Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-16338 State: PUBLISHED Published: 2020-03-19T17:15:03 Last Updated: 2024-08-05T01:10:41.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tfo_common component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file. Additional Analyst Notes: - CVE Program Container: References: - http://help.hancom.com/update_en_multilang/details/HOfficeNEO_update.htm - https://starlabs.sg/advisories/
CVE ID: CVE-2019-16340 State: PUBLISHED Published: 2019-11-21T14:49:17 Last Updated: 2024-08-05T01:10:41.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI. Additional Analyst Notes: - CVE Program Container: References: - http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/WHW03_A03_Velop_Customer_Release_Notes_1.1.9.195026.txt - https://puzzor.github.io/Linksys-Velop-Authentication-bypass - https://www.linksys.com/us/support-article?articleNum=207568
CVE ID: CVE-2019-16344 State: PUBLISHED Published: 2019-10-14T14:05:56 Last Updated: 2024-08-05T01:10:41.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://fabiantronc.wordpress.com/2019/10/11/xss-on-scadabr-1-0ce/
CVE ID: CVE-2019-16346 State: PUBLISHED Published: 2019-09-16T12:57:42 Last Updated: 2024-08-05T01:10:41.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: ngiflib 0.4 has a heap-based buffer overflow in WritePixel() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/ngiflib/issues/11 - https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a
CVE ID: CVE-2019-16347 State: PUBLISHED Published: 2019-09-16T12:57:33 Last Updated: 2024-08-05T01:10:41.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: ngiflib 0.4 has a heap-based buffer overflow in WritePixels() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a - https://github.com/miniupnp/ngiflib/issues/12
CVE ID: CVE-2019-16348 State: PUBLISHED Published: 2019-09-16T12:56:41 Last Updated: 2024-08-05T01:10:41.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: marc-q libwav through 2017-04-20 has a NULL pointer dereference in gain_file() at wav_gain.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marc-q/libwav/issues/24
CVE ID: CVE-2019-16349 State: PUBLISHED Published: 2019-09-16T12:56:24 Last Updated: 2024-08-05T01:10:41.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bento4 1.5.1-628 has a NULL pointer dereference in AP4_ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called from the AP4_TrunAtom class. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/422
CVE ID: CVE-2019-16350 State: PUBLISHED Published: 2019-09-16T12:55:53 Last Updated: 2024-08-05T01:10:41.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: ffjpeg before 2019-08-18 has a NULL pointer dereference in idct2d8x8() at dct.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rockcarry/ffjpeg/issues/10
CVE ID: CVE-2019-16351 State: PUBLISHED Published: 2019-09-16T12:55:41 Last Updated: 2024-08-05T01:10:41.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: ffjpeg before 2019-08-18 has a NULL pointer dereference in huffman_decode_step() at huffman.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rockcarry/ffjpeg/issues/11
CVE ID: CVE-2019-16352 State: PUBLISHED Published: 2019-09-16T12:55:16 Last Updated: 2024-08-05T01:10:41.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rockcarry/ffjpeg/issues/12
CVE ID: CVE-2019-16353 State: PUBLISHED Published: 2019-09-16T13:18:58 Last Updated: 2024-08-05T01:10:41.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emerson GE Automation Proficy Machine Edition 8.0 allows an access violation and application crash via crafted traffic from a remote device, as demonstrated by an RX7i device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/boofish/GE_Proficy_Machine_Edition_Vuln/blob/master/README.md
CVE ID: CVE-2019-16354 State: PUBLISHED Published: 2019-09-16T14:10:55 Last Updated: 2024-08-05T01:10:41.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/astaxie/beego/issues/3763
CVE ID: CVE-2019-16355 State: PUBLISHED Published: 2019-09-16T14:12:22 Last Updated: 2024-08-05T01:10:41.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/astaxie/beego/issues/3763
CVE ID: CVE-2019-16366 State: PUBLISHED Published: 2019-09-16T16:09:27 Last Updated: 2024-08-05T01:10:41.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: In XS 9.0.0 in Moddable SDK OS180329, there is a heap-based buffer overflow in fxBeginHost in xsAPI.c when called from fxRunDefine in xsRun.c, as demonstrated by crafted JavaScript code to xst. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Moddable-OpenSource/moddable/issues/235
CVE ID: CVE-2019-16370 State: PUBLISHED Published: 2019-09-16T17:50:28 Last Updated: 2024-08-05T01:10:41.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/pull/10543 - https://github.com/gradle/gradle/commit/425b2b7a50cd84106a77cdf1ab665c89c6b14d2f
CVE ID: CVE-2019-16371 State: PUBLISHED Published: 2019-09-16T17:56:06 Last Updated: 2024-08-05T01:10:41.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because do_popupregister can be bypassed via clickjacking. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1930
