.zimbra.com/show_bug.cgi?id=109141
CVE ID: CVE-2019-15314 State: PUBLISHED Published: 2019-08-22T12:15:31 Last Updated: 2024-08-05T00:42:03.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/wEM7rnG7
CVE ID: CVE-2019-15315 State: PUBLISHED Published: 2019-08-21T19:35:49 Last Updated: 2024-08-05T00:42:03.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch. Additional Analyst Notes: - CVE Program Container: References: - https://xiaoyinl.github.io/steam_EoP_bypass.html
CVE ID: CVE-2019-15316 State: PUBLISHED Published: 2019-08-21T19:36:06 Last Updated: 2024-08-05T00:42:03.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition. Additional Analyst Notes: - CVE Program Container: References: - https://amonitoring.ru/article/onemore_steam_eop_0day/ - https://habr.com/ru/company/pm/blog/464367/ - https://www.youtube.com/watch?v=I93aH86BUaE - https://www.youtube.com/watch?v=ZCHrjP0cMew
CVE ID: CVE-2019-15317 State: PUBLISHED Published: 2019-08-22T12:21:55 Last Updated: 2024-08-05T00:42:03.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: The give plugin before 2.4.7 for WordPress has XSS via a donor name. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/give/#developers - https://blog.sucuri.net/2019/05/wordpress-plugin-give-stored-xss-for-donors.html - https://wpvulndb.com/vulnerabilities/9584
CVE ID: CVE-2019-15318 State: PUBLISHED Published: 2019-08-22T12:43:55 Last Updated: 2024-08-05T00:42:03.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/yikes-inc-easy-mailchimp-extender/#developers - https://wpvulndb.com/vulnerabilities/9583
CVE ID: CVE-2019-15319 State: PUBLISHED Published: 2019-08-22T13:26:22 Last Updated: 2024-08-05T00:42:03.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/option-tree/#developers - https://wpvulndb.com/vulnerabilities/9599
CVE ID: CVE-2019-15320 State: PUBLISHED Published: 2019-08-22T13:27:10 Last Updated: 2024-08-05T00:42:03.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/option-tree/#developers - https://wpvulndb.com/vulnerabilities/9600
CVE ID: CVE-2019-15321 State: PUBLISHED Published: 2019-08-22T13:27:59 Last Updated: 2024-08-05T00:42:03.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/option-tree/#developers - https://wpvulndb.com/vulnerabilities/9600
CVE ID: CVE-2019-15322 State: PUBLISHED Published: 2019-08-22T13:31:18 Last Updated: 2024-08-05T00:42:04.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/shortcode-factory/#developers
CVE ID: CVE-2019-15323 State: PUBLISHED Published: 2019-08-22T13:37:01 Last Updated: 2024-08-05T00:42:03.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ad-inserter plugin before 2.4.20 for WordPress has path traversal. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9453 - https://wordpress.org/plugins/ad-inserter/#developers
CVE ID: CVE-2019-15324 State: PUBLISHED Published: 2019-08-22T13:37:47 Last Updated: 2024-08-05T00:42:03.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9455 - https://wordpress.org/plugins/ad-inserter/#developers
CVE ID: CVE-2019-15325 State: PUBLISHED Published: 2019-08-22T19:13:15 Last Updated: 2024-08-05T00:42:03.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not. Additional Analyst Notes: - CVE Program Container: References: - https://www.kernel.org/doc/Documentation/security/Yama.txt - https://github.com/GalliumOS/galliumos-distro/issues/514
CVE ID: CVE-2019-15326 State: PUBLISHED Published: 2019-08-22T19:10:38 Last Updated: 2024-08-05T00:42:03.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/import-users-from-csv-with-meta/#developers - https://wpvulndb.com/vulnerabilities/9392
CVE ID: CVE-2019-15327 State: PUBLISHED Published: 2019-08-22T19:10:04 Last Updated: 2024-08-05T00:42:03.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/import-users-from-csv-with-meta/#developers
CVE ID: CVE-2019-15328 State: PUBLISHED Published: 2019-08-22T19:09:31 Last Updated: 2024-08-05T00:42:03.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/import-users-from-csv-with-meta/#developers - https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta?rev=2050450
CVE ID: CVE-2019-15329 State: PUBLISHED Published: 2019-08-22T19:08:42 Last Updated: 2024-08-05T00:42:03.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/import-users-from-csv-with-meta/#developers - https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta?rev=2050450
CVE ID: CVE-2019-15330 State: PUBLISHED Published: 2019-08-22T18:59:39 Last Updated: 2024-08-05T00:42:03.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/webp-express/#developers
CVE ID: CVE-2019-15331 State: PUBLISHED Published: 2019-08-22T18:58:22 Last Updated: 2024-08-05T00:42:03.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers
CVE ID: CVE-2019-15332 State: PUBLISHED Published: 2019-11-14T16:15:51 Last Updated: 2024-08-05T00:42:03.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lava Z61 Android device with a build fingerprint of LAVA/Z61_2GB/Z61_2GB:8.1.0/O11019/1533889281:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15333 State: PUBLISHED Published: 2019-11-14T16:24:25 Last Updated: 2024-08-05T00:42:04.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15334 State: PUBLISHED Published: 2019-11-14T16:24:26 Last Updated: 2024-08-05T00:42:03.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lava Iris 88 Go Android device with a build fingerprint of LAVA/iris88_go/iris88_go:8.1.0/O11019/1538188945:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15335 State: PUBLISHED Published: 2019-11-14T16:24:28 Last Updated: 2024-08-05T00:42:03.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/1535088037:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15336 State: PUBLISHED Published: 2019-11-14T16:24:29 Last Updated: 2024-08-05T00:42:03.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lava Z61 Turbo Android device with a build fingerprint of LAVA/Z61_Turbo/Z61_Turbo:8.1.0/O11019/1536917928:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.31) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15337 State: PUBLISHED Published: 2019-11-14T16:24:31 Last Updated: 2024-08-05T00:42:04.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/1532317309:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.31) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15338 State: PUBLISHED Published: 2019-11-14T16:24:32 Last Updated: 2024-08-05T00:42:03.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88_lite/iris88_lite:8.1.0/O11019/1536323070:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware
interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15339 State: PUBLISHED Published: 2019-11-14T16:24:34 Last Updated: 2024-08-05T00:42:03.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/1530331229:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15340 State: PUBLISHED Published: 2019-11-14T16:24:35 Last Updated: 2024-08-05T00:42:03.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india/sakura_india:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app (versionCode=1, versionName=QL1715_201805292006) that allows any app co-located on the device to programmatically disable and enable Wi-Fi, Bluetooth, and GPS without the corresponding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - h
ding access permission through an exported interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15341 State: PUBLISHED Published: 2019-11-14T16:24:37 Last Updated: 2024-08-05T00:42:03.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with i
file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user's Wi-Fi passwords, obtain the user's notifications, read the logca
arty app to factory reset the device, obtain the user's Wi-Fi passwords, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15342 State: PUBLISHED Published: 2019-11-14T16:24:38 Last Updated: 2024-08-05T00:42:04.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.FontCoverService that allows any app co-located on the device to supply arbitrary commands via shell script to be executed as the system user that are triggered by writing an attacker-selected message t