Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-6695 State: PUBLISHED Published: 2019-08-23T20:07:33 Last Updated: 2024-10-25T14:28:38.678Z Vendors: n/a Products: Fortinet FortiManager Problem Types: Execute unauthorized code or commands Description: Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-017
CVE ID: CVE-2019-6696 State: PUBLISHED Published: 2020-03-15T22:03:22 Last Updated: 2024-10-25T14:02:33.188Z Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted request to the admin initial password change webpage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-179
CVE ID: CVE-2019-6697 State: PUBLISHED Published: 2025-03-17T13:40:57.520Z Last Updated: 2025-03-17T17:56:56.460Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-79 Description: An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname parameter of a DHCP packet under DHCP monitor page may allow an unauthenticated attacker in the same network as the FortiGate to perform a Stored Cross Site Scripting attack (XSS) by sending a crafted DHCP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortig
(XSS) by sending a crafted DHCP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-184
CVE ID: CVE-2019-6698 State: PUBLISHED Published: 2019-08-23T19:58:39 Last Updated: 2024-10-25T14:29:00.440Z Vendors: n/a Products: Fortinet FortiRecorder Problem Types: Authentication Controls Bypass Description: Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-185
CVE ID: CVE-2019-6699 State: PUBLISHED Published: 2020-03-13T15:06:42 Last Updated: 2024-10-25T14:02:43.771Z Vendors: Fortinet Products: Fortinet FortiADC Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) via a field in the traffic group interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-220
CVE ID: CVE-2019-6700 State: PUBLISHED Published: 2020-01-07T18:19:04 Last Updated: 2024-10-25T14:04:46.137Z Vendors: n/a Products: Fortinet FortiSIEM Problem Types: Information disclosure Description: An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-100
CVE ID: CVE-2019-6702 State: PUBLISHED Published: 2019-03-17T17:13:13 Last Updated: 2024-08-04T20:31:04.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151524/Qkr-With-MasterPass-Man-In-The-Middle.html - http://seclists.org/fulldisclosure/2019/Feb/21 - https://seclists.org/bugtraq/2019/Feb/28 - https://www.info-sec.ca/advisories/Qkr-MasterCard.html
CVE ID: CVE-2019-6703 State: PUBLISHED Published: 2019-01-27T02:00:00 Last Updated: 2024-08-04T20:31:04.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator. Additional Analyst Notes: - CVE Program Container:
egistration and set the default role for new users to Administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin/ - https://wpvulndb.com/vulnerabilities/9208
CVE ID: CVE-2019-6706 State: PUBLISHED Published: 2019-01-23T00:00:00 Last Updated: 2024-08-04T20:31:04.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.html - https://github.com/Lua-Project/cve-analysis/blob/a43c9ccd00274b31fa2f24c6c8f20ce36655682d/CVE-2019-6706.pdf - https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951
a43c9ccd00274b31fa2f24c6c8f20ce36655682d/CVE-2019-6706.pdf - https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951b306d2ee8ecb71e - http://lua-users.org/lists/lua-l/2019-01/msg00039.html - https://access.redhat.com/security/cve/cve-2019-6706 - https://lists.debian.org/debian-lts-announce/2023/06/msg00031.html
CVE ID: CVE-2019-6707 State: PUBLISHED Published: 2019-01-23T19:00:00 Last Updated: 2024-08-04T20:31:03.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kk98kk0/exploit/issues/1
CVE ID: CVE-2019-6708 State: PUBLISHED Published: 2019-01-23T19:00:00 Last Updated: 2024-08-04T20:31:03.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kk98kk0/exploit/issues/2
CVE ID: CVE-2019-6710 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T20:31:03.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/god3err/status/1088067902832631809 - https://alicangonullu.biz/konu/3 - https://www.exploit-db.com/exploits/46240/
CVE ID: CVE-2019-6713 State: PUBLISHED Published: 2019-01-23T21:00:00 Last Updated: 2024-08-04T20:31:04.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a file_put_contents call. Additional Analyst Notes: - CVE Program Container: References: - http://www.ttk7.cn/post-108.html - https://www.thinkcmf.com/download.html
CVE ID: CVE-2019-6714 State: PUBLISHED Published: 2019-03-17T17:40:33 Last Updated: 2024-08-04T20:31:03.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user. Additional Analyst Notes: - CVE Program Container: Reference
results in remote code execution for an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151628/BlogEngine.NET-3.3.6-Directory-Traversal-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/46353/ - https://blogengine.io/ - https://github.com/rxtur/BlogEngine.NET/ - http://seclists.org/fulldisclosure/2019/Jun/26
CVE ID: CVE-2019-6715 State: PUBLISHED Published: 2019-04-01T19:05:55 Last Updated: 2024-08-04T20:31:03.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data. Additional Analyst Notes: - CVE Program Container: References: - https://vinhjaxt.github.io/2019/03/cve-2019-6715 - http://packetstormsecurity.com/files/160674/WordPress-W3-Total-Cache-0.9.3-File-Read-Directory-Traversal.html
CVE ID: CVE-2019-6716 State: PUBLISHED Published: 2019-03-17T17:50:43 Last Updated: 2024-08-04T20:31:03.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151373/LongBox
st. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151373/LongBox-Limited-Access-Manager-Insecure-Direct-Object-Reference.html - https://www.exploit-db.com/exploits/46254/ - https://www.logonbox.com/en/
