Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-9147 State: PUBLISHED Published: 2019-07-09T20:20:33 Last Updated: 2024-08-04T21:38:46.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_resources). Mailvelope implements additional measures to prevent web applications from directly embedding the settings page, but this mechanism can be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v
nalyst Notes: - CVE Program Container: References: - https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v310 - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
CVE ID: CVE-2019-9148 State: PUBLISHED Published: 2019-07-09T20:41:18 Last Updated: 2024-08-04T21:38:46.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certification. Keys that are obviously invalid are not rejected during import. An attacker that is able to get a victim to import a manipulated key could claim to have signed a message that originates from another person. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330 - https://www.bsi.bund.de
ontainer: References: - https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330 - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
CVE ID: CVE-2019-9149 State: PUBLISHED Published: 2019-07-09T20:45:39 Last Updated: 2024-08-04T21:38:46.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign (and encrypt) arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows an attacker to decrypt an arbitrary message when the GnuPG backend is used in Mailvelope. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330 - https
s: - CVE Program Container: References: - https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330 - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
CVE ID: CVE-2019-9150 State: PUBLISHED Published: 2019-07-09T20:49:50 Last Updated: 2024-08-04T21:38:46.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330 - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Pu
ns/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
CVE ID: CVE-2019-9151 State: PUBLISHED Published: 2019-02-25T19:00:00Z Last Updated: 2024-09-17T00:00:48.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5VM_memcpyvv in H5VM.c when called from H5D__compact_readvv in H5Dcompact.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicSwordsMan/PAAFS/tree/master/vul7
CVE ID: CVE-2019-9152 State: PUBLISHED Published: 2019-02-25T19:00:00Z Last Updated: 2024-09-16T17:28:10.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5MM_xstrdup in H5MM.c when called from H5O_dtype_decode_helper in H5Odtype.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicSwordsMan/PAAFS/tree/master/vul8
CVE ID: CVE-2019-9153 State: PUBLISHED Published: 2019-08-22T15:30:33 Last Updated: 2024-08-04T21:38:46.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/ - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1 - https://github.com/openpgpjs/openpgpjs/releases/tag/
s/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1 - https://github.com/openpgpjs/openpgpjs/releases/tag/v4.2.0 - https://github.com/openpgpjs/openpgpjs/pull/816 - https://github.com/openpgpjs/openpgpjs/pull/797/commits/327d3e5392a6f59a4270569d200c7f7a2bfc4cbc - http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
CVE ID: CVE-2019-9154 State: PUBLISHED Published: 2019-08-22T15:39:28 Last Updated: 2024-08-04T21:38:46.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/ - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1 - https://github.com/openpgpjs/openpgpjs/releases/tag/v4.2.0 - https://github.com/openpgpjs/openpgpjs/pull/797 - htt
d=1 - https://github.com/openpgpjs/openpgpjs/releases/tag/v4.2.0 - https://github.com/openpgpjs/openpgpjs/pull/797 - https://github.com/openpgpjs/openpgpjs/pull/797/commits/47138eed61473e13ee8f05931119d3e10542c5e1 - http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
CVE ID: CVE-2019-9155 State: PUBLISHED Published: 2019-08-22T15:48:57 Last Updated: 2024-08-04T21:38:46.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-openpgp-js/ - https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#dow
ww.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html#download=1 - https://github.com/openpgpjs/openpgpjs/releases/tag/v4.3.0 - https://github.com/openpgpjs/openpgpjs/pull/853 - https://github.com/openpgpjs/openpgpjs/pull/853/commits/7ba4f8c655e7fd7706e8d7334e44b40fdf56c43e - http://packetstormsecurity.com/files/154191/OpenPGP.js-4.2.0-Signature-Bypass-Invalid-Curve-Attack.html
