Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12349 State: PUBLISHED Published: 2022-06-02T12:38:57 Last Updated: 2024-08-04T23:17:39.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/2
CVE ID: CVE-2019-12350 State: PUBLISHED Published: 2022-06-02T12:58:24 Last Updated: 2024-08-04T23:17:39.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/4
CVE ID: CVE-2019-12351 State: PUBLISHED Published: 2022-06-02T12:26:35 Last Updated: 2024-08-04T23:17:39.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/3
CVE ID: CVE-2019-12352 State: PUBLISHED Published: 2022-06-17T12:11:12 Last Updated: 2024-08-04T23:17:39.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendmail.php (when the attacker has dls_print authority) via a dlid cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/5
CVE ID: CVE-2019-12353 State: PUBLISHED Published: 2022-06-17T12:10:54 Last Updated: 2024-08-04T23:17:39.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dl_sendmail.php (when the attacker has admin authority) via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/5
CVE ID: CVE-2019-12354 State: PUBLISHED Published: 2022-06-17T12:10:32 Last Updated: 2024-08-04T23:17:39.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php (when the attacker has admin authority) via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/5
CVE ID: CVE-2019-12355 State: PUBLISHED Published: 2022-06-17T12:10:14 Last Updated: 2024-08-04T23:17:39.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_print.php (when the attacker has dls_print authority) via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/5
CVE ID: CVE-2019-12356 State: PUBLISHED Published: 2022-06-17T12:09:59 Last Updated: 2024-08-04T23:17:39.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_download.php (when the attacker has dls_download authority) via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/5
CVE ID: CVE-2019-12357 State: PUBLISHED Published: 2022-06-17T12:09:46 Last Updated: 2024-08-04T23:17:39.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php (when the attacker has admin authority) via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/5
CVE ID: CVE-2019-12358 State: PUBLISHED Published: 2022-06-17T12:09:35 Last Updated: 2024-08-04T23:17:39.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/5
CVE ID: CVE-2019-12359 State: PUBLISHED Published: 2022-06-17T12:09:22 Last Updated: 2024-08-04T23:17:39.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cby234/zzcms/issues/5
CVE ID: CVE-2019-12360 State: PUBLISHED Published: 2019-05-27T22:01:33 Last Updated: 2024-08-04T23:17:39.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41801 - https://lists.debian.org/debian-lts-announce/2019/06/msg00002.html - https://lists.fedoraproject.org/ar
hp?f=3&t=41801 - https://lists.debian.org/debian-lts-announce/2019/06/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IQBAHQQF2P7E6PL5STST3TGH7VPVXKKQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJ3GYFINXANXTQEDN5SON47IJA5277RU/
CVE ID: CVE-2019-12361 State: PUBLISHED Published: 2019-05-27T22:49:57 Last Updated: 2024-08-04T23:17:39.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/coolboy0816/audit/issues/3
CVE ID: CVE-2019-12362 State: PUBLISHED Published: 2019-05-27T22:50:09 Last Updated: 2024-08-04T23:17:39.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/coolboy0816/audit/issues/4
CVE ID: CVE-2019-12363 State: PUBLISHED Published: 2019-07-11T13:25:07 Last Updated: 2024-08-04T23:17:39.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate (or usercp.php?action=mybb2fa&do=activate). A deactivate operation lowers the security of the targeted account by disabling two factor authentication. Additional Analyst Notes: - CVE Program Container: References: - https://community.mybb.com/thread-162369.html - https://seekurity.com/blog/advisories/mybb-two-fa
ntainer: References: - https://community.mybb.com/thread-162369.html - https://seekurity.com/blog/advisories/mybb-two-factor-authentication-extension-vulnerabilities/
