Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17362 State: PUBLISHED Published: 2019-10-09T00:00:00 Last Updated: 2024-11-15T15:03:01.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.142995 - https://github.com/libtom/libtomcrypt/issues/507 - https://github.c
chment: References: - https://vuldb.com/?id.142995 - https://github.com/libtom/libtomcrypt/issues/507 - https://github.com/libtom/libtomcrypt/pull/508 - https://lists.debian.org/debian-lts-announce/2019/10/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
CVE ID: CVE-2019-17364 State: PUBLISHED Published: 2019-12-13T20:45:21 Last Updated: 2024-08-05T01:40:15.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: The processCommandUploadLog() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE ID: CVE-2019-17365 State: PUBLISHED Published: 2019-10-09T21:19:13 Last Updated: 2024-08-05T01:40:15.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/10/09/4 - http://www.openwall.com/lists/oss-security/2019/10/10/1 - http://www.openwall.com/lists/oss-security/2019/10/17/3
CVE ID: CVE-2019-17366 State: PUBLISHED Published: 2019-10-09T21:12:28 Last Updated: 2024-08-05T01:40:15.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX261735
CVE ID: CVE-2019-17367 State: PUBLISHED Published: 2019-10-18T16:19:56 Last Updated: 2024-08-05T01:40:15.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openwrt/luci/commit/f8c6eb67cd9da09ee20248fec6ab742069635e47
CVE ID: CVE-2019-17368 State: PUBLISHED Published: 2019-10-09T10:55:36 Last Updated: 2024-08-05T01:40:15.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Gitaddy/vluns/blob/master/S-CMS.md
CVE ID: CVE-2019-17369 State: PUBLISHED Published: 2019-10-09T10:55:46 Last Updated: 2024-08-05T01:40:15.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Gitaddy/vluns/blob/master/Otcms-CSRF.md
CVE ID: CVE-2019-17370 State: PUBLISHED Published: 2019-10-09T11:04:25 Last Updated: 2024-08-05T01:40:15.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/**/outfile" manipulation. Therefore, the attacker can create a .php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Gitaddy/vluns/blob/master/Otcms-getshell.md
CVE ID: CVE-2019-17371 State: PUBLISHED Published: 2019-10-09T12:07:22 Last Updated: 2024-08-05T01:40:15.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: gif2png 2.5.13 has a memory leak in the writefile function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glennrp/libpng/issues/307 - https://github.com/glennrp/libpng/issues/307#issuecomment-544779431 - https://gitlab.com/esr/gif2png/issues/8
CVE ID: CVE-2019-17372 State: PUBLISHED Published: 2019-10-09T12:06:57 Last Updated: 2024-08-05T01:40:15.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3,
R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md
CVE ID: CVE-2019-17373 State: PUBLISHED Published: 2019-10-09T12:07:13 Last Updated: 2024-08-05T01:40:15.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, and WNR834Bv2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zer0yu/CVE_Request/blob/master/netgear/Netgear_web_interface_exists_authentication_bypass.md
CVE ID: CVE-2019-17375 State: PUBLISHED Published: 2019-10-09T15:08:35 Last Updated: 2024-08-05T01:40:15.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-17376 State: PUBLISHED Published: 2019-10-09T15:09:21 Last Updated: 2024-08-05T01:40:15.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-17377 State: PUBLISHED Published: 2019-10-09T15:10:01 Last Updated: 2024-08-05T01:40:15.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-17378 State: PUBLISHED Published: 2019-10-09T15:10:42 Last Updated: 2024-08-05T01:40:15.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-17379 State: PUBLISHED Published: 2019-10-09T15:11:19 Last Updated: 2024-08-05T01:40:15.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-17380 State: PUBLISHED Published: 2019-10-09T15:11:55 Last Updated: 2024-08-05T01:40:15.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528). Additional Analyst Notes: - CVE Program Container: References: - https://documentation.cpanel.net/display/CL/82+Change+Log
CVE ID: CVE-2019-17382 State: PUBLISHED Published: 2019-10-09T00:00:00 Last Updated: 2024-08-05T01:40:15.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47467 - https://lists.debian.org/debian-lts-announce/2023/08/ms