CVE ID: CVE-2019-9156 State: PUBLISHED Published: 2019-06-05T18:27:42 Last Updated: 2024-08-04T21:38:46.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html - http://seclists.org/fulldisclosure/2019/May/6
CVE ID: CVE-2019-9157 State: PUBLISHED Published: 2019-06-05T18:25:32 Last Updated: 2024-08-04T21:38:46.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html - http://seclists.org/fulldisclosure/2019/May/6
CVE ID: CVE-2019-9158 State: PUBLISHED Published: 2019-06-05T18:16:57 Last Updated: 2024-08-04T21:38:46.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html - http://seclists.org/fulldisclosure/2019/May/6
CVE ID: CVE-2019-9160 State: PUBLISHED Published: 2019-04-18T21:58:00 Last Updated: 2024-08-04T21:38:46.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH (on TCP port 22345) and escalate to root (because the password for root is the WebUI admin password concatenated with a static string). Additional Analyst Notes: - CVE Program Container: References: - http://www.cnvd.org.cn/flaw/show/CNVD-2019-07680
CVE ID: CVE-2019-9161 State: PUBLISHED Published: 2019-04-18T22:01:22 Last Updated: 2024-08-04T21:38:46.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginx_webconsole.php Cookie header can be used to read an etc/config/wac/wns_cfg_admin_detail.xml file containing the admin password. (The password for root is the WebUI admin password concatenated with a static string.) Additional Analyst Notes: - CVE Program Container: References: - http://www.cnvd.org.cn/flaw/show/CNVD-201
atic string.) Additional Analyst Notes: - CVE Program Container: References: - http://www.cnvd.org.cn/flaw/show/CNVD-2019-07679
CVE ID: CVE-2019-9162 State: PUBLISHED Published: 2019-02-25T22:00:00 Last Updated: 2024-08-04T21:38:46.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.25 - https://www.exploit-db.com/exploits/46477/ - http://git.kernel.org/cgit/linux/kernel
nux/kernel/v4.x/ChangeLog-4.19.25 - https://www.exploit-db.com/exploits/46477/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.12 - http://www.securityfocus.com/bid/107159 - https://github.com/torvalds/linux/commit/c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc - https://bugs.chromium.org/p/project-zero/issues/detail?id=1776 - https://security.netapp.com/advisory/ntap-20190327-0002/ - https://usn.ubuntu.com/3930-1/ - https://usn.ubuntu.com/3930-2/ - https://support.f5.com/csp/article/K31864522
CVE ID: CVE-2019-9163 State: PUBLISHED Published: 2020-04-01T20:23:42 Last Updated: 2024-08-04T21:38:46.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafted XAML objects. Additional Analyst Notes: - CVE Program Container: References: - https://www.marchnetworks.com/cve-2019-9163/
CVE ID: CVE-2019-9164 State: PUBLISHED Published: 2019-03-28T16:43:13 Last Updated: 2024-08-04T21:38:46.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/products/security/ - https://www.nagios.com/downloads/nagios-xi/change-log/ - http://seclists.org/fulldisclosure/2019/Apr/19 - http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html
CVE ID: CVE-2019-9165 State: PUBLISHED Published: 2019-03-28T18:59:09 Last Updated: 2024-08-04T21:38:46.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/products/security/ - https://www.nagios.com/downloads/nagios-xi/change-log/ - http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html
CVE ID: CVE-2019-9166 State: PUBLISHED Published: 2019-03-28T19:10:01 Last Updated: 2024-08-04T21:38:46.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/products/security/ - https://www.nagios.com/downloads/nagios-xi/change-log/ - http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html
CVE ID: CVE-2019-9167 State: PUBLISHED Published: 2019-03-28T19:14:26 Last Updated: 2024-08-04T21:38:46.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/products/security/ - https://www.nagios.com/downloads/nagios-xi/change-log/ - http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html
CVE ID: CVE-2019-9168 State: PUBLISHED Published: 2019-02-26T00:00:00Z Last Updated: 2024-09-17T01:35:31.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: WooCommerce before 3.5.5 allows XSS via a Photoswipe caption. Additional Analyst Notes: - CVE Program Container: References: - https://woocommerce.wordpress.com/2019/02/20/woocommerce-3-5-5-security-fix-release/
