Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-20765 State: PUBLISHED Published: 2020-04-16T21:15:41 Last Updated: 2024-08-05T02:53:08.987Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000060634/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0136
CVE ID: CVE-2019-20766 State: PUBLISHED Published: 2020-04-16T21:16:24 Last Updated: 2024-08-05T02:53:08.811Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000060633/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0135
CVE ID: CVE-2019-20767 State: PUBLISHED Published: 2020-04-15T13:42:05 Last Updated: 2024-08-05T02:53:08.913Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.60, D3600 before 1.0.0.75, D6000 before 1.0.0.75, R9000 before 1.0.4.26, R8900 before 1.0.4.26, R7800 before 1.0.2.52, WNDR4500v3 before 1.0.0.58, WNDR4300v2 before 1.0.0.58, WNDR4300 before 1.0.2.104, WNDR3700v4 before 1.0.2.102, and WNR2000v5 before 1.0.0.66. Additional Analyst Notes: - CVE Program Container: References: - htt
v4 before 1.0.2.102, and WNR2000v5 before 1.0.0.66. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000060632/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Modem-Routers-PSV-2018-0116
CVE ID: CVE-2019-20768 State: PUBLISHED Published: 2020-05-05T21:13:31 Last Updated: 2024-08-05T02:53:08.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparm_item_guid and sys_id parameters in an Incident Request to service_catalog.do. Additional Analyst Notes: - CVE Program Container: References: - https://outpost24.com/blog?tags=307 - https://outpost24.com/blog/Responsible-disclosure-Multiple-stored-XSS-vulnerabilities-discovered-in-ServiceNow-ITSM
CVE ID: CVE-2019-20769 State: PUBLISHED Published: 2020-04-17T13:32:34 Last Updated: 2024-08-05T02:53:09.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LG PC Suite for LG G3 and earlier (aka LG PC Suite v5.3.27 and earlier). DLL Hijacking can occur via a Trojan horse DLL in the current working directory. The LG ID is LVE-MOT-190001 (November 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20770 State: PUBLISHED Published: 2020-04-17T13:33:43 Last Updated: 2024-08-05T02:53:09.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 9.0 software. The HAL service has a buffer overflow that leads to arbitrary code execution. The LG ID is LVE-SMP-190013 (September 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20771 State: PUBLISHED Published: 2020-04-17T13:22:04 Last Updated: 2024-08-05T02:53:09.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. WapService allows unconfirmed configuration changes via a modified OMACP message. The LG ID is LVE-SMP-190006 (August 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20772 State: PUBLISHED Published: 2020-04-17T13:35:06 Last Updated: 2024-08-05T02:53:08.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. The Account subsystem allows authorization bypass. The LG ID is LVE-SMP-190007 (August 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20773 State: PUBLISHED Published: 2020-04-17T13:36:26 Last Updated: 2024-08-05T02:53:09.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. Unprivileged applications can execute shell commands via the connectivity service. The LG ID is LVE-SMP-190008 (August 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20774 State: PUBLISHED Published: 2020-04-17T13:37:29 Last Updated: 2024-08-05T02:53:09.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. A system service allows local retrieval of the user's password. The LG ID is LVE-SMP-190009 (August 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20775 State: PUBLISHED Published: 2020-04-17T13:38:36 Last Updated: 2024-08-05T02:53:08.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 9.0 (Qualcomm SDM450, SDM845, SM6150, and SM8150 chipsets) software. Weak encryption leads to local information disclosure. The LG ID is LVE-SMP-190010 (August 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20776 State: PUBLISHED Published: 2020-04-17T13:39:35 Last Updated: 2024-08-05T02:53:08.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. A TZ trusted application can crash via crafted input. The LG ID is LVE-SMP-190005 (July 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20777 State: PUBLISHED Published: 2020-04-17T13:40:19 Last Updated: 2024-08-05T02:53:09.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. WapService mishandles OTA Provisioning on V40 and G7 devices. The LG ID is LVE-SMP-190006 (July 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20778 State: PUBLISHED Published: 2020-04-17T13:41:24 Last Updated: 2024-08-05T02:53:09.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. The Backup subsystem does not properly restrict operations or validate their input. The LG ID is LVE-SMP-190004 (June 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20779 State: PUBLISHED Published: 2020-04-17T13:42:34 Last Updated: 2024-08-05T02:53:08.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. A TrustZone trusted application can crash via crafted input. The LG ID is LVE-SMP-190003 (May 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20780 State: PUBLISHED Published: 2020-04-17T13:43:35 Last Updated: 2024-08-05T02:53:09.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Certain security settings, related to whether packages are verified and accepted only from known sources, are mishandled. The LG ID is LVE-SMP-190002 (April 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20781 State: PUBLISHED Published: 2020-04-29T13:08:35 Last Updated: 2024-08-05T02:53:09.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LG Bridge before April 2019 on Windows. DLL Hijacking can occur. Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20782 State: PUBLISHED Published: 2020-04-17T13:45:09 Last Updated: 2024-08-05T02:53:09.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. LG Advanced Flash (LAF) has a buffer overflow. The LG ID is LVE-SMP-190001 (March 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20783 State: PUBLISHED Published: 2020-04-17T13:46:14 Last Updated: 2024-08-05T02:53:09.