Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-3883 State: PUBLISHED Published: 2019-04-17T00:00:00 Last Updated: 2024-08-04T19:19:18.605Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: 389-ds-base Problem Types: CWE-772 Description: In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial o
unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/05/msg00008.html - https://access.redhat.com/errata/RHSA-2019:1896 - https://access.redhat.com/errata/RHSA-2019:3401 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883 - https://pagure.io/389-ds-base/issue/50329 - https://pagure.io/389-ds-base/pull-request/50331 - https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
CVE ID: CVE-2019-3884 State: PUBLISHED Published: 2019-08-01T13:20:50 Last Updated: 2024-08-04T19:19:18.666Z Severity: LOW (CVSS 3.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Red Hat Products: atomic-openshift Problem Types: CWE-290 Description: A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects. Versions 3.6, 3.7, 3.8, 3.9, 3.10, 3.11 and 4.1 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3884
CVE ID: CVE-2019-3885 State: PUBLISHED Published: 2019-04-18T00:00:00 Last Updated: 2024-08-04T19:19:18.606Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: ClusterLabs Products: pacemaker Problem Types: CWE-416 Description: A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClusterLabs/pacemaker/pull/1749 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3885 - http://www.securityfocus.com/bid/108036 - https://usn.ubuntu.com/3952-1/ - https://lists.fedoraprojec
id=CVE-2019-3885 - http://www.securityfocus.com/bid/108036 - https://usn.ubuntu.com/3952-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HR6QUYGML735EI3HEEHYRDW7EG73BUH2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GCWFO7GL6MBU6C4BGFO3P6L77DIBBF3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FY4M4RMIG2POKC6OOFQODGKPRYXHET2F/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00034.html - https://access.redhat.com/errata/RHSA-2019:1278 - https://access.redhat.com/errata/RHSA-2019:1279 - https://security.gentoo.org/gl
cess.redhat.com/errata/RHSA-2019:1278 - https://access.redhat.com/errata/RHSA-2019:1279 - https://security.gentoo.org/glsa/202309-09
CVE ID: CVE-2019-3886 State: PUBLISHED Published: 2019-04-04T00:00:00 Last Updated: 2024-08-04T19:19:18.727Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: The libvirt Project Products: libvirt Problem Types: CWE-862 Description: An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107777 - http://lists.opensuse.org/opensuse-security-announce/2019
ainer: References: - http://www.securityfocus.com/bid/107777 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00105.html - https://usn.ubuntu.com/4021-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5DHYIFECZ7BMVXK4EP4FDFZXK7I5MZH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYMNKXAUBZCFBBPFH64FJPH5EJH4GSU2/ - https://access.redhat.com/errata/RHBA-2019:3723 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3886
CVE ID: CVE-2019-3887 State: PUBLISHED Published: 2019-04-09T00:00:00 Last Updated: 2024-08-04T19:19:18.713Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H) Vendors: The Linux Foundation Products: Kernel Problem Types: CWE-863 Description: A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue. Additional Analyst Notes: - C
resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107850 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWPOIII2L73HV5PGXSGMRMKQIK47UIYE/ - https://usn.ubuntu.com/3980-1/ - https://usn.ubuntu.com/3979-1/ - https://usn.ubuntu.com/3980-2/ - https://access.redhat.com/errata/RHSA-2019:2703 - https://access.redhat.com/errata/RHSA-2019:2741 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3887
CVE ID: CVE-2019-3888 State: PUBLISHED Published: 2019-06-12T13:45:20 Last Updated: 2024-08-04T19:19:18.684Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: undertow Problem Types: CWE-532 Description: A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange) Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3888 - http://www.securityfocus.c
Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3888 - http://www.securityfocus.com/bid/108739 - https://access.redhat.com/errata/RHSA-2019:2439 - https://access.redhat.com/errata/RHSA-2019:2998 - https://access.redhat.com/errata/RHSA-2020:0727 - https://security.netapp.com/advisory/ntap-20220210-0019/
CVE ID: CVE-2019-3889 State: PUBLISHED Published: 2019-07-11T18:27:40 Last Updated: 2024-08-04T19:19:18.683Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: atomic-openshift Problem Types: CWE-79 Description: A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3889 - https:/
nalyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3889 - https://access.redhat.com/errata/RHSA-2019:3722 - https://access.redhat.com/errata/RHSA-2019:3770
CVE ID: CVE-2019-3890 State: PUBLISHED Published: 2019-08-01T13:22:55 Last Updated: 2024-08-04T19:19:18.672Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: The Gnome Project Products: evolution-ews Problem Types: CWE-295, CWE-296 Description: It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3890 - https://gitlab.gnome.org/GNOME/evolution-e
er: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3890 - https://gitlab.gnome.org/GNOME/evolution-ews/issues/27 - https://access.redhat.com/errata/RHSA-2019:3699
CVE ID: CVE-2019-3891 State: PUBLISHED Published: 2019-04-12T20:25:44 Last Updated: 2024-08-04T19:19:18.817Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: candlepin Problem Types: CWE-532 Description: It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching package updates, thus preventing all Satellite hosts from accessing those updates. Additional Analyst Notes: - CVE Program Container: References: -
ting all Satellite hosts from accessing those updates. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3891 - https://access.redhat.com/errata/RHSA-2019:1222
CVE ID: CVE-2019-3892 State: REJECTED Published: 2019-04-30T06:34:58.304Z Last Updated: 2025-02-13T15:46:12.718Z Description: No description available.