CVE ID: CVE-2019-16374 State: PUBLISHED Published: 2020-08-13T12:30:26 Last Updated: 2024-08-05T01:17:39.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters of a username, followed by the * character, to bypass access control. Additional Analyst Notes: - CVE Program Container: References: - https://community.pega.com/upgrade - https://gist.github.com/IAG0110/0205823570ba04ec12e656f7f4602877
CVE ID: CVE-2019-16375 State: PUBLISHED Published: 2020-03-19T00:00:00 Last Updated: 2024-08-05T01:17:39.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is logged in as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent composes an answer to the original article. Additional Analyst Notes: - CVE Program Container: References: - https://community.otrs.com/category/securi
nal article. Additional Analyst Notes: - CVE Program Container: References: - https://community.otrs.com/category/security-advisories-en/ - https://otrs.com/release-notes/otrs-security-advisory-2019-13/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2019-16377 State: PUBLISHED Published: 2019-09-23T15:08:39 Last Updated: 2024-08-05T01:17:39.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://rubygems.org/gems/consul - https://github.com/makandra/consul/issues/49
CVE ID: CVE-2019-16378 State: PUBLISHED Published: 2019-09-17T11:24:18 Last Updated: 2024-08-05T01:17:39.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/trusteddomainproject/OpenDMARC/pull/48 - https://bugs.debian.org/940081 - https://www.openwall.com/lists/oss-security/2019/09/11/8 - http://www.openwall.com/lists/oss-security/2019/09/17/2 - https://www.deb
openwall.com/lists/oss-security/2019/09/11/8 - http://www.openwall.com/lists/oss-security/2019/09/17/2 - https://www.debian.org/security/2019/dsa-4526 - https://seclists.org/bugtraq/2019/Sep/36 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUBIHJLMPMB6KHOSGDMUQKSAW4HOCYM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7RT6ID7MBCEPNZEIUKK2TZIOCYPJR6E/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HEWDFGRKQHIWKFZH5BNWQDGUPNR7VH3/ - https://usn.ubuntu.com/4567-1/
CVE ID: CVE-2019-16382 State: PUBLISHED Published: 2020-03-19T16:57:41 Last Updated: 2024-08-05T01:17:39.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by PowerGrid. A malicious PowerGrid XML file can then be created, after which the folder is renamed back to its original value. Also, CVE-2018-15591 exploitation can consequently be achieved by using PowerGrid with the /SEE parameter to execute the arbitrary command specified in the XML file. Additional Analyst Notes: - CVE Program Container: References: - https://t
arbitrary command specified in the XML file. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/jmoosdijk - https://forums.ivanti.com/s/article/Security-Alert-Ivanti-Workspace-Control-September-2019
CVE ID: CVE-2019-16383 State: PUBLISHED Published: 2019-09-24T14:34:34 Last Updated: 2024-08-05T01:17:39.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API, aka SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://c
database via the REST API, aka SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability - https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm - https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm - https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm - http://packetstormsecurity.com/files/157208/MOVEit-Transfer-11.1.1-SQL-Injection.html
CVE ID: CVE-2019-16384 State: PUBLISHED Published: 2020-06-04T15:30:34 Last Updated: 2024-08-05T01:17:39.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables files outside of the web directory to be retrieved if the exact location is known and the user has permissions. Additional Analyst Notes: - CVE Program Container: References: - https://labs.nettitude.com/blog/cve-2019-16384-85-cyblesoft-thinfinity-virtualui-path-traversal-http-header-injection/
CVE ID: CVE-2019-16385 State: PUBLISHED Published: 2020-06-04T15:29:35 Last Updated: 2024-08-05T01:17:39.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a reflected XSS payload being executed. Additional Analyst Notes: - CVE Program Container: References: - https://labs.nettitude.com/blog/cve-2019-16384-85-cyblesoft-thinfinity-virtualui-path-traversal-http-header-injection/
CVE ID: CVE-2019-16386 State: PUBLISHED Published: 2019-11-26T17:23:46 Last Updated: 2024-08-05T01:17:39.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect Additional Analyst Notes: - CVE Program Container:
claim that the CVE was done with a low privilege account is incorrect Additional Analyst Notes: - CVE Program Container: References: - https://blog.cybercastrum.com/2019/11/25/cve-2019-16386/
CVE ID: CVE-2019-16387 State: PUBLISHED Published: 2019-11-26T17:25:14 Last Updated: 2024-08-05T01:17:39.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account. (This can perform actions and retrieve data that only an administrator should have access to.) NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect Additional Analyst Notes: - CVE Pro
