Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-5876 State: PUBLISHED Published: 2019-11-25T14:22:57 Last Updated: 2024-08-04T20:09:23.720Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in media in Google Chrome on Android prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html - https://crbug.com/997190
CVE ID: CVE-2019-5877 State: PUBLISHED Published: 2019-11-25T14:22:57 Last Updated: 2024-08-04T20:09:23.750Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html - https://crbug.com/999310
CVE ID: CVE-2019-5878 State: PUBLISHED Published: 2019-11-25T14:22:58 Last Updated: 2024-08-04T20:09:23.679Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in V8 in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html - https://crbug.com/1000217
CVE ID: CVE-2019-5879 State: PUBLISHED Published: 2019-11-25T14:22:58 Last Updated: 2024-08-04T20:09:23.744Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html - https://crbug.com/986043
CVE ID: CVE-2019-5880 State: PUBLISHED Published: 2019-11-25T14:22:58 Last Updated: 2024-08-04T20:09:23.791Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html - https://crbug.com/831725
CVE ID: CVE-2019-5881 State: PUBLISHED Published: 2019-11-25T14:22:58 Last Updated: 2024-08-04T20:09:23.903Z Vendors: Google Products: Chrome Problem Types: Out of bounds read Description: Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html - https://crbug.com/980816
CVE ID: CVE-2019-5882 State: PUBLISHED Published: 2019-01-09T22:00:00 Last Updated: 2024-08-04T20:09:23.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer. Additional Analyst Notes: - CVE Program Container: References: - https://irssi.org/security/irssi_sa_2019_01.txt - https://irssi.org/NEWS/#v1-1-2 - https://github.com/irssi/irssi/pull/948 - https://usn.ubuntu.com/3862-1/
CVE ID: CVE-2019-5883 State: PUBLISHED Published: 2019-05-17T15:30:47 Last Updated: 2024-08-04T20:09:23.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE ID: CVE-2019-5884 State: PUBLISHED Published: 2019-01-10T06:00:00 Last Updated: 2024-08-04T20:09:23.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Studio-42/elFinder/releases/tag/2.1.45 - https://github.com/Studio-42/elFinder/commit/f133163f2d754584de65d718b2fde96191557316
CVE ID: CVE-2019-5885 State: PUBLISHED Published: 2019-03-19T17:59:29 Last Updated: 2024-08-04T20:09:23.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32Y6KD3OAHCG5P33HC2QEX3NUZOSXCGZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMCLO5PUPBA756UK
CGZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMCLO5PUPBA756UKY72PKUWL4RRM4W6K/ - https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/ - https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/
CVE ID: CVE-2019-5886 State: PUBLISHED Published: 2019-01-10T14:00:00 Last Updated: 2024-08-04T20:09:23.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gongfuxiang/shopxo/issues/1
CVE ID: CVE-2019-5887 State: PUBLISHED Published: 2019-01-10T14:00:00 Last Updated: 2024-08-04T20:09:23.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling by the rmdir method. Attackers can delete arbitrary files by using "../" directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gongfuxiang/shopxo/issues/2
CVE ID: CVE-2019-5888 State: PUBLISHED Published: 2019-04-01T15:13:51 Last Updated: 2024-08-04T20:09:23.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple XSS vulnerabilities were discovered in OverIT Geocall 6.3 before build 2:346977. Additional Analyst Notes: - CVE Program Container: References: - https://www.quantumleap.it/geocall-v-6-3-multiple-vulnerabilities/ - https://web.archive.org/web/20200327142627/https://www.quantumleap.it/geocall-v-6-3-multiple-vulnerabilities/
CVE ID: CVE-2019-5889 State: PUBLISHED Published: 2019-04-01T15:16:27 Last Updated: 2024-08-04T20:09:23.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: An log-management directory traversal issue was discovered in OverIT Geocall 6.3 before build 2:346977. Additional Analyst Notes: - CVE Program Container: References: - https://www.quantumleap.it/geocall-v-6-3-multiple-vulnerabilities/ - https://web.archive.org/web/20200327142627/https://www.quantumleap.it/geocall-v-6-3-multiple-vulnerabilities/
CVE ID: CVE-2019-5890 State: PUBLISHED Published: 2019-04-01T15:19:15 Last Updated: 2024-08-04T20:09:23.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OverIT Geocall 6.3 before build 2:346977. Weak authentication and session management allows an authenticated user to obtain access to the Administrative control panel and execute administrative functions. Additional Analyst Notes: - CVE Program Container: References: - https://www.quantumleap.it/geocall-v-6-3-multiple-vulnerabilities/ - https://web.archive.org/web/20200327142627/https://www.quantumleap.it/geocall-v-6-3-multiple-vulnerabilities/