ainer: References: - https://www.exploit-db.com/exploits/47467 - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE ID: CVE-2019-17383 State: PUBLISHED Published: 2019-10-09T14:54:40 Last Updated: 2024-08-05T01:40:15.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://rubygems.org/gems/netaddr/versions - https://github.com/dspinhirne/netaddr-rb/commit/3aac46c00a36e71905eaa619cb94d45bff6e3b51
CVE ID: CVE-2019-17384 State: PUBLISHED Published: 2019-10-09T15:38:06 Last Updated: 2024-08-05T01:40:15.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: The animate-it plugin before 2.3.4 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/animate-it/#developers - https://wpvulndb.com/vulnerabilities/9900
CVE ID: CVE-2019-17385 State: PUBLISHED Published: 2019-10-09T15:38:44 Last Updated: 2024-08-05T01:40:15.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: The animate-it plugin before 2.3.5 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/animate-it/#developers - https://wpvulndb.com/vulnerabilities/9900
CVE ID: CVE-2019-17386 State: PUBLISHED Published: 2019-10-10T20:03:46 Last Updated: 2024-08-05T01:40:15.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/animate-it/#developers - https://www.pluginvulnerabilities.com/2019/07/29/vulnerability-details-cross-site-request-forgery-csrf-cross-site-scripting-xss-in-animate-it/ - https://plugins.trac.wordpress.org/changeset?old_path=%2Fanimate-it%2Ftags%2F2.3.6%2Fedsanimate.php&old=2129363&new_path=%2Fanimate-it%2Ftags%2F2.3.5%2Fedsanimate.php - https://wpvulndb.com
Ftags%2F2.3.6%2Fedsanimate.php&old=2129363&new_path=%2Fanimate-it%2Ftags%2F2.3.5%2Fedsanimate.php - https://wpvulndb.com/vulnerabilities/9900
CVE ID: CVE-2019-17387 State: PUBLISHED Published: 2019-12-05T17:07:48 Last Updated: 2024-08-05T01:40:15.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html - https://immersivelabs.com/blog/ - https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/
CVE ID: CVE-2019-17388 State: PUBLISHED Published: 2019-12-05T17:08:39 Last Updated: 2024-08-05T01:40:15.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html - https://immersivelabs.com/blog/ - https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/
CVE ID: CVE-2019-17389 State: PUBLISHED Published: 2019-10-09T16:06:55 Last Updated: 2024-08-05T01:40:15.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: In RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker (via a large packet) to prevent a RIOT MQTT-SN client from working until the device is restarted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/pull/12382
CVE ID: CVE-2019-17390 State: PUBLISHED Published: 2019-12-18T22:31:34 Last Updated: 2024-08-05T01:40:15.209Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Outlook add-in in Pronestor Planner before 8.1.77. There is local privilege escalation in the Health Monitor service because PronestorHealthMonitor.exe access control is mishandled, aka PNB-2359. Additional Analyst Notes: - CVE Program Container: References: - https://improsec.com - http://help.pronestor.com/download/PronestorBooking/ReleaseNotes/ReleaseNotes.htm
CVE ID: CVE-2019-17391 State: PUBLISHED Published: 2019-11-14T20:34:03 Last Updated: 2024-08-05T01:40:15.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and secure boot keys, by injecting a glitch into the power supply of the chip shortly after reset. Additional Analyst Notes: - CVE Program Container: References: - https://www.espressif.com/en/news/Security_Advisory_Concerning_Fault_Injec
Notes: - CVE Program Container: References: - https://www.espressif.com/en/news/Security_Advisory_Concerning_Fault_Injection_and_eFuse_Protections
CVE ID: CVE-2019-17392 State: PUBLISHED Published: 2019-11-26T17:30:00 Last Updated: 2024-08-05T01:40:15.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019
CVE ID: CVE-2019-17393 State: PUBLISHED Published: 2019-10-18T16:04:41 Last Updated: 2024-08-05T01:40:15.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and password. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Oct/33 - http://packetstormsecurity.com/files/154873/Tomedo-Server-1.7.3-Information-Disclosure-Weak-Cryptography.html
CVE ID: CVE-2019-17394 State: PUBLISHED Published: 2019-10-15T20:59:54 Last Updated: 2024-08-05T01:40:15.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/h8v0qxZH
CVE ID: CVE-2019-17395 State: PUBLISHED Published: 2019-10-15T21:07:47 Last Updated: 2024-08-05T01:40:15.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/8dvs5RcJ
CVE ID: CVE-2019-17396 State: PUBLISHED Published: 2019-10-15T20:52:45 Last Updated: 2024-08-05T01:40:15.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/9VBiRpAR
