Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-5440 State: PUBLISHED Published: 2019-05-28T18:41:05 Last Updated: 2024-08-04T19:54:53.582Z Vendors: Revive Products: Revive Adserver Problem Types: CWE-338 Description: Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an attacker exploits the password recovery functionality. In lib/OA/Dal/PasswordRecovery.php, the function generateRecoveryId() generates a password reset token that relies on the PHP uniqid function and consequently depends only on the current server time, which is often visible in an HTTP Date header. Additional Analyst Notes: - CVE Program Container: R
current server time, which is often visible in an HTTP Date header. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/576504
CVE ID: CVE-2019-5441 State: REJECTED Published: 2019-06-07T19:16:34 Last Updated: 2019-06-12T17:57:32 Description: No description available.
CVE ID: CVE-2019-5442 State: PUBLISHED Published: 2019-06-12T15:08:59 Last Updated: 2024-08-04T19:54:53.549Z Vendors: n/a Products: Pippo Problem Types: CWE-776 Description: XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/506791
CVE ID: CVE-2019-5443 State: PUBLISHED Published: 2019-07-02T18:31:23 Last Updated: 2024-08-04T19:54:53.552Z Vendors: n/a Products: curl Problem Types: CWE-94 Description: A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/24/1 - http://www.securityfocus.com/bid/108881 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle
- http://www.securityfocus.com/bid/108881 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://curl.haxx.se/docs/CVE-2019-5443.html - https://security.netapp.com/advisory/ntap-20191017-0002/
CVE ID: CVE-2019-5444 State: PUBLISHED Published: 2019-07-10T19:43:03 Last Updated: 2024-08-04T19:54:53.476Z Vendors: n/a Products: serve-here.js npm module Problem Types: CWE-22 Description: Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/569966
CVE ID: CVE-2019-5445 State: PUBLISHED Published: 2019-07-10T19:45:09 Last Updated: 2024-08-04T19:54:53.583Z Vendors: n/a Products: EdgeMAX Problem Types: CWE-400 Description: DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7
CVE ID: CVE-2019-5446 State: PUBLISHED Published: 2019-07-10T19:47:07 Last Updated: 2024-08-04T19:54:53.484Z Vendors: n/a Products: EdgeMAX Problem Types: CWE-77 Description: Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7
CVE ID: CVE-2019-5447 State: PUBLISHED Published: 2019-07-15T17:57:34 Last Updated: 2024-08-04T19:54:53.483Z Vendors: n/a Products: http-file-server Problem Types: CWE-22 Description: A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/570133
CVE ID: CVE-2019-5448 State: PUBLISHED Published: 2019-07-30T20:15:57 Last Updated: 2024-08-04T19:54:53.646Z Vendors: yarn Products: yarn Problem Types: CWE-311 Description: Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/640904 - https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md - https://yarnpkg.com/blog/2019/07/12/recommended-security-update/
CVE ID: CVE-2019-5449 State: PUBLISHED Published: 2019-07-30T20:36:32 Last Updated: 2024-08-04T19:54:53.479Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-287 Description: A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/476615
CVE ID: CVE-2019-5450 State: PUBLISHED Published: 2019-07-30T20:35:37 Last Updated: 2024-08-04T19:54:53.484Z Vendors: n/a Products: com.nextcloud.client Problem Types: CWE-80 Description: Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/631227
CVE ID: CVE-2019-5451 State: PUBLISHED Published: 2019-07-30T20:33:47 Last Updated: 2024-08-04T19:54:53.493Z Vendors: n/a Products: com.nextcloud.client Problem Types: CWE-288 Description: Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/507172
CVE ID: CVE-2019-5452 State: PUBLISHED Published: 2019-07-30T20:32:40 Last Updated: 2024-08-04T19:54:53.503Z Vendors: n/a Products: com.nextcloud.client Problem Types: CWE-284 Description: Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/534541
CVE ID: CVE-2019-5453 State: PUBLISHED Published: 2019-07-30T20:30:50 Last Updated: 2024-08-04T19:54:53.548Z Vendors: Nextcloud Products: com.nextcloud.client Problem Types: CWE-288 Description: Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/331489
CVE ID: CVE-2019-5454 State: PUBLISHED Published: 2019-07-30T20:28:53 Last Updated: 2024-08-04T19:54:53.469Z Vendors: n/a Products: com.nextcloud.client Problem Types: CWE-89 Description: SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/291764