Therefore, the claim that the CVE was done with a low privilege account is incorrect Additional Analyst Notes: - CVE Program Container: References: - https://blog.cybercastrum.com/2019/11/25/cve-2019-16387/
CVE ID: CVE-2019-16388 State: PUBLISHED Published: 2019-11-26T17:26:23 Last Updated: 2024-08-05T01:17:39.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.cyberc
incorrect Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.cybercastrum.com/2019/11/25/cve-2019-16388/
CVE ID: CVE-2019-16391 State: PUBLISHED Published: 2019-09-17T20:49:04 Last Updated: 2024-08-05T01:17:39.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php. Additional Analyst Notes: - CVE Program Container: References: - https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html - https://git.spip.net/SPIP/spip/commit/187952ce85e73b52c2753f2d54fc2c44807b8f79 - https://git.spip.net/SPIP/spip/commit/3cbc758400323ab006c00e
SPIP/spip/commit/187952ce85e73b52c2753f2d54fc2c44807b8f79 - https://git.spip.net/SPIP/spip/commit/3cbc758400323ab006c00ea78eacdb8f76aa5f66 - https://seclists.org/bugtraq/2019/Sep/40 - https://www.debian.org/security/2019/dsa-4532 - https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html?lang=fr - https://lists.debian.org/debian-lts-announce/2019/10/msg00038.html - https://usn.ubuntu.com/4536-1/
CVE ID: CVE-2019-16392 State: PUBLISHED Published: 2019-09-17T20:48:28 Last Updated: 2024-08-05T01:17:39.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages. Additional Analyst Notes: - CVE Program Container: References: - https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html - https://git.spip.net/SPIP/spip/commit/3c12a82c7d9d4afd09e708748fa82e7836174028 - https://seclists.org/bugtraq/2019/Sep/40 - https://www.debian.org/security/2019/dsa-4532 - https://lists.debian.org/debian-lts-announce/2019/10/msg00038.html - https://usn.ubuntu.com/4536-
curity/2019/dsa-4532 - https://lists.debian.org/debian-lts-announce/2019/10/msg00038.html - https://usn.ubuntu.com/4536-1/
CVE ID: CVE-2019-16393 State: PUBLISHED Published: 2019-09-17T20:48:04 Last Updated: 2024-08-05T01:17:39.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character. Additional Analyst Notes: - CVE Program Container: References: - https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html - https://core.spip.net/issues/4362 - https://git.spip.net/SPIP/spip/commit/0b832408b0aabd5b94a81e261e9413c0f31a19f1 - https://seclists.org/bugtraq/2019/Sep/40 - https://www.debian.org/security/2019/dsa-4532 - https://lists.debian.org/debian-lt
://seclists.org/bugtraq/2019/Sep/40 - https://www.debian.org/security/2019/dsa-4532 - https://lists.debian.org/debian-lts-announce/2019/10/msg00038.html - https://usn.ubuntu.com/4536-1/
CVE ID: CVE-2019-16394 State: PUBLISHED Published: 2019-09-17T20:47:50 Last Updated: 2024-08-05T01:17:39.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers. Additional Analyst Notes: - CVE Program Container: References: - https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-2-5-et-SPIP-3-1-11.html - https://core.spip.net/issues/4171 - https://zone.spip.net/trac/spip-zone/changeset/117577/spip-zone - https://zone.spip.net/trac/spip-zone/changeset/117578/spip-z
//zone.spip.net/trac/spip-zone/changeset/117577/spip-zone - https://zone.spip.net/trac/spip-zone/changeset/117578/spip-zone - https://seclists.org/bugtraq/2019/Sep/40 - https://www.debian.org/security/2019/dsa-4532 - https://lists.debian.org/debian-lts-announce/2019/10/msg00038.html - https://usn.ubuntu.com/4536-1/
CVE ID: CVE-2019-16395 State: PUBLISHED Published: 2019-09-17T21:06:15 Last Updated: 2024-08-05T01:17:39.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/open-cobol/bugs/586/
CVE ID: CVE-2019-16396 State: PUBLISHED Published: 2019-09-17T21:06:04 Last Updated: 2024-08-05T01:17:39.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/open-cobol/bugs/587/
CVE ID: CVE-2019-16398 State: PUBLISHED Published: 2019-09-19T14:39:26 Last Updated: 2024-08-05T01:17:39.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj_script_run.sh that executes a reverse shell. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/crypt0crc/cve-2019-16398
CVE ID: CVE-2019-16399 State: PUBLISHED Published: 2019-09-18T13:06:13 Last Updated: 2024-08-05T01:17:39.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/pak0s/22ad6bae26198ebcd137b61adb6fcfe6 - http://packetstormsecurity.com/files/154524/Western-Digital-My-Book-World-II-NAS-1.02.12-Hardcoded-Credential.h
6fcfe6 - http://packetstormsecurity.com/files/154524/Western-Digital-My-Book-World-II-NAS-1.02.12-Hardcoded-Credential.html
CVE ID: CVE-2019-16400 State: PUBLISHED Published: 2019-11-06T22:12:26 Last Updated: 2024-08-05T01:17:39.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow attackers to send AT commands over Bluetooth, resulting in several Denial of Servi
Baseband: N7100DDUFND1) devices allow attackers to send AT commands over Bluetooth, resulting in several Denial of Service (DoS) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.openconf.org/acsac2019/modules/request.php?module=oc_program&action=summary.php&id=210