CVE ID: CVE-2019-12365 State: PUBLISHED Published: 2020-03-18T17:29:07 Last Updated: 2024-08-04T23:17:39.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission. Additional Analyst Notes: - CVE Program Container: References: - https://gubello.me - https://newtonhq.com/ - https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE ID: CVE-2019-12366 State: PUBLISHED Published: 2020-03-18T17:30:09 Last Updated: 2024-08-04T23:17:39.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission. Additional Analyst Notes: - CVE Program Container: References: - https://gubello.me - http://release-notes.9folders.com/ - https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE ID: CVE-2019-12367 State: PUBLISHED Published: 2020-03-18T17:31:08 Last Updated: 2024-08-04T23:17:39.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission. Additional Analyst Notes: - CVE Program Container: References: - https://gubello.me - https://www.bluemail.me/ - https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE ID: CVE-2019-12368 State: PUBLISHED Published: 2020-03-18T17:31:51 Last Updated: 2024-08-04T23:17:39.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission. Additional Analyst Notes: - CVE Program Container: References: - https://gubello.me - https://mail.edison.tech/ - https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE ID: CVE-2019-12369 State: PUBLISHED Published: 2020-03-18T17:34:27 Last Updated: 2024-08-04T23:17:39.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission. Additional Analyst Notes: - CVE Program Container: References: - https://gubello.me - https://www.typeapp.com/ - https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE ID: CVE-2019-12370 State: PUBLISHED Published: 2020-03-18T17:35:07 Last Updated: 2024-08-04T23:17:39.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission. Additional Analyst Notes: - CVE Program Container: References: - https://gubello.me - https://sparkmailapp.com/ - https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE ID: CVE-2019-12372 State: PUBLISHED Published: 2019-05-28T00:11:33 Last Updated: 2024-08-04T23:17:39.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. Additional Analyst Notes: - CVE Program Container: References: - https://faudhzanrahman.blogspot.com/2019/05/sql-injection-on-login-form.html - http://packetstormsecurity.com/files/153084/Petraware-pTransformer-ADC-SQL-Injection.html
CVE ID: CVE-2019-12373 State: PUBLISHED Published: 2019-06-03T19:27:16 Last Updated: 2024-08-04T23:17:39.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote disclosure of administrator passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-administrator-password-disclosure/ - https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/
CVE ID: CVE-2019-12374 State: PUBLISHED Published: 2019-06-03T19:26:14 Last Updated: 2024-08-04T23:17:39.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 due to improper username sanitization in the Basic Authentication implementation in core/provisioning.secure/ProvisioningSecure.asmx in Provisioning.Secure.dll. Additional Analyst Notes: - CVE Program Container: References: - https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-sql-injection/ - https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/
CVE ID: CVE-2019-12375 State: PUBLISHED Published: 2019-06-03T19:24:45 Last Updated: 2024-08-04T23:17:39.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote information disclosure and arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-open-directories/
CVE ID: CVE-2019-12376 State: PUBLISHED Published: 2019-06-03T19:23:37 Last Updated: 2024-08-04T23:17:40.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to full managed endpoint compromise by an authenticated user with read privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-hard-coded-encryption-key/
CVE ID: CVE-2019-12377 State: PUBLISHED Published: 2019-06-03T19:19:43 Last Updated: 2024-08-04T23:17:39.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary file upload, which may lead to arbitrary remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-arbitrary-file-upload/ - https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/
CVE ID: CVE-2019-12378 State: PUBLISHED Published: 2019-05-28T02:04:30 Last Updated: 2024-08-04T23:17:40.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This has been disputed as not an issue Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/5/25/229 - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=95baa60a0da80a0143e3ddd4d3725758b4513825 - http://www.securi
ernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=95baa60a0da80a0143e3ddd4d3725758b4513825 - http://www.securityfocus.com/bid/108475 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLGWJKLMTBBB53D5QLS4HOY2EH246WBE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI/