CVE ID: CVE-2019-5891 State: PUBLISHED Published: 2019-04-01T15:23:39 Last Updated: 2024-08-04T20:09:23.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OverIT Geocall 6.3 before build 2:346977. An unauthenticated servlet allows an attacker to obtain a cookie of an authenticated user, and login to the web application. Additional Analyst Notes: - CVE Program Container: References: - https://www.quantumleap.it/geocall-v-6-3-multiple-vulnerabilities/ - https://web.archive.org/web/20200327142627/https://www.quantumleap.it/geocall-v-6-3-multiple-vulnerabilities/
CVE ID: CVE-2019-5892 State: PUBLISHED Published: 2019-01-10T17:00:00 Last Updated: 2024-08-04T20:09:23.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABLE_BGP_VNC is used for Virtual Network Control, allows remote attackers to cause a denial of service (peering session flap) via attribute 255 in a BGP UPDATE packet. This occurred during Disco in January 2019 because FRR does not implement RFC 7606, and therefore the packets with 255 were considered invalid VNC data and the BGP session was closed. Addi
ement RFC 7606, and therefore the packets with 255 were considered invalid VNC data and the BGP session was closed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FRRouting/frr/releases/tag/frr-3.0.4 - https://lists.frrouting.org/pipermail/frog/2019-January/000404.html - https://github.com/FRRouting/frr/releases/tag/frr-5.0.2 - https://github.com/FRRouting/frr/releases/tag/frr-6.0.2 - https://github.com/FRRouting/frr/commit/943d595a018e69b550db08cccba1d0778a86705a - https://frrouting.org/community/security/cve-2019-5892.html - https://github.com/FRRouting/frr/releases/tag/frr-4.0.1
CVE ID: CVE-2019-5893 State: PUBLISHED Published: 2019-01-10T17:00:00 Last Updated: 2024-08-04T20:09:23.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46118/ - https://github.com/EmreOvunc/OpenSource-ERP-SQL-Injection
CVE ID: CVE-2019-5909 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-04T20:09:23.659Z Vendors: Yokogawa Electric Corporation Products: License Manager Service of YOKOGAWA products Problem Types: Authentication Bypass by Assumed-Immutable Data Description: License Manager Service of YOKOGAWA products (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.00), ProSafe-RS (R3.01.00 - R4.04.00), PRM (R4.01.00 - R4.02.00), B/M9000 VP(R7.01.01 - R8.02.03)) allows remote attackers to bypass access restriction to send malicious files to the PC where License Manager Service runs via unspecified vectors. Additional Analyst Notes: - CVE Program Container: Refer
PC where License Manager Service runs via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdf - http://www.securityfocus.com/bid/106772 - http://jvn.jp/vu/JVNVU99147082/index.html
CVE ID: CVE-2019-5910 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-04T20:09:23.783Z Vendors: HOUSE GATE inc. Products: HOUSE GATE App for iOS Problem Types: Directory traversal Description: Directory traversal vulnerability in HOUSE GATE App for iOS 1.7.8 and earlier allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN98505783/index.html
CVE ID: CVE-2019-5911 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-04T20:09:23.769Z Vendors: Micco Products: The installer of UNLHA32.DLL Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in the installer of UNLHA32.DLL (UNLHA32.DLL for Win32 Ver 2.67.1.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm - http://jvn.jp/en/jp/JVN83826673/index.html
CVE ID: CVE-2019-5912 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-04T20:09:23.739Z Vendors: Micco Products: The installer of UNARJ32.DLL Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm - http://jvn.jp/en/jp/JVN83826673/index.html
CVE ID: CVE-2019-5913 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-04T20:09:23.745Z Vendors: Micco Products: The installer of LHMelting Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in the installer of LHMelting (LHMelting for Win32 Ver 1.65.3.6 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm - http://jvn.jp/en/jp/JVN83826673/index.html
CVE ID: CVE-2019-5914 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-04T20:09:23.617Z Vendors: NTT DOCOMO, INC. Products: V20 PRO L-01J Problem Types: Null Pointer Exception Description: V20 PRO L-01J software version L01J20c and L01J20d has a NULL pointer exception flaw that can be used by an attacker to cause the device to crash on the same network range via a specially crafted access point. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN40439414/index.html - https://www.nttdocomo.co.jp/support/utilization/product_update/list/l01j/index.html
CVE ID: CVE-2019-5915 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-04T20:09:23.759Z Vendors: OpenAM Consortium Products: OpenAM (Open Source Edition) Problem Types: Open Redirect Description: Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page. Additional Analyst Notes: - CVE Program Container: References: - https://www.cs.themistruct.com/ - http://jvn.jp/en/jp/JVN43193964/index.html - https://www.osstech.co.jp/support/am2019-1-1