CVE ID: CVE-2019-5455 State: PUBLISHED Published: 2019-07-30T20:26:47 Last Updated: 2024-08-04T19:54:53.490Z Vendors: Nextcloud Products: com.nextcloud.client Problem Types: CWE-288 Description: Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/490946
CVE ID: CVE-2019-5456 State: PUBLISHED Published: 2019-07-30T20:19:48 Last Updated: 2024-08-04T19:54:53.544Z Vendors: UniFi Products: UniFi Problem Types: CWE-300 Description: SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/519582 - https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391 - https://community.ui.com/releases/862b962b-55f6-4324-96be-610f647d5c1c - https://community.ui.com/releases/
b84753f391 - https://community.ui.com/releases/862b962b-55f6-4324-96be-610f647d5c1c - https://community.ui.com/releases/9f698d0b-8279-40d3-9f1a-d36db4813124
CVE ID: CVE-2019-5457 State: PUBLISHED Published: 2019-07-30T20:22:28 Last Updated: 2024-08-04T19:54:53.541Z Vendors: min-http-server Products: min-http-server Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/570568
CVE ID: CVE-2019-5458 State: PUBLISHED Published: 2019-07-30T20:21:09 Last Updated: 2024-08-04T19:54:53.487Z Vendors: http-file-server Products: http-file-server Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/570563
CVE ID: CVE-2019-5459 State: PUBLISHED Published: 2019-07-30T20:24:06 Last Updated: 2024-08-04T19:54:53.560Z Vendors: n/a Products: VLC Problem Types: CWE-191 Description: An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/502816 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html
CVE ID: CVE-2019-5460 State: PUBLISHED Published: 2019-07-30T20:38:22 Last Updated: 2024-08-04T19:54:53.471Z Vendors: n/a Products: VLC Media Player Problem Types: CWE-415 Description: Double Free in VLC versions <= 3.0.6 leads to a crash. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/503208 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html
CVE ID: CVE-2019-5461 State: PUBLISHED Published: 2019-09-09T16:57:15 Last Updated: 2024-08-04T19:54:53.487Z Vendors: n/a Products: GitLab Community Edition Problem Types: CWE-20 Description: An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/446593 - https://gitlab.com//gitlab-org/gitlab-ce/issues/54649
CVE ID: CVE-2019-5462 State: PUBLISHED Published: 2020-01-28T02:17:12 Last Updated: 2024-08-04T19:54:53.486Z Vendors: GitLab Products: GitLab Community Edition and GitLab Enterprise Edition Problem Types: Privilege Escalation (CAPEC-233) Description: A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/495282 - https://gitlab.com/gitlab-org/gitlab-ce/issues/58312 - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/
CVE ID: CVE-2019-5463 State: PUBLISHED Published: 2019-09-09T17:44:00 Last Updated: 2024-08-04T19:54:53.488Z Vendors: n/a Products: GitLab CE/EE Problem Types: CWE-200 Description: An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/477222 - https://gitlab.com/gitlab-org/gitlab-ce/issues/56407
CVE ID: CVE-2019-5464 State: PUBLISHED Published: 2020-01-28T02:23:14 Last Updated: 2024-08-04T19:54:53.478Z Vendors: GitLab Products: GitLab CE/EE Problem Types: CWE-20 Description: A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - https://hackerone.com/reports/632101 - https://gitlab.com/gitlab-org/gitlab-ce/issues/63959
CVE ID: CVE-2019-5465 State: PUBLISHED Published: 2020-01-28T02:28:00 Last Updated: 2024-08-04T19:54:53.509Z Vendors: GitLab Products: GitLab CE/EE Problem Types: CWE-200 Description: An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - https://hackerone.com/reports/584534 - https://gitlab.com/gitlab-org/gitlab-ce/issues/62070
CVE ID: CVE-2019-5466 State: PUBLISHED Published: 2020-01-28T02:39:28 Last Updated: 2024-08-04T19:54:53.587Z Vendors: n/a Products: GitLab CE/EE Problem Types: CWE-639 Description: An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - https://hackerone.com/reports/507113 - https://gitlab.com/gitlab-org/gitlab-ce/issues/59809
CVE ID: CVE-2019-5467 State: PUBLISHED Published: 2019-09-09T17:45:19 Last Updated: 2024-08-04T19:54:53.501Z Vendors: n/a Products: GitLab CE/EE Problem Types: CWE-79 Description: An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/526325 - https://gitlab.com/gitlab-org/gitlab-ce/issues/60143
CVE ID: CVE-2019-5468 State: PUBLISHED Published: 2020-01-28T02:44:12 Last Updated: 2024-08-04T19:54:53.594Z Vendors: GiltLab Products: GitLab Problem Types: Privilege Escalation (CAPEC-233) Description: An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - https://hackerone.com/reports/493562 - https://gitlab.com/gitlab-org/gitlab-ce/issues/57556
