Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-19387 State: REJECTED Published: 2018-11-20T21:00:00 Last Updated: 2018-11-23T14:57:01 Description: No description available.
CVE ID: CVE-2018-19388 State: PUBLISHED Published: 2018-11-20T21:00:00 Last Updated: 2024-08-05T11:37:11.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read, access violation, and application crash) via TIFF data because of a ConvertToPDF_x86!ReleaseFXURLToHtml issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/20/2018/11/2018-11-20/index.html - https://yan-1-20.github.io/2018/11/20/2018/11/2018-11-20/
CVE ID: CVE-2018-19389 State: PUBLISHED Published: 2018-11-20T21:00:00 Last Updated: 2024-08-05T11:37:11.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and application crash) via BMP data because of a ConvertToPDF_x86!ConnectedPDF::ConnectedPDFSDK::FCP_SendEmailNotification issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/20/2018/11/2018-11-20/index.html - https://yan-1-20.github.io/2018/11/20/2018/11/2018-11-20/
CVE ID: CVE-2018-19390 State: PUBLISHED Published: 2018-11-20T21:00:00 Last Updated: 2024-08-05T11:37:11.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and application crash) via TIFF data because of a ConvertToPDF_x86!ConnectedPDF::ConnectedPDFSDK::FCP_SendEmailNotification issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yan-1-20/Yan-1-20.github.io/blob/master/2018/11/20/2018/11/2018-11-20/index.html - https://yan-1-20.github.io/2018/11/20/2018/11/2018-11-20/
CVE ID: CVE-2018-19391 State: PUBLISHED Published: 2019-03-15T16:00:00 Last Updated: 2024-08-05T11:37:11.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field. Additional Analyst Notes: - CVE Program Container: References: - https://cyberskr.com/blog/cobham-satcom-250-500.html - https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0
CVE ID: CVE-2018-19392 State: PUBLISHED Published: 2019-03-15T16:00:00 Last Updated: 2024-08-05T11:37:11.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password (including the default "admin" account), without prior knowledge of their password. All that is required is knowledge of the username and attack vector (/index.lua?pageID=Administration usernameAdmChange, passwordAdmChange1, and passwordAdmChange2 fields). Additional Analyst Notes: - CVE Program Container: References: - https://cyberskr.com/blog/cobham-sat
dmChange2 fields). Additional Analyst Notes: - CVE Program Container: References: - https://cyberskr.com/blog/cobham-satcom-250-500.html - https://gist.github.com/CyberSKR/2dfd5dccb20a209ec4d35b2678bac0d4
CVE ID: CVE-2018-19393 State: PUBLISHED Published: 2019-03-15T16:00:00 Last Updated: 2024-08-05T11:37:10.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could be leveraged to achieve a Denial of Service (DoS) condition, where the device would require a factory reset to return to normal operation. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/CyberSK
rn to normal operation. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/CyberSKR/1ade6d887039465d635e27fcbcc817a3 - https://cyberskr.com/blog/cobham-satcom-800-900.html
CVE ID: CVE-2018-19394 State: PUBLISHED Published: 2019-03-15T16:00:00 Last Updated: 2024-08-05T11:37:11.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field (e.g., Satellite name), and then restoring the malicious configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://cyberskr.com/blog/cobham-satcom-800-900.html - https://gist.github.com/CyberSKR/fe21b920c8933867ea262a325d37f03b
CVE ID: CVE-2018-19395 State: PUBLISHED Published: 2018-11-20T21:00:00 Last Updated: 2024-08-05T11:37:11.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM("WScript.Shell"). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105989 - https://security.netapp.com/advisory/ntap-20181221-0005/ - https://bugs.php.net/bug.php?id=77177
CVE ID: CVE-2018-19396 State: PUBLISHED Published: 2018-11-20T21:00:00 Last Updated: 2024-08-05T11:37:11.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105989 - https://security.netapp.com/advisory/ntap-20181221-0005/ - https://bugs.php.net/bug.php?id=77177
CVE ID: CVE-2018-19404 State: PUBLISHED Published: 2018-11-21T00:00:00 Last Updated: 2024-08-05T11:37:11.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url= followed by that URL. This is related to the onlineinstall and import functions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HF9/yxcms-code-audit/blob/master/Any%20PHP%20Code%20Execution
CVE ID: CVE-2018-19406 State: PUBLISHED Published: 2018-11-21T00:00:00 Last Updated: 2024-08-05T11:37:11.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2018/11/20/411 - http://www.securityfocus.com/bid/105988
CVE ID: CVE-2018-19407 State: PUBLISHED Published: 2018-11-21T00:00:00 Last Updated: 2024-08-05T11:37:11.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3879-2/ - https://usn.ubuntu.com/3872-1/ - https://usn.ubuntu.com/3878-1/ - https://usn.ubuntu.com/3879-1/ - https://usn.ubuntu.com/3871-5/ - https://usn.ubuntu.com/3878-2/ - https://usn.ubuntu.