CVE ID: CVE-2019-5916 State: PUBLISHED Published: 2019-02-13T18:00:00 Last Updated: 2024-08-04T20:09:23.690Z Vendors: D-CIRCLE inc. Products: POWER EGG Problem Types: Improper Input Validation Description: Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Government Edition Patch 7 and earlier, Ver 2.8 Patch 6 and earlier, Ver 2.8c Patch 5 and earlier, Ver 2.9 Patch 4 and earlier) allows remote attackers to execute EL expression on the server via unspecifi
5 and earlier, Ver 2.9 Patch 4 and earlier) allows remote attackers to execute EL expression on the server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://poweregg.d-circle.com/support/package/important/20190204_000780/ - http://jvn.jp/en/jp/JVN63860183/index.html
CVE ID: CVE-2019-5917 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.698Z Vendors: Microsoft Products: azure-umqtt-c Problem Types: Denial-of-service (DoS) Description: azure-umqtt-c (available through GitHub prior to 2017 October 6) allows remote attackers to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Azure/azure-umqtt-c - http://www.securityfocus.com/bid/107149 - http://jvn.jp/en/jp/JVN05875753/index.html
CVE ID: CVE-2019-5918 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.807Z Vendors: TIS Inc. Products: Nablarch 5 Problem Types: XML external entities (XXE) Description: Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://nablarch.atlassian.net/projects/NAB/issues/NAB-295 - http://jvn.jp/en/jp/JVN56542712/index.html
CVE ID: CVE-2019-5919 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.661Z Vendors: TIS Inc. Products: Nablarch 5 Problem Types: An incomplete cryptography Description: An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://nablarch.atlassian.net/browse/NAB-313 - http://jvn.jp/en/jp/JVN56542712/index.html
CVE ID: CVE-2019-5920 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.928Z Vendors: nCrafts Products: FormCraft Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/formcraft-form-builder/#developers - http://jvn.jp/en/jp/JVN83501605/index.html - https://wpvulndb.com/vulnerabilities/9231
CVE ID: CVE-2019-5921 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.848Z Vendors: Microsoft Products: Windows 7 Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN69181574/index.html - http://www.securityfocus.com/bid/107218
CVE ID: CVE-2019-5922 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.764Z Vendors: Microsoft Products: The installer of Microsoft Teams Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107200 - http://jvn.jp/en/jp/JVN79543573/index.html
CVE ID: CVE-2019-5923 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.666Z Vendors: iChain, Inc. Products: iChain Insurance Wallet App for iOS Problem Types: Directory traversal Description: Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN11622218/index.html - https://www.ichain.co.jp/security20190311.html
CVE ID: CVE-2019-5924 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.793Z Vendors: RedNao Products: Smart Forms Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/jp/JVN97656108/index.html - https://wordpress.org/plugins/smart-forms/#developers - https://wpvulndb.com/vulnerabilities/9232
CVE ID: CVE-2019-5925 State: PUBLISHED Published: 2019-03-12T21:00:00 Last Updated: 2024-08-04T20:09:23.796Z Vendors: Security Roots Ltd Products: Dradis Community Edition and Dradis Professional Edition Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3.1.1 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN40288903/index.html - https://dradisframework.com/ce/security_reports.html#fixed-3.11.1
CVE ID: CVE-2019-5926 State: PUBLISHED Published: 2019-03-27T13:17:58 Last Updated: 2024-08-04T20:09:23.799Z Vendors: Project Kinaga Products: KinagaCMS Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://xn--5rwx17a.xn--v8jtdudb.com/ - https://github.com/KinagaCMS/KinagaCMS - https://jvn.jp/en/jp/JVN06527859/index.html
CVE ID: CVE-2019-5927 State: PUBLISHED Published: 2019-03-27T13:17:58 Last Updated: 2024-08-04T20:09:23.794Z Vendors: PERSOL CAREER CO., LTD. Products: 'an' App for iOS Problem Types: Directory traversal Description: Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://weban.jp/contents/c/smartphone_apri/ - https://jvn.jp/en/jp/JVN60497148/index.html
CVE ID: CVE-2019-5928 State: PUBLISHED Published: 2019-05-17T15:25:54 Last Updated: 2024-08-04T20:09:23.798Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Customize Item function. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cybozu.support/article/34279/ - http://jvn.jp/en/jp/JVN58849431/index.html
CVE ID: CVE-2019-5929 State: PUBLISHED Published: 2019-05-17T15:25:54 Last Updated: 2024-08-04T20:09:23.866Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application 'Memo'. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN58849431/index.html - https://kb.cybozu.support/article/34277/
CVE ID: CVE-2019-5930 State: PUBLISHED Published: 2019-05-17T15:25:54 Last Updated: 2024-08-04T20:09:23.679Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Fails to restrict access Description: Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN58849431/index.html - https://kb.cybozu.support/article/34227/