Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-19826 State: PUBLISHED Published: 2019-12-16T22:21:59 Last Updated: 2024-08-05T02:25:12.689Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion. Code execution might also be possible. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/project/views_dynamic_fields/issues/3056600
CVE ID: CVE-2019-19829 State: PUBLISHED Published: 2019-12-18T17:15:19 Last Updated: 2024-08-05T02:25:12.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 and CVE-2019-13182. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/155708/Serv-U-FTP-Server-15.1.7-Cross-Site-Scripting.html
CVE ID: CVE-2019-19830 State: PUBLISHED Published: 2019-12-17T04:33:32 Last Updated: 2024-08-05T02:25:12.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4583 - https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-sortie-de-SPIP-3-2-7-SPIP-3-1-12.html - https://zone.spip.net/trac/spip-zone/changeset/118898/spip-zone/_core_/plugins/medias - https://git.spip.net/SPIP/spip/commit/8eb11ba132b92696eb34d606d71aa8edf40e0f69 - https://usn.ubuntu.com/4536-1/
CVE ID: CVE-2019-19832 State: PUBLISHED Published: 2019-12-18T17:12:49 Last Updated: 2024-08-05T02:25:12.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The frmUserName value must have a unique name.) Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/155709/Xerox-AltaLink-C8035-Printer-Cross-Site-Request-Forgery.html
CVE ID: CVE-2019-19833 State: PUBLISHED Published: 2019-12-18T17:08:42 Last Updated: 2024-08-05T02:25:12.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Tautulli/Tautulli/compare/v2.1.9...v2.1.10-beta - http://packetstormsecurity.com/files/155710/Tautulli-2.1.9-Cross-Site-Request-Forgery.html - http://packetstormsecurity.com/files/155974/Tautulli-2.1.9-Denial-Of-Service.html
CVE ID: CVE-2019-19834 State: PUBLISHED Published: 2020-01-22T18:09:32 Last Updated: 2024-08-05T02:25:12.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script->exec with ../../../bin/sh as the parameter. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19835 State: PUBLISHED Published: 2020-01-23T12:44:48 Last Updated: 2024-08-05T02:25:12.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19836 State: PUBLISHED Published: 2020-01-22T18:13:49 Last Updated: 2024-08-05T02:25:12.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write to a specified filename. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19837 State: PUBLISHED Published: 2020-01-23T12:26:59 Last Updated: 2024-08-05T02:25:12.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19838 State: PUBLISHED Published: 2020-01-23T13:41:10 Last Updated: 2024-08-05T02:25:12.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/_cmdstat.jsp via the uploadFile attribute. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19839 State: PUBLISHED Published: 2020-01-23T13:42:32 Last Updated: 2024-08-05T02:25:12.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/_cmdstat.jsp via the uploadFile attribute. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19840 State: PUBLISHED Published: 2020-01-22T20:32:36 Last Updated: 2024-08-05T02:25:12.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19841 State: PUBLISHED Published: 2020-01-22T20:29:54 Last Updated: 2024-08-05T02:25:12.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admin/_cmdstat.jsp via the mac attribute. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19842 State: PUBLISHED Published: 2020-01-22T20:31:11 Last Updated: 2024-08-05T02:25:12.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to admin/_cmdstat.jsp via the mac attribute. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19843 State: PUBLISHED Published: 2020-01-22T18:48:04 Last Updated: 2024-08-05T02:25:12.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache. Additional Analyst Notes: - CVE Program Container: References: - https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html - https://www.ruckuswireless.com/security/299/view/txt - https://alephsecurity.com/2020/01/14/ruckus-wireless
CVE ID: CVE-2019-19844 State: PUBLISHED Published: 2019-12-18T18:07:11 Last Updated: 2024-08-05T02:25:12.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.) Additional Analyst Notes: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/release
address.) Additional Analyst Notes: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0 - https://www.djangoproject.com/weblog/2019/dec/18/security-releases/ - https://usn.ubuntu.com/4224-1/ - https://www.debian.org/security/2020/dsa-4598 - https://seclists.org/bugtraq/2020/Jan/9 - http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html - https://security.netapp.com/advisory/ntap-20200110-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/ - https://security.gentoo.org/glsa/202
kage-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD/ - https://security.gentoo.org/glsa/202004-17
CVE ID: CVE-2019-19845 State: PUBLISHED Published: 2019-12-18T03:48:08 Last Updated: 2024-08-05T02:25:12.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/796-20191201-core-path-disclosure-in-logger-class
CVE ID: CVE-2019-19846 State: PUBLISHED Published: 2019-12-18T03:49:04 Last Updated: 2024-08-05T02:25:12.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/797-20191202-core-various-sql-injections-through-configuration-parameters
CVE ID: CVE-2019-19847 State: PUBLISHED Published: 2019-12-17T15:04:52 Last Updated: 2024-08-05T02:25:12.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fontforge/libspiro/issues/21
CVE ID: CVE-2019-19848 State: PUBLISHED Published: 2019-12-17T16:02:50 Last Updated: 2024-08-05T02:25:12.771Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.) Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/securit
rivileges are also required.) Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-core-sa-2019-024/ - https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security
CVE ID: CVE-2019-19849 State: PUBLISHED Published: 2019-12-17T16:03:31 Last Updated: 2024-08-05T02:25:12.712Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action
er who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-core-sa-2019-026/ - https://review.typo3.org/q/%2522Resolves:+%252389005%2522+topic:security