- https://usn.ubuntu.com/3879-1/ - https://usn.ubuntu.com/3871-5/ - https://usn.ubuntu.com/3878-2/ - https://usn.ubuntu.com/3871-4/ - http://www.securityfocus.com/bid/105987 - https://usn.ubuntu.com/3871-1/ - https://usn.ubuntu.com/3871-3/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html - https://lkml.org/lkml/2018/11/20/580
CVE ID: CVE-2018-19409 State: PUBLISHED Published: 2018-11-21T16:00:00 Last Updated: 2024-08-05T11:37:11.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4346 - https://security.gentoo.org/glsa/201811-12 - https://usn.ubuntu.com/3831-1/ - http://www.securityfocus.com/bid/105990 - https://bugs.ghostscript.com/show_bug.cgi?id=700176 - https://access.redhat.com/errata/RHSA-2018:3834 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=661e8d
76 - https://access.redhat.com/errata/RHSA-2018:3834 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=661e8d8fb8248c38d67958beda32f3a5876d0c3f - https://lists.debian.org/debian-lts-announce/2018/11/msg00036.html - https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
CVE ID: CVE-2018-19410 State: PUBLISHED Published: 2018-11-21T16:00:00.000Z Last Updated: 2025-10-21T23:45:46.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator). Additional An
eters, an unauthenticated attacker can create a user with read-write privileges (including administrator). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-24/
CVE ID: CVE-2018-19411 State: PUBLISHED Published: 2018-11-21T16:00:00Z Last Updated: 2024-09-17T01:05:43.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account (including administrator) via an HTTP request because /api/addusers doesn't check, or doesn't properly check, user rights. Additional Analyst Notes: - CVE Program Container: References: - https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-25/
CVE ID: CVE-2018-19413 State: PUBLISHED Published: 2018-12-14T15:00:00 Last Updated: 2024-08-05T11:37:11.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system. Additional Analyst Notes: - CVE Program Container: References: - https://jira.sonarsource.com/browse/S
ainst the system. Additional Analyst Notes: - CVE Program Container: References: - https://jira.sonarsource.com/browse/SONAR-11305 - http://packetstormsecurity.com/files/150496/SonarSource-SonarQube-7.3-Information-Disclosure.html
CVE ID: CVE-2018-19414 State: PUBLISHED Published: 2019-01-03T19:00:00 Last Updated: 2024-08-05T11:37:11.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to groups.php; (2) username parameter to login.php; or (3) date parameter to search.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Dec/8 - https://www.netsparker.com/web-applications-advisories/ns-18-030-cross-site-scripting-in-plikli/ - http://packetstormsecurity.com/files/150657/Plikli-4.0.0-Cross-Sit
dvisories/ns-18-030-cross-site-scripting-in-plikli/ - http://packetstormsecurity.com/files/150657/Plikli-4.0.0-Cross-Site-Scripting.html
CVE ID: CVE-2018-19415 State: PUBLISHED Published: 2019-01-03T19:00:00 Last Updated: 2024-08-05T11:37:11.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to join_group.php or (2) comment_id parameter to story.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Dec/8 - https://www.netsparker.com/web-applications-advisories/ns-18-031-blind-sql-injection-in-plikli/
CVE ID: CVE-2018-19416 State: PUBLISHED Published: 2018-11-21T19:00:00 Last Updated: 2024-08-05T11:37:11.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106010 - https://github.com/sysstat/sysstat/issues/196
CVE ID: CVE-2018-19417 State: PUBLISHED Published: 2018-11-21T19:00:00 Last Updated: 2024-08-05T11:37:10.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages with a variable length header uses memcpy to input data into a fixed size buffer. The allocated buffer can fit only MQTT_MAX_TOPIC_LENGTH (default 64) bytes, and a length check is missing. This could lead to Remote Code Execution via a stack-smashing attack (overwriting the function return address). Contiki-NG does not separate the MQTT server from other servers and the OS modules, so access
function return address). Contiki-NG does not separate the MQTT server from other servers and the OS modules, so access to all memory regions is possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/issues/600
CVE ID: CVE-2018-19418 State: PUBLISHED Published: 2021-01-07T16:49:35 Last Updated: 2024-08-05T11:37:11.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control. Additional Analyst Notes: - CVE Program Container: References: - https://vimeo.com/302125302 - https://www.foxitsoftware.com/support/security-bulletins.html
CVE ID: CVE-2018-19420 State: PUBLISHED Published: 2018-11-21T21:00:00Z Last Updated: 2024-09-16T17:28:02.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename), because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301
