Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-13445 State: PUBLISHED Published: 2019-12-30T17:54:07 Last Updated: 2024-08-04T23:49:24.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. parseOptions() in tools/rosbag/src/record.cpp has an integer overflow when a crafted split option can be entered on the command line. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ros/ros_comm/blob/melodic-devel/tools/rosbag/src/record.cpp#L129 - https://github.com/ros/ros_comm/pull/1741 - https://github.com/ros/ros_comm/issues/1738
CVE ID: CVE-2019-13446 State: REJECTED Published: 2019-07-17T11:31:54 Last Updated: 2019-07-17T11:31:54 Description: No description available.
CVE ID: CVE-2019-13447 State: PUBLISHED Published: 2019-07-17T19:14:58 Last Updated: 2024-08-04T23:49:24.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database via SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://cyberoo.com/2019/07/16/cyberoo-identifica-vulnerabilita-0day/
CVE ID: CVE-2019-13448 State: PUBLISHED Published: 2019-07-17T19:14:27 Last Updated: 2024-08-04T23:49:24.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit the vulnerable function in order to prepare an XSS payload to send to the product's clients. Additional Analyst Notes: - CVE Program Container: References: - https://cyberoo.com/2019/07/16/cyberoo-identifica-vulnerabilita-0day/
CVE ID: CVE-2019-13449 State: PUBLISHED Published: 2019-07-09T05:48:41 Last Updated: 2024-08-04T23:49:25.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&confno= requests to localhost port 19421. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 - https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf - https://blog.zoom.us/wordpress/2019/07/08/response-to-
ssets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf - https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/ - https://twitter.com/zoom_us/status/1148710712241295361 - https://bugs.chromium.org/p/chromium/issues/detail?id=951540
CVE ID: CVE-2019-13450 State: PUBLISHED Published: 2019-07-09T05:49:07 Last Updated: 2024-08-04T23:49:25.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating
eps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 - https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf - https://news.ycombinator.com/item?id=20387298 - https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/ - https://twitter.com/moreati/status/1148548799813640193 - http://www.securityfocus.com/bid/109082 - https://twitter.com/zoom_us/status/1148710712241295361 - h
48548799813640193 - http://www.securityfocus.com/bid/109082 - https://twitter.com/zoom_us/status/1148710712241295361 - https://bugs.chromium.org/p/chromium/issues/detail?id=951540
CVE ID: CVE-2019-13451 State: PUBLISHED Published: 2019-08-27T16:37:07 Last Updated: 2024-08-04T23:49:25.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/history.c - https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html - https://lists.xymon.com/archive/2019-July/046570.html
CVE ID: CVE-2019-13452 State: PUBLISHED Published: 2019-08-27T16:31:49 Last Updated: 2024-08-04T23:49:24.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/reportlog.c - https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html - https://lists.xymon.com/archive/2019-July/046570.html
CVE ID: CVE-2019-13453 State: PUBLISHED Published: 2019-07-17T14:17:56 Last Updated: 2024-08-04T23:49:24.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile(). Additional Analyst Notes: - CVE Program Container: References: - https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-2-of-3/ - https://sourceforge.net/p/zipios/news/2019/07/version-017-cve-/ - http://www.securityfocus.com/bid/109282 - https://lists.debian.org/debian-lts-an
zipios/news/2019/07/version-017-cve-/ - http://www.securityfocus.com/bid/109282 - https://lists.debian.org/debian-lts-announce/2022/05/msg00041.html
CVE ID: CVE-2019-13454 State: PUBLISHED Published: 2019-07-09T16:07:30.000Z Last Updated: 2025-03-04T18:54:17.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1629 - https://github.com/ImageMagick/ImageMagick/commit/1ddcf2e4f28029a888cadef2e757509ef5047ad8 - https://github.com/ImageMagick/ImageMagick6/commit/4f31d78716ac94c85c244efcea368fea202e2ed4 - http://www.securityfocus.com/bid/109099 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg000
202e2ed4 - http://www.securityfocus.com/bid/109099 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - https://usn.ubuntu.com/4192-1/ - https://www.debian.org/security/2020/dsa-4712 - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html - https://github.com/ImageMagick/ImageMagick/blob/7.0.1-0/MagickCore/layer.c#L1618
