Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-11000 State: PUBLISHED Published: 2019-05-10T19:43:22 Last Updated: 2024-08-04T22:40:15.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/ - http://www.securityfocus.com/bid/108301
CVE ID: CVE-2019-11001 State: PUBLISHED Published: 2019-04-08T17:00:21.000Z Last Updated: 2025-10-21T23:45:40.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vdoo.com/blog/working-with-the-community-%E2%80%93-significant-vulnerabilities-in-reolink-cameras/ - https://github.com/mcw0/PoC/blob/master/Reolink-IPC-RCE.py
CVE ID: CVE-2019-11002 State: PUBLISHED Published: 2019-04-08T17:45:45 Last Updated: 2024-08-04T22:40:15.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Materialize through 1.0.0, XSS is possible via the Tooltip feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dogfalo/materialize/issues/6286
CVE ID: CVE-2019-11003 State: PUBLISHED Published: 2019-04-08T17:45:54 Last Updated: 2024-08-04T22:40:15.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Materialize through 1.0.0, XSS is possible via the Autocomplete feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dogfalo/materialize/issues/6286
CVE ID: CVE-2019-11004 State: PUBLISHED Published: 2019-04-08T17:46:08 Last Updated: 2024-08-04T22:40:15.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Materialize through 1.0.0, XSS is possible via the Toast feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dogfalo/materialize/issues/6286
CVE ID: CVE-2019-11005 State: PUBLISHED Published: 2019-04-08T18:17:26 Last Updated: 2024-08-04T22:40:15.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a quoted font family value. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/600/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b6fb77d7d54d - http://lists.opensuse.org/opensuse-security-announce/2019-04/m
g.graphicsmagick.org/hg/GraphicsMagick/rev/b6fb77d7d54d - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.html - https://usn.ubuntu.com/4207-1/ - https://www.debian.org/security/2020/dsa-4640
CVE ID: CVE-2019-11006 State: PUBLISHED Published: 2019-04-08T18:17:37 Last Updated: 2024-08-04T22:40:15.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which allows attackers to cause a denial of service or information disclosure via an RLE packet. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/598/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/f7610c1281c1 - https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html - http://lists.opensuse.org/opensuse-security-announ
https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.html - https://usn.ubuntu.com/4207-1/ - https://www.debian.org/security/2020/dsa-4640
CVE ID: CVE-2019-11007 State: PUBLISHED Published: 2019-04-08T18:18:08 Last Updated: 2024-08-04T22:40:15.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allows attackers to cause a denial of service or information disclosure via an image colormap. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/596/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/40fc71472b98 - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/86a9295e7c83 - https://lists.debian.org/debian-lts-announce/2019/0
- http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/86a9295e7c83 - https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00010.html - https://usn.ubuntu.com/4207-1/ - https://www.debian.org/security/2020/dsa-4640
CVE ID: CVE-2019-11008 State: PUBLISHED Published: 2019-04-08T18:18:18 Last Updated: 2024-08-04T22:40:15.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/599/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/d823d23a474b - https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html - ht
smagick.org/hg/GraphicsMagick/rev/d823d23a474b - https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00020.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00055.html - https://usn.ubuntu.com/4207-1/ - https://ww
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00055.html - https://usn.ubuntu.com/4207-1/ - https://www.debian.org/security/2020/dsa-4640
CVE ID: CVE-2019-11009 State: PUBLISHED Published: 2019-04-08T18:18:30 Last Updated: 2024-08-04T22:40:15.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allows attackers to cause a denial of service or information disclosure via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/597/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/7cff2b1792de - https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html - http://lists.opensuse.org/opensuse-security-a
2de - https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00020.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00055.html - https://usn.ubuntu.com/4207-1/ - https://www.debian.org/security/2020/dsa-4640
