Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ram Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html - http://www.squid-cache.org/Advisories/SQUID-2019_8.txt - https://bugzilla.suse.com/show_bug.cgi?id=1156329 - https://usn.ubuntu.com/4213-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/ - https://www.debian.org/security/2020/dsa-4682 - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html - https://usn.ubuntu.com/4446-1/
CVE ID: CVE-2019-12524 State: PUBLISHED Published: 2020-04-15T18:35:11 Last Updated: 2024-08-04T23:24:38.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource. Additional Analyst Notes: -
to encode their URL to bypass the url_regex check, and gain access to the blocked resource. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12524.txt - https://www.debian.org/security/2020/dsa-4682 - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html - https://usn.ubuntu.com/4446-1/ - https://security.netapp.com/advisory/ntap-20210205-0006/
CVE ID: CVE-2019-12525 State: PUBLISHED Published: 2019-07-11T18:17:49 Last Updated: 2024-08-04T23:24:38.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1. Additional Analyst Notes: - CV
quote (which would satisfy its requirements), leading to a memcpy of its length minus 1. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v4/changesets/ - https://github.com/squid-cache/squid/commits/v4 - http://www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patch - https://usn.ubuntu.com/4065-1/ - https://lists.debian.org/debian-lts-announce/2019/07/msg00018.html - https://usn.ubuntu.com/4065-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/ - https://www.debian.org/security/2019/dsa-4507 - https://seclists.or
ject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/ - https://www.debian.org/security/2019/dsa-4507 - https://seclists.org/bugtraq/2019/Aug/42 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
CVE ID: CVE-2019-12526 State: PUBLISHED Published: 2019-11-26T16:41:57 Last Updated: 2024-08-04T23:24:38.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1156326 - http://www.squid-cache.org/Advisories/SQUID-2019_7.txt - https://usn.ubuntu.com/4213-1/ - ht
m/show_bug.cgi?id=1156326 - http://www.squid-cache.org/Advisories/SQUID-2019_7.txt - https://usn.ubuntu.com/4213-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html - https://security.gentoo.org/glsa/202003-34 - https://www.debian.org/security/2020/dsa-4682 - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
CVE ID: CVE-2019-12527 State: PUBLISHED Published: 2019-07-11T18:10:16 Last Updated: 2024-08-04T23:24:38.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v4/changesets/ - https://github.com/squid-cache/squid/commits/v4 - http://www.squid-cache.org/Versions/v4/changesets/sq
/v4/changesets/ - https://github.com/squid-cache/squid/commits/v4 - http://www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patch - http://www.securityfocus.com/bid/109143 - https://usn.ubuntu.com/4065-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/ - https://www.debian.org/security/2019/dsa-4507 - https://seclists.org/bugtraq/2019/Aug/42 - https://access.redhat.com/errata/RHSA-2019:2593 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
CVE ID: CVE-2019-12528 State: PUBLISHED Published: 2020-02-04T20:07:15 Last Updated: 2024-08-04T23:24:38.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2020_2.txt - https://usn.ubuntu.com/4289-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html - https://security.gentoo.org/glsa/202003-34 - https://lists.fedoraproject.or
se-security-announce/2020-03/msg00012.html - https://security.gentoo.org/glsa/202003-34 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6W2IQ7QV2OGREFFUBNVZIDD3RJBDE4R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSU6SPANL27AGK5PCGBJOKG4LUWA555J/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html - https://www.debian.org/security/2020/dsa-4682 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
CVE ID: CVE-2019-12529 State: PUBLISHED Published: 2019-07-11T18:33:55 Last Updated: 2024-08-04T23:24:38.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker woul
it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v4/changesets/ - https://github.com/squid-cache/squid/commits/v4 - http://www.squid-cache.org/Versions/v4/changesets/squid-4-dd46b5417809647f561d8a5e0e74c3aacd235258.patch - https://usn.ubuntu.com/4065-1/ - https://lists.debian.org/debian-lts-announce/2019/07/msg00018.html - https://usn.ubuntu.com/4065-2/ - https://lists.fedoraproject.org/archives/li
debian-lts-announce/2019/07/msg00018.html - https://usn.ubuntu.com/4065-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/ - https://www.debian.org/security/2019/dsa-4507 - https://seclists.org/bugtraq/2019/Aug/42 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
CVE ID: CVE-2019-12530 State: PUBLISHED Published: 2019-06-02T16:03:30 Last Updated: 2024-08-04T23:24:38.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stdonato/glpi-dashboard/commit/3a89f0085a221d7ad76d1104df6df6c634bd7f14
CVE ID: CVE-2019-12532 State: PUBLISHED Published: 2019-08-26T17:06:07 Last Updated: 2024-08-04T23:24:38.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08. Additional A
H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08. Additional Analyst Notes: - CVE Program Container: References: - https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/ - https://www.insyde.com/security-pledge/SA-2019001 - https://security.netapp.com/advisory/ntap-20220223-0004/
CVE ID: CVE-2019-12537 State: PUBLISHED Published: 2019-07-11T13:17:44 Last Updated: 2024-08-04T23:24:39.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/asset-explorer/readme.html - https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine - http://www.securityfocus.com/bid/109364