CVE ID: CVE-2019-13455 State: PUBLISHED Published: 2019-08-27T16:28:15 Last Updated: 2024-08-04T23:49:25.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of &nbsp; expansion in acknowledge.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/acknowledge.c - https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html - https://lists.xymon.com/archive/2019-July/046570.html
CVE ID: CVE-2019-13456 State: PUBLISHED Published: 2019-12-03T19:53:53 Last Updated: 2024-08-04T23:49:25.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494. Additional Analyst Notes: - CVE Program Container: References: - https://freeradius.org/security/ - https://wpa3.mathyvanhoef.com - https://bugzilla.redhat.com/show_bug.cgi?id=17
ces: - https://freeradius.org/security/ - https://wpa3.mathyvanhoef.com - https://bugzilla.redhat.com/show_bug.cgi?id=1737663 - https://github.com/FreeRADIUS/freeradius-server/commit/3ea2a5a026e73d81cd9a3e9bbd4300c433004bfa - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html
CVE ID: CVE-2019-13457 State: PUBLISHED Published: 2020-03-10T17:16:25 Last Updated: 2024-08-04T23:49:24.987Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets (with the same CustomerID), even when the CustomerDisableCompanyTicketAccess setting is turned on. Additional Analyst Notes: - CVE Program Container: References: - https://www.otrs.com/category/release-and-security-notes-en/ - https://otrs.com/release-notes/otrs-security-advisory
: - https://www.otrs.com/category/release-and-security-notes-en/ - https://otrs.com/release-notes/otrs-security-advisory-2019-11/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE ID: CVE-2019-13458 State: PUBLISHED Published: 2019-08-21T00:00:00 Last Updated: 2024-08-04T23:49:24.980Z Severity: LOW (CVSS 2.7 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.otrs.com/category/release-and-security-notes-en/ - https:/
yst Notes: - CVE Program Container: References: - https://www.otrs.com/category/release-and-security-notes-en/ - https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html - https://community.otrs.com/security-advisory-2019-12-security-update-for-otrs-framework/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2019-13461 State: PUBLISHED Published: 2019-07-09T17:33:26 Last Updated: 2024-08-04T23:49:25.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444. Additional Analyst Notes: - CVE Program Container: References: - https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=40 - https://assets.prestashop2.com/en/system/files/ps_releases/changelog
/index.php?controller=post&action=view&id_post=40 - https://assets.prestashop2.com/en/system/files/ps_releases/changelog_1.7.6.0-rc2.txt
CVE ID: CVE-2019-13462 State: PUBLISHED Published: 2019-08-12T16:30:41 Last Updated: 2024-08-04T23:49:24.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.lansweeper.com/forum/yaf_topics33_Announcements.aspx - https://www.nccgroup.trust/uk/our-research/technical-advisory-unauthenticated-sql-injection-in-lansweeper/
CVE ID: CVE-2019-13463 State: PUBLISHED Published: 2020-03-20T20:40:01 Last Updated: 2024-08-04T23:57:37.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset?old_path=%2Fsimple-link-directory&old=2111131&new_path=%2Fsimple-link-directory&new=2111132&sfp_email=&sfph_mail= - https://wordpress.org/plugins
irectory&old=2111131&new_path=%2Fsimple-link-directory&new=2111132&sfp_email=&sfph_mail= - https://wordpress.org/plugins/simple-link-directory/#developers
CVE ID: CVE-2019-13464 State: PUBLISHED Published: 2019-07-09T18:07:21 Last Updated: 2024-08-04T23:57:37.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1386 - https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1391
CVE ID: CVE-2019-13465 State: PUBLISHED Published: 2019-12-30T17:50:01 Last Updated: 2024-08-04T23:57:37.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. ROS_ASSERT_MSG only works when ROS_ASSERT_ENABLED is defined. This leads to a problem in the remove() function in clients/roscpp/src/libros/spinner.cpp. When ROS_ASSERT_ENABLED is not defined, the iterator loop will run out of the scope of the array, and cause denial of service for other components (that depend on the communication-related functions of this package). NOTE: The reporter of this issue now be
components (that depend on the communication-related functions of this package). NOTE: The reporter of this issue now believes it was a false alarm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ros/ros_comm/issues/1748