CVE ID: CVE-2019-11010 State: PUBLISHED Published: 2019-04-08T18:18:44 Last Updated: 2024-08-04T22:40:15.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to cause a denial of service via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/601/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/a348d9661019 - https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html - http://lis
announce/2019/04/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00107.html - https://usn.ubuntu.com/4207-1/ - https://www.debian.org/security/2020/dsa-4640
CVE ID: CVE-2019-11011 State: PUBLISHED Published: 2019-06-21T17:55:21 Last Updated: 2024-08-04T22:40:15.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Akamai CloudTest before 58.30 allows remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.akamai.com/sitr/2019/06/cloudtest-vulnerability-cve-2019-11011.html
CVE ID: CVE-2019-11013 State: PUBLISHED Published: 2019-08-22T14:41:40 Last Updated: 2024-08-04T22:40:15.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://mayaseven.com/nimble-directory-traversal-in-nimble-streamer-version-3-0-2-2-to-3-5-4-9/ - http://packetstormsecurity.com/files/154196/Nimble-Streamer-3.x-Directory-Traversal.html
CVE ID: CVE-2019-11014 State: PUBLISHED Published: 2019-04-08T19:44:56 Last Updated: 2024-08-04T22:40:16.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not prevent spoofing of the camera server. An attacker can create a fake camera server that listens for the client looking for a camera on the local network. When the camera responds to the client, it responds via the broadcast address, giving all information necessary to impersonate the camera. The attacker then floods the client with responses, causing the original camera to be denied serv
mpersonate the camera. The attacker then floods the client with responses, causing the original camera to be denied service from the client, and thus causing the client to then communicate exclusively with the attacker's fake camera server. When connecting to the fake camera server, the client sends all details necessary to login to the camera (username and password). Additional Analyst Notes: - CVE Program Container: References: - http://blog.0x42424242.in/2019/03/vstarcam-investigational-security.html - http://blog.0x42424242.in/2019/03/vstarcam-investigational-security_22.html
CVE ID: CVE-2019-11015 State: PUBLISHED Published: 2019-04-18T21:51:29 Last Updated: 2024-08-04T22:40:15.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials (partially). This occurs because of paste access to a social media login page. Additional Analyst Notes: - CVE Program Container: References: - https://www.andmp.com/2019/04/unpatched-vulnerability-in-xiaomi-miui-os-lock-screen.html
CVE ID: CVE-2019-11016 State: PUBLISHED Published: 2019-04-08T20:13:25 Last Updated: 2024-08-04T22:40:15.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect. Additional Analyst Notes: - CVE Program Container: References: - https://elgg.org/blog/view/2913744/security-release-elgg-11218-and-2311 - https://github.com/Elgg/Elgg/releases/tag/1.12.18 - https://github.com/Elgg/Elgg/releases/tag/2.3.11
CVE ID: CVE-2019-11017 State: PUBLISHED Published: 2019-04-18T17:54:02 Last Updated: 2024-08-04T22:40:15.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smap, as demonstrated by the cgi-bin/smap RC parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/152465/D-Link-DI-524-2.06RU-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/46687
CVE ID: CVE-2019-11018 State: PUBLISHED Published: 2019-04-08T20:37:08 Last Updated: 2024-08-04T22:40:15.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zoujingli/ThinkAdmin/issues/173
CVE ID: CVE-2019-11019 State: PUBLISHED Published: 2019-07-09T15:43:43 Last Updated: 2024-08-04T22:40:15.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim details by visiting easily guessable exportpdf/all_claim_detail.php?claim_id= URLs. Additional Analyst Notes: - CVE Program Container: References: - http://ddrt.co.uk/complaint-handling-software/ - https://domdomegg.github.io/CVE-2019-11019.pdf
CVE ID: CVE-2019-11020 State: PUBLISHED Published: 2019-07-09T17:00:24 Last Updated: 2024-08-04T22:40:15.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visiting easily guessable dashboard/uploads/claim_files/claim_id_ URLs. Additional Analyst Notes: - CVE Program Container: References: - http://ddrt.co.uk/complaint-handling-software/ - https://domdomegg.github.io/CVE-2019-11020.pdf
CVE ID: CVE-2019-11021 State: PUBLISHED Published: 2019-10-24T15:26:25 Last Updated: 2024-08-04T22:40:16.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.schlix.com/html/schlix-cms-downloads.html - https://gurel
lnrichment: - CVE Program Container: References: - https://www.schlix.com/html/schlix-cms-downloads.html - https://gurelahmet.com/schlix-cms-v2-1-8-7-authenticated-unrestricted-file-upload-to-rce/ - https://www.incibe-cert.es/en/early-warning/vulnerabilities/cve-2019-11021 - https://vuldb.com/?id.144129 - https://www.schlix.com/news/security/cve-2019-11021-for-older-schlix-cms-v2-1-8-7-november-2018.html