CVE ID: CVE-2019-19850 State: PUBLISHED Published: 2019-12-17T16:03:15 Last Updated: 2024-08-05T02:25:12.897Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:L/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-core-sa-2019
Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-core-sa-2019-025/ - https://review.typo3.org/q/%2522Resolves:+%252389452%2522+topic:security
CVE ID: CVE-2019-19851 State: PUBLISHED Published: 2020-03-16T15:07:37 Last Updated: 2024-08-05T02:25:12.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta URI. This affects Superfecta through 13.0.4.7, 14.x through 14.0.24, and 15.x through 15.0.2.20. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities - https://wiki.freepbx.org/display/FOP/2020-01-09+XSS+Injection+vulnerability+in+Superfecta+Module
CVE ID: CVE-2019-19852 State: PUBLISHED Published: 2020-03-16T20:36:44 Last Updated: 2024-08-05T02:25:12.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities - https://wiki.freepbx.org/display/FOP/2020-01-09+XSS+Injection+vulnerability+in+Call+Event+Logging+modu
Vulnerabilities - https://wiki.freepbx.org/display/FOP/2020-01-09+XSS+Injection+vulnerability+in+Call+Event+Logging+module
CVE ID: CVE-2019-19854 State: PUBLISHED Published: 2020-01-15T22:51:42 Last Updated: 2024-08-05T02:25:12.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the Origin header (which must match the request origin). This is problematic in conjunction with XSS: one can escalate privileges from User level to Administrator. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/news.php
CVE ID: CVE-2019-19855 State: PUBLISHED Published: 2020-01-15T22:50:28 Last Updated: 2024-08-05T02:25:12.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/list_user allows stored XSS via the auth_type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/news.php - https://github.com/SerpicoProject/Serpico/commit/270f05ca6e51c87bb0867abb0511b61bf2aae182
CVE ID: CVE-2019-19856 State: PUBLISHED Published: 2020-01-15T22:49:10 Last Updated: 2024-08-05T02:25:12.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin/list_user page allows stored XSS via the type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/news.php - https://github.com/SerpicoProject/Serpico/commit/270f05ca6e51c87bb0867abb0511b61bf2aae182
CVE ID: CVE-2019-19857 State: PUBLISHED Published: 2020-01-15T22:47:27 Last Updated: 2024-08-05T02:32:08.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring the admin to enter an Old Password value on the Change Password screen does not enhance security. This is problematic in conjunction with XSS. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/news.php
CVE ID: CVE-2019-19858 State: PUBLISHED Published: 2020-01-15T22:46:09 Last Updated: 2024-08-05T02:32:08.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/add_user/UID allows stored XSS via the author parameter. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/news.php - https://github.com/SerpicoProject/Serpico/commit/270f05ca6e51c87bb0867abb0511b61bf2aae182
CVE ID: CVE-2019-19859 State: PUBLISHED Published: 2020-01-15T22:43:59 Last Updated: 2024-08-05T02:32:08.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The Add Collaborator allows unlimited data via the author parameter, even if the data does not match anything in the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.websec.nl/news.php
CVE ID: CVE-2019-19861 State: REJECTED Published: 2020-01-06T17:36:15 Last Updated: 2020-01-06T17:36:15 Description: No description available.
CVE ID: CVE-2019-19862 State: REJECTED Published: 2020-01-06T17:38:52 Last Updated: 2020-01-06T17:38:52 Description: No description available.
CVE ID: CVE-2019-19863 State: REJECTED Published: 2020-01-06T17:39:43 Last Updated: 2020-01-06T17:39:43 Description: No description available.
CVE ID: CVE-2019-19864 State: REJECTED Published: 2020-01-06T17:40:09 Last Updated: 2020-01-06T17:40:09 Description: No description available.
CVE ID: CVE-2019-19865 State: PUBLISHED Published: 2020-02-21T15:23:26 Last Updated: 2024-08-05T02:32:08.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored XSS payload. Additional Analyst Notes: - CVE Program Container: References: - https://unify.com/en/support/security-advisories - https://networks.unify.com/security/advisories/OBSO-2002-01.pdf
CVE ID: CVE-2019-19866 State: PUBLISHED Published: 2020-02-21T15:22:24 Last Updated: 2024-08-05T02:32:08.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with their numbers and access PINs. Additional Analyst Notes: - CVE Program Container: References: - https://unify.com/en/support/security-advisories - https://networks.unify.com/security/advisories/OBSO-2002-01.pdf
CVE ID: CVE-2019-19869 State: PUBLISHED Published: 2020-11-27T14:06:07 Last Updated: 2024-08-05T02:32:08.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. PVs could be changed (unencrypted) by using the IosHttp service and the JSON interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/BRP44400000000000000585952/APROL_R42_A1_ReleaseNotes_001.pdf
CVE ID: CVE-2019-19872 State: PUBLISHED Published: 2020-11-27T14:08:11 Last Updated: 2024-08-05T02:32:08.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject and execute arbitrary unintended commands via an unspecified attack scenario, a different vulnerability than CVE-2019-16364. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/BRP44400000000000000585952/APROL_R42_A1_ReleaseNotes_001.pdf
CVE ID: CVE-2019-19873 State: PUBLISHED Published: 2020-11-27T16:18:34 Last Updated: 2024-08-05T02:32:08.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the AprolSqlServer DBMS by bypassing authentication, a different vulnerability than CVE-2019-16356 and CVE-2019-9983. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/BRP44400000000000000585952/APROL_R42_A1_ReleaseNotes_001.pdf
CVE ID: CVE-2019-19874 State: PUBLISHED Published: 2020-11-27T16:20:06 Last Updated: 2024-08-05T02:32:08.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrary unintended commands on the web server, a different vulnerability than CVE-2019-16364. Additional Analyst Notes: - CVE Program Container: References: - https://www.br-automation.com/downloads_br_productcatalogue/BRP44400000000000000585952/APROL_R42_A1_ReleaseNotes_001.pdf