Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-18263 State: PUBLISHED Published: 2019-12-20T15:27:16 Last Updated: 2024-08-05T01:47:14.119Z Vendors: n/a Products: Philips Veradius Unity, Pulsera, and Endura Dual WAN Router Problem Types: CWE-326 Description: An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped between 2016-August 2018), Veradius Unity (718132) with ViewForum option (shipped between 2016-August 2018), Pulsera (718095) and Endura (718075) with wireless option (shipped between 26-June-2017 through 07-August 2018), Pulsera (718095) and Endura (718075) with ViewForum option (shipped between 26-June-2017 through 07-August 2018)
2018), Pulsera (718095) and Endura (718075) with ViewForum option (shipped between 26-June-2017 through 07-August 2018). The router software uses an encryption scheme that is not strong enough for the level of protection required. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-19-353-01
CVE ID: CVE-2019-18265 State: PUBLISHED Published: 2022-11-30T22:58:26.586Z Last Updated: 2025-04-16T16:05:50.055Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Digital Alert Systems Products: DASDEC Problem Types: CWE-79 Description: Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
endered when viewed in the web application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.digitalalertsystems.com/security-advisory
CVE ID: CVE-2019-18267 State: PUBLISHED Published: 2019-12-18T19:37:46 Last Updated: 2024-08-05T01:47:14.086Z Vendors: n/a Products: GE S2020/S2020G Fast Switch 61850 Problem Types: CWE-79 Description: An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site scripting vulnerability that may allow session hijacking, disclosure of sensitive data, cross-site request forgery (CSRF) attacks, and remote code execution. Additional Analyst Notes: - CVE Program Cont
data, cross-site request forgery (CSRF) attacks, and remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-19-351-01
CVE ID: CVE-2019-18269 State: PUBLISHED Published: 2019-12-16T19:21:31 Last Updated: 2024-08-05T01:47:14.075Z Vendors: Omron Products: Omron PLC CJ Series, Omron PLC CS series, Omron PLC NX1P2 series Problem Types: CWE-412 Description: Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-19-346-02 - https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf
CVE ID: CVE-2019-18271 State: PUBLISHED Published: 2020-01-15T18:40:25 Last Updated: 2024-08-05T01:47:14.077Z Vendors: n/a Products: OSIsoft PI Vision Problem Types: CWE-352 Description: OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request forgery that may be introduced on the PI Vision administration site. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-014-06
CVE ID: CVE-2019-18273 State: PUBLISHED Published: 2020-01-15T18:44:13 Last Updated: 2024-08-05T01:47:14.106Z Vendors: n/a Products: OSIsoft PI Vision Problem Types: CWE-79 Description: OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The affected product is vulnerable to cross-site scripting, which may allow invalid input to be introduced. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-014-06
CVE ID: CVE-2019-18275 State: PUBLISHED Published: 2020-01-15T18:36:52 Last Updated: 2024-08-05T01:47:14.085Z Vendors: n/a Products: OSIsoft PI Vision Problem Types: CWE-284 Description: OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to an improper access control, which may return unauthorized tag data when viewing analysis data reference attributes. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-014-06
CVE ID: CVE-2019-18276 State: PUBLISHED Published: 2019-11-28T00:27:51.000Z Last Updated: 2025-06-09T15:51:35.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and
he shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://security.gentoo.org/glsa/202105-34 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.youtube.com/watch?v=-wGtxJ8opa8 - https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff - http://packetstormsecurity.com/files/
- https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff - http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html - https://security.netapp.com/advisory/ntap-20200430-0003/
CVE ID: CVE-2019-18277 State: PUBLISHED Published: 2019-10-23T13:07:01 Last Updated: 2024-08-05T01:47:14.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification). Additional Ana
er as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification). Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/haproxy%40formilux.org/msg34926.html - https://nathandavison.com/blog/haproxy-http-request-smuggling - https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=196a7df44d8129d1adc795da020b722614d6a581 - https://usn.ubuntu.com/4174-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00019.html - https://lists.debian.org/debian-lts-announce/2022/05/msg00045.html
CVE ID: CVE-2019-18278 State: PUBLISHED Published: 2019-10-23T13:22:26 Last Updated: 2024-08-05T01:47:14.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: When executing VideoLAN VLC media player 3.0.8 with libqt on Windows, Data from a Faulting Address controls Code Flow starting at libqt_plugin!vlc_entry_license__3_0_0f+0x00000000003b9aba. NOTE: the VideoLAN security team indicates that they have not been contacted, and have no way of reproducing this issue. Additional Analyst Notes: - CVE Program Container: References: - https://code610.blogspot.com/2019/10/random-bytes-in-vlc-308.html
CVE ID: CVE-2019-18279 State: PUBLISHED Published: 2019-11-13T17:34:20 Last Updated: 2024-10-15T18:36:12.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included drivers could be used by a malicious Windows application to gain elevated privileges. Adverse impacts are limited to the Windows environment and there is no known direct impact to the UEFI firmware. This was fixed in late June 2019. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/ - https://eclypsium.com/wp-content/uploads/2019/08/EXTERNAL-Get-off-th
19/08/10/screwed-drivers-signed-sealed-delivered/ - https://eclypsium.com/wp-content/uploads/2019/08/EXTERNAL-Get-off-the-kernel-if-you-cant-drive-DEFCON27.pdf - https://www.phoenix.com/content/uploads/Security-Newsletter-September-2019.pdf
CVE ID: CVE-2019-18280 State: PUBLISHED Published: 2019-10-23T13:40:34 Last Updated: 2024-08-05T01:47:14.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online Grading System 1.0 is affected by a Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code via a crafted HTML page, as demonstrated by a Create User action at the admin/modules/user/controller.php?action=add URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/261-online-grading-system-1-0-csrf