CVE ID: CVE-2019-5469 State: PUBLISHED Published: 2019-12-18T20:59:50 Last Updated: 2024-08-04T19:54:53.479Z Vendors: n/a Products: GitLab Problem Types: CWE-639 Description: An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/534794 - https://gitlab.com/gitlab-org/gitlab-ce/issues/60551
CVE ID: CVE-2019-5470 State: PUBLISHED Published: 2020-01-28T02:49:40 Last Updated: 2024-08-04T19:54:53.581Z Vendors: GitLab Products: GitLab Problem Types: CWE-200 Description: An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - https://hackerone.com/reports/490250 - https://gitlab.com/gitlab-org/gitlab-ee/issues/9665
CVE ID: CVE-2019-5471 State: PUBLISHED Published: 2019-09-09T17:47:02 Last Updated: 2024-08-04T19:54:53.486Z Vendors: n/a Products: GitLab Problem Types: CWE-79 Description: An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/496973 - https://gitlab.com/gitlab-org/gitlab-ee/issues/11515
CVE ID: CVE-2019-5472 State: PUBLISHED Published: 2020-01-28T02:52:04 Last Updated: 2024-08-04T19:54:53.512Z Vendors: GitLab Products: GitLab Problem Types: CWE-400 Description: An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - https://hackerone.com/reports/538101 - https://gitlab.com/gitlab-org/gitlab-ee/issues/11381
CVE ID: CVE-2019-5473 State: PUBLISHED Published: 2019-09-09T17:49:52 Last Updated: 2024-08-04T19:54:53.484Z Vendors: n/a Products: gitlab.com Problem Types: CWE-288 Description: An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/565883 - https://gitlab.com/gitlab-org/gitlab-ee/issues/11643
CVE ID: CVE-2019-5474 State: PUBLISHED Published: 2020-01-28T02:29:38 Last Updated: 2024-08-04T19:54:53.488Z Vendors: GitLab Products: GitLab EE Problem Types: CWE-284 Description: An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - https://hackerone.com/reports/544756 - https://gitlab.com/gitlab-org/gitlab-ee/issues/11423
CVE ID: CVE-2019-5475 State: PUBLISHED Published: 2019-09-03T19:13:43 Last Updated: 2024-08-04T19:54:53.577Z Vendors: n/a Products: Nexus Repository Manager Problem Types: CWE-78 Description: The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/654888
CVE ID: CVE-2019-5476 State: PUBLISHED Published: 2019-08-07T16:23:51 Last Updated: 2024-08-04T19:54:53.478Z Vendors: n/a Products: lookup.nextcloud.com Problem Types: CWE-89 Description: An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to execute arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/508487
CVE ID: CVE-2019-5477 State: PUBLISHED Published: 2019-08-16T00:00:00 Last Updated: 2024-08-04T19:54:53.581Z Vendors: n/a Products: Nokogiri (ruby gem) Problem Types: CWE-78 Description: A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addre
cal is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/650835 - https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc - https://github.com/sparklemotion/nokogiri/issues/1915 - https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html - https://usn.ubuntu.com/4175-1/ - https://security.gentoo.org/glsa/202006-05 - https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html - https://lists.debian.org/debian-lts-announce
6-05 - https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html - https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html
CVE ID: CVE-2019-5478 State: PUBLISHED Published: 2019-09-03T19:17:35 Last Updated: 2024-08-04T19:54:53.489Z Vendors: n/a Products: Zynq UltraScale+ SoC Problem Types: CWE-657 Description: A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot image leading to an incorrect secure boot behavior. Additional Analyst Notes: - CVE Program Container: References: - https://www.xilinx.com/support/answers/72588.html - https://github.com/inversepath/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU+-Encrypt_Only_Secure_Boot_bypass.txt
CVE ID: CVE-2019-5479 State: PUBLISHED Published: 2019-09-03T19:15:47 Last Updated: 2024-08-04T19:54:53.576Z Vendors: n/a Products: larvitbase-api Problem Types: CWE-98 Description: An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file). Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/566056
CVE ID: CVE-2019-5480 State: PUBLISHED Published: 2019-09-03T19:19:00 Last Updated: 2024-08-04T19:54:53.591Z Vendors: n/a Products: statichttpserver Problem Types: CWE-22 Description: A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/570035
CVE ID: CVE-2019-5481 State: PUBLISHED Published: 2019-09-16T18:05:38 Last Updated: 2024-08-04T19:54:53.498Z Vendors: n/a Products: curl Problem Types: CWE-415 Description: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/ - http://lists.opensuse.org/opensuse-securit