CVE ID: CVE-2019-11023 State: PUBLISHED Published: 2019-04-08T22:20:09 Last Updated: 2024-08-04T22:40:15.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graphml2gv. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/graphviz/graphviz/issues/1517 - https://research.loginsoft.com/bugs/null-pointer-dereference-in-function-agroot/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI3D5TQE3IMCSF5OUTXQL4GVKFCIY5JG/ - https://lists.fedoraproject.org/archives/list/packag
lists.fedoraproject.org/message/FI3D5TQE3IMCSF5OUTXQL4GVKFCIY5JG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLEAHLDJVMAEGA3YMC7KPKJ7ZPXNMJID/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00054.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00065.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00056.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00065.html
CVE ID: CVE-2019-11024 State: PUBLISHED Published: 2019-04-08T22:20:19 Last Updated: 2024-08-04T22:40:15.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: The load_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saitoha/libsixel/issues/85 - https://research.loginsoft.com/bugs/1501/
CVE ID: CVE-2019-11025 State: PUBLISHED Published: 2019-04-08T22:20:39 Last Updated: 2024-08-04T22:40:16.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/issues/2581 - https://github.com/Cacti/cacti/compare/6ea486a...99995bb - https://lists.debian.org/debian-lts-announce/2019/04/msg00017.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html
CVE ID: CVE-2019-11026 State: PUBLISHED Published: 2019-04-08T22:20:51 Last Updated: 2024-08-04T22:40:15.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/752 - https://research.loginsoft.com/bugs/1508/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5JWQE2WP4W4F2FEYPYJQBPQIOG75MVH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
P4W4F2FEYPYJQBPQIOG75MVH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWWVIYFXM74KJFIDHP4W67HR4FRF2LDE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGYLZZ4DZUDBQEGCNDWSZPSFNNZJF4S6/
CVE ID: CVE-2019-11027 State: PUBLISHED Published: 2019-06-10T18:57:09 Last Updated: 2024-08-04T22:40:15.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=openid-security&m=155154717027534&w
dditional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=openid-security&m=155154717027534&w=2 - https://github.com/openid/ruby-openid/issues/122 - https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html - https://security.gentoo.org/glsa/202003-09
CVE ID: CVE-2019-11028 State: PUBLISHED Published: 2019-04-09T13:09:08 Last Updated: 2024-08-04T22:40:15.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx". Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.133141 - https://seclists.org/fulldisclosure/2019/Apr/14 - http://seclists.org/fulldisclosure/2019/Apr/33 - http://packetstormsecurity.com/files/152643/GAT-Ship-Web-Module-Unrestricted-File-Upload.html
CVE ID: CVE-2019-11029 State: PUBLISHED Published: 2019-08-22T14:49:45 Last Updated: 2024-08-04T22:40:15.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-m
tional Analyst Notes: - CVE Program Container: References: - https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution
CVE ID: CVE-2019-11030 State: PUBLISHED Published: 2019-08-22T14:51:12 Last Updated: 2024-08-04T22:40:15.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget (contained in a serialized object) may be executed with SYSTEM privileges. The attacker must properly encrypt the object; however, the hardcoded keys are available. Additional Analyst Notes: - CVE Program Container: References: - https://www.kyberturvallisuuskeskus.fi/e
are available. Additional Analyst Notes: - CVE Program Container: References: - https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution
CVE ID: CVE-2019-11031 State: PUBLISHED Published: 2019-08-22T14:52:18 Last Updated: 2024-08-04T22:40:15.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a Setup-Files action, and then execute these files with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution
CVE ID: CVE-2019-11032 State: PUBLISHED Published: 2019-04-24T14:53:49 Last Updated: 2024-08-04T22:40:15.950Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In EasyToRecruit (E2R) before 2.11, the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting (XSS) injection in multiple locations. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory/ - https://www.excellium-services.com/cert-xlm-advisory/cve-2019-11032/
CVE ID: CVE-2019-11033 State: PUBLISHED Published: 2019-05-16T14:56:59 Last Updated: 2024-08-04T22:40:15.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring. Additional Analyst Notes: - CVE Program Container: References: - https://www.applaudsolutions.com/resources/ - https://support.applaudsolutions.com/hc/en-us/articles/203794318-Download-latest-Applaud-HCM-patch