CVE ID: CVE-2019-12538 State: PUBLISHED Published: 2019-06-05T14:40:41 Last Updated: 2024-08-04T23:24:38.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://github.com/tarantula-team/CVE-2019-12538
CVE ID: CVE-2019-12539 State: PUBLISHED Published: 2019-07-11T13:16:35 Last Updated: 2024-08-04T23:24:39.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine
CVE ID: CVE-2019-12540 State: PUBLISHED Published: 2019-07-11T13:15:36 Last Updated: 2024-08-04T23:24:38.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine
CVE ID: CVE-2019-12541 State: PUBLISHED Published: 2019-06-05T14:36:03 Last Updated: 2024-08-04T23:24:38.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://github.com/tarantula-team/CVE-2019-12541
CVE ID: CVE-2019-12542 State: PUBLISHED Published: 2019-06-05T14:25:33 Last Updated: 2024-08-04T23:24:38.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://github.com/tarantula-team/CVE-2019-12542
CVE ID: CVE-2019-12543 State: PUBLISHED Published: 2019-06-05T14:15:54 Last Updated: 2024-08-04T23:24:38.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html - https://github.com/tarantula-team/CVE-2019-12543
CVE ID: CVE-2019-12548 State: PUBLISHED Published: 2019-06-03T20:38:32 Last Updated: 2024-08-04T23:24:38.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/compare/5e5957c...77e85e7 - https://github.com/bludit/bludit/releases/tag/3.9.0 - https://github.com/bludit/bludit/commit/d0843a4070c7d7fa596a7eb2130be15383013487
CVE ID: CVE-2019-12549 State: PUBLISHED Published: 2019-06-17T16:33:13 Last Updated: 2024-08-04T23:24:39.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key. Additional Analyst Notes: - CVE Program Container: References: - https://www.wago.com/us/ - https://ics-cert.us-cert.gov/advisories/ICSA-19-164-02 - https://cert.vde.com/en-us/advisories/vde-2019-013
CVE ID: CVE-2019-12550 State: PUBLISHED Published: 2019-06-17T16:29:08 Last Updated: 2024-08-04T23:24:38.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET. Additional Analyst Notes: - CVE Program Container: References: - https://www.wago.com/us/ - https://ics-cert.us-cert.gov/advisories/ICSA-19-164-02 - https://cert.vde.com/en-us/advisories/vde-2019-013
CVE ID: CVE-2019-12551 State: PUBLISHED Published: 2019-07-22T19:31:57 Last Updated: 2024-08-04T23:24:38.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.sweetscape.com/010editor/manual/ReleaseNotes.htm - https://github.com/ereisr00/bagofbugz/blob/master/010Editor - https://ereisr00.github.io/
CVE ID: CVE-2019-12552 State: PUBLISHED Published: 2019-07-22T19:40:37 Last Updated: 2024-08-04T23:24:39.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.sweetscape.com/010editor/manual/ReleaseNotes.htm - https://github.com/ereisr00/bagofbugz/blob/master/010Editor - https://ereisr00.github.io/
CVE ID: CVE-2019-12553 State: PUBLISHED Published: 2019-06-05T16:20:28 Last Updated: 2024-08-04T23:24:38.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.sweetscape.com/010editor/release_notes.html - https://github.com/ereisr00/bagofbugz/blob/master/010Editor/strcat_heap_overflow.bt
CVE ID: CVE-2019-12554 State: PUBLISHED Published: 2019-06-05T16:23:49 Last Updated: 2024-08-04T23:24:38.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sweetscape.com/010editor/release_notes.html - https://github.com/ereisr00/bagofbugz/blob/master/010Editor/WSubStr.bt
CVE ID: CVE-2019-12555 State: PUBLISHED Published: 2019-06-05T16:17:25 Last Updated: 2024-08-04T23:24:38.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sweetscape.com/010editor/release_notes.html - https://github.com/ereisr00/bagofbugz/blob/master/010Editor/SubStr.bt
CVE ID: CVE-2019-12562 State: PUBLISHED Published: 2019-09-26T19:48:46 Last Updated: 2024-08-04T23:24:38.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://mayaseven.com/cve-2019-12562-st
site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://mayaseven.com/cve-2019-12562-stored-cross-site-scripting-in-dotnetnuke-dnn-version-v9-3-2/ - http://packetstormsecurity.com/files/154673/DotNetNuke-Cross-Site-Scripting.html
CVE ID: CVE-2019-12564 State: PUBLISHED Published: 2019-06-02T23:07:06 Last Updated: 2024-08-04T23:24:38.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/srsec/-srsec-/issues/1
CVE ID: CVE-2019-12566 State: PUBLISHED Published: 2019-06-02T23:34:58 Last Updated: 2024-08-04T23:24:38.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-statistics/#developers - https://github.com/wp-statistics/wp-statistics/issues/271 - https://github.com/wp-statistics/wp-statistics/commit/aec4359975344f75385ae1ec257575d8131d6ec2
CVE ID: CVE-2019-12567 State: PUBLISHED Published: 2019-12-23T22:45:50 Last Updated: 2024-08-04T23:24:38.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2018-10387 and CVE-2019-12568. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/
CVE ID: CVE-2019-12568 State: PUBLISHED Published: 2019-12-23T22:45:54 Last Updated: 2024-08-04T23:24:38.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2018-10387 and CVE-2019-12567. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/
CVE ID: CVE-2019-12569 State: PUBLISHED Published: 2019-06-03T00:50:00 Last Updated: 2024-08-04T23:24:38.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileg
eted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user, if the attacker can place a crafted library in a directory that is accessible to the vulnerable system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-006.md
CVE ID: CVE-2019-12570 State: PUBLISHED Published: 2019-07-03T17:22:06 Last Updated: 2024-08-04T23:24:38.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ivoschyk-cs/exploit_wp/blob/master/CVE-2019-12570 - https://wpvulndb.com/vulnerabilities/9964