CVE ID: CVE-2019-3893 State: PUBLISHED Published: 2019-04-09T15:17:14 Last Updated: 2024-08-04T19:19:18.608Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: The Foreman Project Products: foreman Problem Types: CWE-732 Description: In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable. Additional Analyst Notes: - CVE Progr
sources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107846 - http://www.openwall.com/lists/oss-security/2019/04/14/2 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3893 - https://projects.theforeman.org/issues/26450 - https://github.com/theforeman/foreman/pull/6621
CVE ID: CVE-2019-3894 State: PUBLISHED Published: 2019-05-03T19:25:58 Last Updated: 2024-08-04T19:19:18.806Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: wildfly Problem Types: CWE-358 Description: It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3894 - ht
nal Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3894 - https://access.redhat.com/errata/RHSA-2019:1107 - https://access.redhat.com/errata/RHSA-2019:1108 - https://access.redhat.com/errata/RHSA-2019:1106 - https://access.redhat.com/errata/RHSA-2019:1140 - https://security.netapp.com/advisory/ntap-20190517-0004/
CVE ID: CVE-2019-3895 State: PUBLISHED Published: 2019-06-03T18:04:56 Last Updated: 2024-08-04T19:26:26.642Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: openstack-tripleo-common Problem Types: CWE-284 Description: An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image. Additional Analyst Notes: - CVE Program Container: References
mphorae, Octavia would then pick up the compromised image. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3895 - https://access.redhat.com/errata/RHSA-2019:1683 - https://access.redhat.com/errata/RHSA-2019:1742
CVE ID: CVE-2019-3896 State: PUBLISHED Published: 2019-06-18T23:40:34 Last Updated: 2024-08-04T19:26:26.644Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: The Linux Foundation Products: kernel Problem Types: CWE-416 Description: A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3896 - http://www.securityfocus.com/bid/108814 - https://support.f5.com/csp/article/K04327111 - https:
g.cgi?id=CVE-2019-3896 - http://www.securityfocus.com/bid/108814 - https://support.f5.com/csp/article/K04327111 - https://security.netapp.com/advisory/ntap-20190710-0002/
CVE ID: CVE-2019-3897 State: PUBLISHED Published: 2021-03-16T21:02:23 Last Updated: 2024-08-04T19:26:26.664Z Vendors: n/a Products: redhat-certification Problem Types: CWE-552 Description: It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1593768
CVE ID: CVE-2019-3898 State: REJECTED Published: 2021-03-16T21:07:57 Last Updated: 2021-03-16T21:07:57 Description: No description available.