CVE ID: CVE-2019-13466 State: PUBLISHED Published: 2019-09-30T17:52:04 Last Updated: 2024-08-04T23:57:37.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-19009-sandisk-and-western-digital-ssd-dashboard-vulnerabilities
CVE ID: CVE-2019-13467 State: PUBLISHED Published: 2019-09-30T18:30:27 Last Updated: 2024-08-04T23:57:37.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/downloads.aspx?g=907&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-19009-sandisk
/support.wdc.com/downloads.aspx?g=907&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-19009-sandisk-and-western-digital-ssd-dashboard-vulnerabilities
CVE ID: CVE-2019-13470 State: PUBLISHED Published: 2019-07-09T21:00:25 Last Updated: 2024-08-04T23:57:37.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrixssl/matrixssl/blob/4-2-1-open/doc/CHANGES_v4.x.md#changes-between-420-and-421-june-2019
CVE ID: CVE-2019-13472 State: PUBLISHED Published: 2019-07-09T21:57:37 Last Updated: 2024-08-04T23:57:37.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2184
CVE ID: CVE-2019-13473 State: PUBLISHED Published: 2019-09-11T00:00:00 Last Updated: 2024-08-04T23:57:37.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have an undocumented TELNET service within the BusyBox subsystem, leading to root access. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2183 - http://packetstormsecurity.com/files/154416/Dabman-And-Imperial-Web-Radio-Devices-Undocumented-Telnet-
ent.php?id=2183 - http://packetstormsecurity.com/files/154416/Dabman-And-Imperial-Web-Radio-Devices-Undocumented-Telnet-Backdoor.html - http://seclists.org/fulldisclosure/2023/Sep/1 - http://packetstormsecurity.com/files/174503/Internet-Radio-auna-IR-160-SE-UIProto-DoS-XSS-Missing-Authentication.html
CVE ID: CVE-2019-13474 State: PUBLISHED Published: 2019-09-16T00:00:00 Last Updated: 2024-08-04T23:57:37.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have insufficient access control for the /set_dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2183 - http
l Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2183 - http://seclists.org/fulldisclosure/2019/Sep/12 - http://seclists.org/fulldisclosure/2023/Sep/1 - http://packetstormsecurity.com/files/174503/Internet-Radio-auna-IR-160-SE-UIProto-DoS-XSS-Missing-Authentication.html
CVE ID: CVE-2019-13475 State: PUBLISHED Published: 2019-07-09T21:58:05 Last Updated: 2024-08-04T23:57:38.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=21
Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2186
CVE ID: CVE-2019-13476 State: PUBLISHED Published: 2019-08-21T19:02:13 Last Updated: 2024-08-04T23:57:39.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13476.md - http://packetstormsecurity.com/files/154216/CentOS-7.6.1810-Control-Web-Panel-0.9.8.837-Cross-Site-Scripting.html
CVE ID: CVE-2019-13477 State: PUBLISHED Published: 2019-08-21T18:55:04 Last Updated: 2024-08-04T23:57:37.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13477.md - http://packetstormsecurity.com/files/154217/CentOS-7.6.1810-Control-Web-Panel-0.9.8.837-Cross-Site-Request-Forgery.html
CVE ID: CVE-2019-13478 State: PUBLISHED Published: 2019-07-09T22:35:20 Last Updated: 2024-08-04T23:57:39.408Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AC:L/AV:N/A:L/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yoast/wordpress-seo/releases/tag/11.6-RC5 - https://wpvulndb.com/vulnerabilities/9445
CVE ID: CVE-2019-13481 State: PUBLISHED Published: 2019-07-10T19:53:29 Last Updated: 2024-08-04T23:57:39.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to SetWanSettings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-3.pdf - http://www.securityfocus.com/bid/109131
CVE ID: CVE-2019-13482 State: PUBLISHED Published: 2019-07-10T19:53:39 Last Updated: 2024-08-04T23:57:39.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-4.pdf - http://www.securityfocus.com/bid/109131
CVE ID: CVE-2019-13483 State: PUBLISHED Published: 2019-07-25T19:34:58 Last Updated: 2024-08-04T23:57:38.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms. Additional Analyst Notes: - CVE Program Container: References: - https://auth0.com/docs/security/bulletins/cve-2019-13483
CVE ID: CVE-2019-13484 State: PUBLISHED Published: 2019-08-27T16:26:53 Last Updated: 2024-08-04T23:57:39.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of &nbsp; expansion in appfeed.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/appfeed.c - https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html - https://lists.xymon.com/archive/2019-July/046570.html