CVE ID: CVE-2019-9169 State: PUBLISHED Published: 2019-02-26T02:00:00 Last Updated: 2024-08-04T21:38:46.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107160 - https://security.gentoo.org/glsa/202006-04 - https://usn.ubuntu.com/4416-1/ - https://kc.mcafee.com/corporate/index?page=content&id=SB10278 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://sourceware.org/git/gitweb.cgi?p
ge=content&id=SB10278 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9 - https://security.netapp.com/advisory/ntap-20190315-0002/ - https://sourceware.org/bugzilla/show_bug.cgi?id=24114 - https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142 - https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140 - https://support.f5.com/csp/article/K54823184
CVE ID: CVE-2019-9170 State: PUBLISHED Published: 2019-04-17T16:23:38 Last Updated: 2024-08-04T21:38:46.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/51971
CVE ID: CVE-2019-9171 State: PUBLISHED Published: 2019-04-17T16:37:30 Last Updated: 2024-08-04T21:38:46.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 1 of 5). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54635
CVE ID: CVE-2019-9172 State: PUBLISHED Published: 2019-04-17T16:20:09 Last Updated: 2024-08-04T21:38:46.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 2 of 5). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54795
CVE ID: CVE-2019-9174 State: PUBLISHED Published: 2019-04-17T16:17:40 Last Updated: 2024-08-04T21:38:46.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/55468
CVE ID: CVE-2019-9175 State: PUBLISHED Published: 2019-04-17T16:26:16 Last Updated: 2024-08-04T21:38:46.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 3 of 5). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/52524
CVE ID: CVE-2019-9176 State: PUBLISHED Published: 2019-04-17T16:15:05 Last Updated: 2024-08-04T21:38:46.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/55664
CVE ID: CVE-2019-9177 State: REJECTED Published: 2019-05-29T15:58:09 Last Updated: 2019-09-03T22:48:44 Description: No description available.
CVE ID: CVE-2019-9178 State: PUBLISHED Published: 2019-04-17T16:28:40 Last Updated: 2024-08-04T21:38:46.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 4 of 5). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54803
CVE ID: CVE-2019-9179 State: PUBLISHED Published: 2019-04-17T16:31:20 Last Updated: 2024-08-04T21:38:46.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 5 of 5). Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/54783
CVE ID: CVE-2019-9181 State: PUBLISHED Published: 2019-02-26T07:00:00 Last Updated: 2024-08-04T21:38:46.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the Content-Type to image/php, and placing PHP code after the JPEG data. This ultimately allows execution of arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/125/
CVE ID: CVE-2019-9182 State: PUBLISHED Published: 2019-02-26T07:00:00 Last Updated: 2024-08-04T21:38:46.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the filetext parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/119/
CVE ID: CVE-2019-9183 State: PUBLISHED Published: 2020-04-23T12:33:37 Last Updated: 2024-08-04T21:38:46.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. A buffer overflow is present due to an integer underflow during 6LoWPAN fragment processing in the face of truncated fragments in os/net/ipv6/sicslowpan.c. This results in accesses of unmapped memory, crashing the application. An attacker can cause a denial-of-service via a crafted 6LoWPAN frame. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/pull/972 - https://github.com/contiki-ng/contiki-ng/r
Container: References: - https://github.com/contiki-ng/contiki-ng/pull/972 - https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.4 - https://www.usenix.org/system/files/sec20summer_clements_prepub.pdf
CVE ID: CVE-2019-9184 State: PUBLISHED Published: 2019-02-26T15:00:00 Last Updated: 2024-08-04T21:38:46.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the product_option[] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46467/ - https://www.j2store.org/blog/general/security-update-for-j2store.html - https://andreiconache.me/j2store-plugin-3-3-6-sql-injection/