CVE ID: CVE-2018-19421 State: PUBLISHED Published: 2018-11-21T21:00:00Z Last Updated: 2024-09-17T03:08:07.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301
CVE ID: CVE-2018-19422 State: PUBLISHED Published: 2018-11-21T00:00:00 Last Updated: 2024-08-05T11:37:11.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/issues/801 - http://packetstormsecurity.com/files/162591/Subrion-CMS-4.2.1-Shell-Upload.html - http://packetstormsecurity.com/files/173998/Intelliants-Subrion-CMS-4.2.1-Remote-Code-Execution.html
CVE ID: CVE-2018-19423 State: PUBLISHED Published: 2018-11-21T21:00:00 Last Updated: 2024-08-05T11:37:11.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Codiad/Codiad/issues/1098 - http://packetstormsecurity.com/files/162772/Codiad-2.8.4-Shell-Upload.html - https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-19423-Exploit
CVE ID: CVE-2018-19424 State: PUBLISHED Published: 2018-11-21T21:00:00Z Last Updated: 2024-09-16T19:57:32.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClipperCMS/ClipperCMS/issues/495
CVE ID: CVE-2018-19432 State: PUBLISHED Published: 2018-11-22T05:00:00 Last Updated: 2024-08-05T11:37:11.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libsndfile 1.0.28. There is a NULL pointer dereference in the function sf_write_int in sndfile.c, which will lead to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erikd/libsndfile/issues/427 - https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html - http://www.securityfocus.com/bid/105996 - https://usn.ubuntu.com/4013-1/
CVE ID: CVE-2018-19433 State: PUBLISHED Published: 2018-11-22T05:00:00 Last Updated: 2024-08-05T11:37:11.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/issues/392
CVE ID: CVE-2018-19434 State: PUBLISHED Published: 2018-11-22T05:00:00 Last Updated: 2024-08-05T11:37:11.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind SQL injection via the AmtClear_ parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eddietcc/CVEnotes/tree/master/webERP_4.15_BankMatching
CVE ID: CVE-2018-19435 State: PUBLISHED Published: 2018-11-22T05:00:00 Last Updated: 2024-08-05T11:37:11.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xUhaw/CVE-Bins/tree/master/webERP%20SQLI-1
CVE ID: CVE-2018-19436 State: PUBLISHED Published: 2018-11-22T05:00:00 Last Updated: 2024-08-05T11:37:11.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xUhaw/CVE-Bins/tree/master/webERP%20SQLI-2
CVE ID: CVE-2018-19437 State: PUBLISHED Published: 2018-11-22T05:00:00 Last Updated: 2024-08-05T11:37:11.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wwwws1234/ucms/blob/master/Vertical%20crossing%20power.md
CVE ID: CVE-2018-19439 State: PUBLISHED Published: 2018-12-13T19:00:00 Last Updated: 2024-08-05T11:37:11.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/106006 - http:/
e-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/106006 - http://seclists.org/fulldisclosure/2018/Nov/58
CVE ID: CVE-2018-19440 State: PUBLISHED Published: 2019-01-29T23:00:00 Last Updated: 2024-08-05T11:37:11.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: ARM Trusted Firmware-A allows information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARM-software/arm-trusted-firmware/pull/1710 - https://github.com/ARM-software/arm-trusted-firmware/wiki/Trusted-Firmware-A-Security-Advisory-TFV-8
CVE ID: CVE-2018-19441 State: PUBLISHED Published: 2020-01-27T18:33:37 Last Updated: 2024-08-05T11:37:11.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers for robot secret_key values used for local and cloud authentication/authorization. If an attacker knows the serial number and is able to estimate the time of first provisioning of a robot, he is able to brute force the generated secret_key of the robot. This is because the entropy of the secret_key exclusively relies on these two values, due to not seeding the random ge
. This is because the entropy of the secret_key exclusively relies on these two values, due to not seeding the random generator and using several constant inputs for secret_key computation. Serial numbers are printed on the packaging and equal the MAC address of the robot. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=k5nj7Jhwn9c - https://www.usenix.org/system/files/woot19-paper_ullrich.pdf
CVE ID: CVE-2018-19442 State: PUBLISHED Published: 2019-04-25T16:59:15 Last Updated: 2024-08-05T11:37:11.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary code with root privileges via a crafted POST request to a vendors/neato/robots/[robot_serial]/messages Neato cloud URI on the nucleo.neatocloud.com web site (port 4443). Additional Analyst Notes: - CVE Program Container: References: - https://media.ccc.de/v/eh19-157-smart-vacuum-cleaners-as-remote-wiretapping-devices#t=1779 - https://www.usenix.org/system/files/woot19-
c.de/v/eh19-157-smart-vacuum-cleaners-as-remote-wiretapping-devices#t=1779 - https://www.usenix.org/system/files/woot19-paper_ullrich.pdf