CVE ID: CVE-2019-6719 State: PUBLISHED Published: 2019-01-23T22:00:00 Last Updated: 2024-08-04T20:31:04.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/iso_server/iso_server.c, as demonstrated by examples/server_example_goose/server_example_goose.c and examples/server_example_61400_25/server_example_61400_25.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mz-automation/libiec61850/issues/111
CVE ID: CVE-2019-6724 State: PUBLISHED Published: 2019-03-18T19:12:25 Last Updated: 2024-08-04T20:31:04.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root. Additional Analyst Notes: - CVE Program Container: References: - https://campus.barracuda.com/product/networkaccessclient/doc/78154149/release-notes-barracuda-vpn-client-for-linux/ - http://campus.barracuda.com/product/networkaccessclient/doc/78154147/release-notes-barrac
racuda-vpn-client-for-linux/ - http://campus.barracuda.com/product/networkaccessclient/doc/78154147/release-notes-barracuda-vpn-client-for-macos/ - https://blog.mirch.io/2019/02/14/cve-2019-6724-barracuda-vpn-client-privilege-escalation-on-linux-and-macos/
CVE ID: CVE-2019-6725 State: PUBLISHED Published: 2019-05-31T21:27:36 Last Updated: 2024-08-04T20:31:04.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. After accessing the page, the admin user's password can be obtained by viewing the HTML source code, and the interface of the modem can be accessed as admin. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/May/78
CVE ID: CVE-2019-6726 State: PUBLISHED Published: 2019-07-29T15:20:10 Last Updated: 2024-08-04T20:31:04.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-fastest-cache/#developers - https://wordpress.org/plugins/wp-fastest-cache/ - https://www.wpfastestcache.com/ - https://plugins.trac.wordpress.org/browser/wp-fastest-cache/trunk/wpFastestCache.p
/ - https://www.wpfastestcache.com/ - https://plugins.trac.wordpress.org/browser/wp-fastest-cache/trunk/wpFastestCache.php - https://packetstormsecurity.com/files/152042
CVE ID: CVE-2019-6727 State: PUBLISHED Published: 2019-03-19T19:56:00 Last Updated: 2024-08-04T20:31:04.198Z Vendors: Foxit Products: Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA remerge method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was
ns on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7347. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-133/
CVE ID: CVE-2019-6728 State: PUBLISHED Published: 2019-03-19T19:56:01 Last Updated: 2024-08-04T20:31:04.065Z Vendors: Foxit Products: Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilit
sult in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7353. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-134/
CVE ID: CVE-2019-6729 State: PUBLISHED Published: 2019-03-19T19:56:01 Last Updated: 2024-08-04T20:31:04.050Z Vendors: Foxit Products: Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context o
a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7423. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-135/
CVE ID: CVE-2019-6730 State: PUBLISHED Published: 2019-03-19T19:56:01 Last Updated: 2024-08-04T20:31:04.237Z Vendors: Foxit Products: Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the popUpMenu method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was Z
on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7368. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-136/
CVE ID: CVE-2019-6731 State: PUBLISHED Published: 2019-03-19T19:56:01 Last Updated: 2024-08-04T20:31:04.132Z Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code
h can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7369. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-137/
CVE ID: CVE-2019-6732 State: PUBLISHED Published: 2019-03-19T19:56:01 Last Updated: 2024-08-04T20:31:03.997Z Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the AFParseDateEx method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction wi
ed data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7453. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-138/
CVE ID: CVE-2019-6733 State: PUBLISHED Published: 2019-03-19T19:56:01 Last Updated: 2024-08-04T20:31:04.027Z Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulner
can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7576. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-139/
CVE ID: CVE-2019-6734 State: PUBLISHED Published: 2019-03-19T19:56:01 Last Updated: 2024-08-04T20:31:04.146Z Vendors: Foxit Products: PhantomPDF Problem Types: CWE-416 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the setInterval method. By performing actions in JavaScript, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute
to be reused after it has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7452. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-140/
CVE ID: CVE-2019-6735 State: PUBLISHED Published: 2019-03-19T19:56:01 Last Updated: 2024-08-04T20:31:04.188Z Vendors: Foxit Products: Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilit
sult in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7355. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-19-141/
CVE ID: CVE-2019-6736 State: PUBLISHED Published: 2019-06-03T18:07:44 Last Updated: 2024-08-04T20:31:03.794Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bitdefender Products: SafePay Problem Types: CWE-356 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of tiscript. When processing the System.Exec method the application does not properly validate a user-supplied string before using it