CVE ID: CVE-2019-17397 State: PUBLISHED Published: 2019-10-15T14:42:38 Last Updated: 2024-08-05T01:40:15.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/hGg5efMe
CVE ID: CVE-2019-17398 State: PUBLISHED Published: 2019-10-15T20:38:26 Last Updated: 2024-08-05T01:40:15.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log during authentication, and may be available to attackers via logcat. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/5ZDDCqgL
CVE ID: CVE-2019-17399 State: PUBLISHED Published: 2019-10-09T17:20:24 Last Updated: 2024-08-05T01:40:15.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment. Additional Analyst Notes: - CVE Program Container: References: - https://www.joomlashack.com/changelog/shack-forms/
CVE ID: CVE-2019-17400 State: PUBLISHED Published: 2019-10-21T22:06:04 Last Updated: 2024-08-05T01:40:15.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/unoconv/unoconv/pull/510 - https://buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions/
CVE ID: CVE-2019-17401 State: PUBLISHED Published: 2019-10-09T18:21:18 Last Updated: 2024-11-15T15:02:13.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyal liblnk 20191006 has a heap-based buffer over-read in the network_share_name_offset>20 code block of liblnk_location_information_read_data in liblnk_location_information.c, a different issue than CVE-2019-17264. NOTE: the vendor has disputed this as described in the GitHub issue Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libyal/liblnk/issues/40
CVE ID: CVE-2019-17402 State: PUBLISHED Published: 2019-10-09T00:00:00 Last Updated: 2024-08-05T01:40:15.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/1019 - https://usn.ubuntu.com/4159-1/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00001.html - https://lists.debian.org/debian-lts-announce/2023/01/msg00004
sts.debian.org/debian-lts-announce/2019/12/msg00001.html - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE ID: CVE-2019-17403 State: PUBLISHED Published: 2019-11-25T14:43:01 Last Updated: 2024-08-05T01:40:15.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nokia IMPACT < 18A: An unrestricted File Upload vulnerability was found that may lead to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.nokia.com/networks/solutions/impact-iot-platform/ - https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html
CVE ID: CVE-2019-17404 State: PUBLISHED Published: 2019-11-25T14:48:10 Last Updated: 2024-08-05T01:40:15.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nokia IMPACT < 18A: allows full path disclosure Additional Analyst Notes: - CVE Program Container: References: - https://www.nokia.com/networks/solutions/impact-iot-platform/ - https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html
CVE ID: CVE-2019-17405 State: PUBLISHED Published: 2019-11-25T14:53:32 Last Updated: 2024-08-05T01:40:15.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nokia IMPACT < 18A: has Reflected self XSS Additional Analyst Notes: - CVE Program Container: References: - https://www.nokia.com/networks/solutions/impact-iot-platform/ - https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html
CVE ID: CVE-2019-17406 State: PUBLISHED Published: 2019-11-25T15:03:36 Last Updated: 2024-08-05T01:40:15.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743 Additional Analyst Notes: - CVE Program Container: References: - https://www.nokia.com/networks/solutions/impact-iot-platform/ - https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html
CVE ID: CVE-2019-17408 State: PUBLISHED Published: 2019-10-14T11:43:05 Last Updated: 2024-08-05T01:40:15.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed via manipulations such as strtr. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Tardis07/CVE_GO/blob/master/zzzphp_code_execution_v1.7.3.md
CVE ID: CVE-2019-17409 State: PUBLISHED Published: 2019-10-21T00:11:32 Last Updated: 2024-08-05T01:40:15.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/pull/2712/files - https://github.com/lodestone-security/CVEs/blob/master/CVE-2019-17409/README.md
CVE ID: CVE-2019-17414 State: PUBLISHED Published: 2019-10-09T21:52:29 Last Updated: 2024-08-05T01:40:15.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service ("vn_get_string error: Resource temporarily unavailable" error and daemon crash) via a long URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tinylcy/vino/issues/9