CVE ID: CVE-2019-18281 State: PUBLISHED Published: 2019-10-23T14:03:53 Last Updated: 2024-08-05T01:47:14.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters. Additional Analyst Notes: - CVE Program Container: References: - https://bugreports.qt.io/browse/QTBUG-77819 - https://codereview.qt-project.org/c/qt/qtbase/+/271889 - https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784 - https://www.debian
c/qt/qtbase/+/271889 - https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784 - https://www.debian.org/security/2019/dsa-4556 - https://seclists.org/bugtraq/2019/Nov/4 - https://usn.ubuntu.com/4275-1/ - https://security.gentoo.org/glsa/202003-60
CVE ID: CVE-2019-18282 State: PUBLISHED Published: 2020-01-16T15:22:58 Last Updated: 2024-08-05T01:47:14.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/
w_dissector.c and related code. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=55667441c84fa5e0911a0aac44fb059c15ba6da2 - https://security.netapp.com/advisory/ntap-20200204-0002/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html - https://www.computer.org/csdl/proceedings-article/sp/2020/349700b594/1j2LgrHDR2o
CVE ID: CVE-2019-18283 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.154Z Vendors: Siemens Products: SPPA-T3000 Application Server Problem Types: CWE-502 Description: A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The AdminService is available without authentication on the Application Server. An attacker can gain remote code execution by sending specifically crafted objects to one of its functions. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnera
order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf - http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html
CVE ID: CVE-2019-18284 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.142Z Vendors: Siemens Products: SPPA-T3000 Application Server Problem Types: CWE-287 Description: A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The AdminService is available without authentication on the Application Server. An attacker can use methods exposed via this interface to receive password hashes of other users and to change user passwords. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of th
ication Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf - http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html
CVE ID: CVE-2019-18285 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.213Z Vendors: Siemens Products: SPPA-T3000 Application Server Problem Types: CWE-319 Description: A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The RMI communication between the client and the Application Server is unencrypted. An attacker with access to the communication channel can read credentials of a valid user. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was kn
oit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf - http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html
CVE ID: CVE-2019-18286 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.157Z Vendors: Siemens Products: SPPA-T3000 Application Server Problem Types: CWE-287 Description: A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings and files containing sensitive information. This vulnerability is independent from CVE-2019-18287. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst No
the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf - http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html
CVE ID: CVE-2019-18287 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.131Z Vendors: Siemens Products: SPPA-T3000 Application Server Problem Types: CWE-287 Description: A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings and files containing sensitive information. This vulnerability is independent from CVE-2019-18286. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst No
CVE ID: CVE-2019-18288 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.185Z Vendors: Siemens Products: SPPA-T3000 Application Server Problem Types: CWE-434 Description: A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with valid authentication at the RMI interface could be able to gain remote code execution through an unsecured file upload. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE P
advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf - http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html
CVE ID: CVE-2019-18289 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.164Z Vendors: Siemens Products: SPPA-T3000 MS3000 Migration Server Problem Types: CWE-122 Description: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18293, CVE-2019-18295, and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. A
18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf - http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html
CVE ID: CVE-2019-18290 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.161Z Vendors: Siemens Products: SPPA-T3000 MS3000 Migration Server Problem Types: CWE-122 Description: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-183
-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf - http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html
CVE ID: CVE-2019-18291 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.216Z Vendors: Siemens Products: SPPA-T3000 MS3000 Migration Server Problem Types: CWE-122 Description: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-183
CVE ID: CVE-2019-18292 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.122Z Vendors: Siemens Products: SPPA-T3000 MS3000 Migration Server Problem Types: CWE-122 Description: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-183
CVE ID: CVE-2019-18293 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.161Z Vendors: Siemens Products: SPPA-T3000 MS3000 Migration Server Problem Types: CWE-122 Description: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18289, CVE-2019-18295, and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. A
CVE ID: CVE-2019-18294 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.156Z Vendors: Siemens Products: SPPA-T3000 MS3000 Migration Server Problem Types: CWE-122 Description: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-183
CVE ID: CVE-2019-18295 State: PUBLISHED Published: 2019-12-12T19:08:47 Last Updated: 2024-08-05T01:47:14.164Z Vendors: Siemens Products: SPPA-T3000 MS3000 Migration Server Problem Types: CWE-122 Description: A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18289, CVE-2019-18293, and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. A