CVE ID: CVE-2019-12379 State: PUBLISHED Published: 2019-05-28T02:04:48 Last Updated: 2024-08-04T23:17:40.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in con_insert_unipair in drivers/tty/vt/consolemap.c in the Linux kernel through 5.1.5. There is a memory leak in a certain case of an ENOMEM outcome of kmalloc. NOTE: This id is disputed as not being an issue Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-next&id=84ecc2f6eb1cb12e6d44818f94fa49b50f06e6ac - http://www.securityfocus.com/bid/108478 - https://lists.fedoraproject.org/archives/list/package-announce
a49b50f06e6ac - http://www.securityfocus.com/bid/108478 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLGWJKLMTBBB53D5QLS4HOY2EH246WBE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI/ - https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-testing&id=15b3cd8ef46ad1b100e0d3c7e38774f330726820 - https://security.netapp.com/advisory/ntap-20190710-0002/
CVE ID: CVE-2019-12380 State: PUBLISHED Published: 2019-05-28T02:05:08 Last Updated: 2024-08-04T23:17:39.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: **DISPUTED** An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures. NOTE: This id is disputed as not being an issue because “All the code touched by the referenced commit runs only at boot, before any user processes are started. Therefore, there is no possibility for an unprivileged user to control it.”. Additional Analyst Notes: - CVE Program
ed. Therefore, there is no possibility for an unprivileged user to control it.”. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=4e78921ba4dd0aca1cc89168f45039add4183f8e - http://www.securityfocus.com/bid/108477 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLGWJKLMTBBB53D5QLS4HOY2EH246WBE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/20
.opensuse.org/opensuse-security-announce/2019-06/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html - https://security.netapp.com/advisory/ntap-20190710-0002/ - https://usn.ubuntu.com/4427-1/ - https://usn.ubuntu.com/4414-1/ - https://usn.ubuntu.com/4439-1/
CVE ID: CVE-2019-12381 State: PUBLISHED Published: 2019-05-28T02:05:20 Last Updated: 2024-08-04T23:17:40.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: this is disputed because new_ra is never used if it is NULL Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/5/25/230 - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=425aa0e1d01513437668fa3d4a971168bbaa8515 -
30 - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=425aa0e1d01513437668fa3d4a971168bbaa8515 - http://www.securityfocus.com/bid/108473 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLGWJKLMTBBB53D5QLS4HOY2EH246WBE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI/ - https://bugzilla.redhat.com/show_bug.cgi?id=1715501
CVE ID: CVE-2019-12382 State: PUBLISHED Published: 2019-05-28T02:05:29 Last Updated: 2024-08-04T23:17:39.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL pointer dereference Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/20
for a NULL pointer dereference Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/5/24/843 - https://cgit.freedesktop.org/drm/drm-misc/commit/?id=9f1f1a2dab38d4ce87a13565cf4dc1b73bef3a5f - http://www.securityfocus.com/bid/108474 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLGWJKLMTBBB53D5QLS4HOY2EH246WBE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html - http://l
y-announce/2019-06/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html - https://lore.kernel.org/lkml/87o93u7d3s.fsf%40intel.com/ - https://salsa.debian.org/kernel-team/kernel-sec/blob/master/retired/CVE-2019-12382
CVE ID: CVE-2019-12383 State: PUBLISHED Published: 2019-05-28T02:21:05 Last Updated: 2024-08-04T23:17:39.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting. Additional Analyst Notes: - CVE Program Container: References: - https://trac.torproject.org/projects/tor/ticket/24056 - https://hackerone.com/reports/282748 - https://gitweb.torproject.org/tor-browser.git/commit/?id=cbb04b72c68272c2de42f157d40cd7d29a6b7b55 - http://www.securityfocus.com/bid/108484
CVE ID: CVE-2019-12384 State: PUBLISHED Published: 2019-06-24T15:34:08 Last Updated: 2024-08-04T23:17:39.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html - https://access.redhat.com/errata/RHSA-2019:1820 - https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d
dhat.com/errata/RHSA-2019:1820 - https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/5ecc3
d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E - https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:2720 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.