CVE ID: CVE-2019-3899 State: PUBLISHED Published: 2019-04-22T15:20:07 Last Updated: 2024-08-04T19:26:26.706Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: The Heketi Project Products: heketi Problem Types: CWE-592 Description: It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3899 - https://access.redhat.com/errata/RHSA-2019:3255
CVE ID: CVE-2019-3900 State: PUBLISHED Published: 2019-04-25T14:41:08 Last Updated: 2024-08-04T19:26:26.695Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Kernel Problem Types: CWE-835 Description: An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfoc
ad, resulting in a DoS scenario. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108076 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOFNJA5NNVXQ6AV6KGZB677JIVXAMJHT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYTZH6QCNITK7353S6RCRT2PQHZSDPXD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RI3WXXM5URTZSR3RVEKO6MDXDFIKTZ5R/ - https://access.redhat.com/errata/RHSA-2019:1973 - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029 - https://sec
9:1973 - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029 - https://seclists.org/bugtraq/2019/Aug/18 - https://www.debian.org/security/2019/dsa-4497 - https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html - https://usn.ubuntu.com/4117-1/ - https://usn.ubuntu.com/4114-1/ - https://usn.ubuntu.com/4115-1/ - https://usn.ubuntu.com/4116-1/ - https://usn.ubuntu.com/4118-1/ - https://access.redhat.com/errata/RHSA-2019:3220 - https://access.redhat.com/errata/RHSA-2019:3309 - https://access.redhat.com/errata/RHSA-2019:3517 - https://seclists.org/bugtraq/2019/Nov/11 - http
rrata/RHSA-2019:3309 - https://access.redhat.com/errata/RHSA-2019:3517 - https://seclists.org/bugtraq/2019/Nov/11 - https://access.redhat.com/errata/RHSA-2019:3836 - https://access.redhat.com/errata/RHSA-2019:3967 - https://access.redhat.com/errata/RHSA-2019:4058 - https://access.redhat.com/errata/RHSA-2020:0204 - https://security.netapp.com/advisory/ntap-20190517-0005/ - https://www.oracle.com/security-alerts/cpuApr2021.html - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3900 - https://www.spinics.net/lists/kernel/msg3111012.html
CVE ID: CVE-2019-3901 State: PUBLISHED Published: 2019-04-22T15:22:15 Last Updated: 2024-08-04T19:26:26.688Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: The Linux Foundation Products: kernel Problem Types: CWE-667 Description: A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_ev
perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/89937 - https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html - https://security.netapp.com/advisory/ntap-20190517-0005/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3901
CVE ID: CVE-2019-3902 State: PUBLISHED Published: 2019-04-22T15:29:13 Last Updated: 2024-08-04T19:26:26.699Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: The Mercurial Project Products: mercurial Problem Types: CWE-22 Description: A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902 - https://lists.debian.org/debian-lts-announce/2019/04/msg00024.html - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.28201
.debian.org/debian-lts-announce/2019/04/msg00024.html - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29 - https://usn.ubuntu.com/4086-1/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
CVE ID: CVE-2019-3903 State: REJECTED Published: 2021-03-16T21:04:38 Last Updated: 2021-03-16T21:04:38 Description: No description available.
CVE ID: CVE-2019-3905 State: PUBLISHED Published: 2019-01-03T18:00:00.000Z Last Updated: 2025-05-30T16:01:10.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html#5703 - https://www.excellium-services.com/cert-xlm-advisory/cve-2019-3905/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-3905
CVE ID: CVE-2019-3906 State: PUBLISHED Published: 2019-01-18T18:00:00 Last Updated: 2024-08-04T19:26:26.705Z Vendors: n/a Products: Premisys Identicard 3.1.190 Problem Types: CWE-798 Description: Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-01 - http://www.securityfocus.com/bid/106552
CVE ID: CVE-2019-3907 State: PUBLISHED Published: 2019-01-18T18:00:00 Last Updated: 2024-08-04T19:26:26.671Z Vendors: n/a Products: Premisys Identicard 3.1.190 Problem Types: CWE-798 Description: Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-01 - http://www.securityfocus.com/bid/106552
CVE ID: CVE-2019-3908 State: PUBLISHED Published: 2019-01-18T18:00:00 Last Updated: 2024-08-04T19:26:26.712Z Vendors: n/a Products: Premisys Identicard 3.1.190 Problem Types: CWE-259 Description: Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-01 - http://www.securityfocus.com/bid/106552
CVE ID: CVE-2019-3909 State: PUBLISHED Published: 2019-01-18T18:00:00 Last Updated: 2024-08-04T19:26:26.685Z Vendors: n/a Products: Premisys Identicard 3.1.190 Problem Types: Default Credentials Description: Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-01 - http://www.securityfocus.com/bid/106552
CVE ID: CVE-2019-3910 State: PUBLISHED Published: 2019-01-18T18:00:00 Last Updated: 2024-08-04T19:26:26.668Z Vendors: n/a Products: Crestron AM-100 Before 1.6.0.2 Problem Types: Authentication Bypass Description: Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-02
CVE ID: CVE-2019-3911 State: PUBLISHED Published: 2019-01-30T20:00:00Z Last Updated: 2024-09-17T04:14:40.386Z Vendors: Tenable Products: LabKey Server Community Edition Problem Types: CWE-79 Description: Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-03