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (North America CDMA) software. The LTE protocol implementation allows a bypass of AKA (Authentication and Key Agreement). The LG ID is LVE-SMP-180014 (February 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20784 State: PUBLISHED Published: 2020-04-17T13:47:07 Last Updated: 2024-08-05T02:53:09.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (MTK chipsets) software. Interaction of GPS with 911 emergency calls is mishandled. The LG ID is LVE-SMP-180012 (January 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20785 State: PUBLISHED Published: 2020-04-17T13:47:57 Last Updated: 2024-08-05T02:53:09.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable. The LG ID is LVE-SMP-180013 (January 2019). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/
CVE ID: CVE-2019-20786 State: PUBLISHED Published: 2020-04-19T19:57:36 Last Updated: 2024-08-05T02:53:09.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/sec20fall_fiterau-brostean_prepub.pdf - https://www.usenix.org/conference/usenixsecurity20/presentation/fiterau-brostean - https://github.com/pion/dtls/commit/fd73a5df2ff0e1fb6ae6a51e2777d7a16cc4f4e0 - https://github.com/pion/dt
rau-brostean - https://github.com/pion/dtls/commit/fd73a5df2ff0e1fb6ae6a51e2777d7a16cc4f4e0 - https://github.com/pion/dtls/compare/v1.5.1...v1.5.2
CVE ID: CVE-2019-20787 State: PUBLISHED Published: 2020-04-22T16:19:49 Last Updated: 2024-08-05T02:53:09.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size. Additional Analyst Notes: - CVE Program Container: References: - https://www.teeworlds.com/forum/viewtopic.php?pid=123860 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00044.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVYG7CCPS5F3OPOQMJKVNXTQ7BXSEX2V/
CVE ID: CVE-2019-20788 State: PUBLISHED Published: 2020-04-23T18:06:55 Last Updated: 2024-08-05T02:53:09.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibVNC/libvncserver/commit/54220248886b5001fbbb9fa73c4e1a2cb9413fed - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html - https://usn.ubuntu.com/4407-1/ - https://securitylab.github.com/advisories/GHSL-2020-064-libvnc-libvn
05/msg00027.html - https://usn.ubuntu.com/4407-1/ - https://securitylab.github.com/advisories/GHSL-2020-064-libvnc-libvncclient - https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
CVE ID: CVE-2019-20789 State: PUBLISHED Published: 2020-04-26T16:06:57 Last Updated: 2024-08-05T02:53:09.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/croogo/croogo/issues/940 - https://github.com/croogo/croogo/compare/3.0.6...3.0.7
CVE ID: CVE-2019-20790 State: PUBLISHED Published: 2020-04-27T14:00:46 Last Updated: 2024-08-05T02:53:09.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf - https://sourceforge.net/p/opendmarc/tickets/235/ - https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproj
chpad.net/pypolicyd-spf/+bug/1838816 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2D4JGHMALEJEWWG56DKR5OZB22TK7W5B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBOGOQOK3TIWWJV66MW5YWNRJAFFYGR5/
CVE ID: CVE-2019-20791 State: PUBLISHED Published: 2020-04-28T17:35:52 Last Updated: 2024-08-05T02:53:09.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenThread before 2019-12-13 has a stack-based buffer overflow in MeshCoP::Commissioner::GeneratePskc. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19386 - https://github.com/openthread/openthread/commit/b8c3161281f8e15873f8decabd8eac461717aefe - https://github.com/openthread/openthread/commit/c3a3a0c424322009fec3ab735fb20ce8f6e19e70
CVE ID: CVE-2019-20792 State: PUBLISHED Published: 2020-04-29T03:53:57 Last Updated: 2024-08-05T02:53:09.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208 - https://github.com/OpenSC/OpenSC/commit/c246f6f69a749d4f68626b40795a4f69168008f4 - https://github.com/OpenSC/OpenSC/compare/0.19.0...0.20.0
CVE ID: CVE-2019-20794 State: PUBLISHED Published: 2020-05-09T17:35:50 Last Updated: 2024-08-05T02:53:09.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and mount a FUSE filesystem. Upon interaction with this FUSE filesystem, if the userspace component is terminated via a kill of the PID namespace's pid 1, it will result in a hung task, and resources being permanently locked up until system reboot. This can result in resource exhaustion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sarg
result in resource exhaustion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sargun/fuse-example - https://sourceforge.net/p/fuse/mailman/message/36598753/ - https://security.netapp.com/advisory/ntap-20200608-0001/ - http://www.openwall.com/lists/oss-security/2020/08/24/1
CVE ID: CVE-2019-20795 State: PUBLISHED Published: 2020-05-09T20:16:02 Last Updated: 2024-08-05T02:53:09.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10 - https://bug
//git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10 - https://bugzilla.suse.com/show_bug.cgi?id=1171452 - https://usn.ubuntu.com/4357-1/ - https://security.gentoo.org/glsa/202008-06
CVE ID: CVE-2019-20797 State: PUBLISHED Published: 2020-05-17T23:06:33 Last Updated: 2024-08-05T02:53:09.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in e6y prboom-plus 2.5.1.5. There is a buffer overflow in client and server code responsible for handling received UDP packets, as demonstrated by I_SendPacket or I_SendPacketTo in i_network.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/prboom-plus/bugs/252/ - https://sourceforge.net/p/prboom-plus/bugs/253/ - https://logicaltrust.net/blog/2019/10/prboom1.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
g/2019/10/prboom1.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77J22ZEQXS5SAYZGBDJ475AKFFJNKX5L/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3WS7GRZUIHCGLFET33MGC3PEKCH37W6/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00028.html
CVE ID: CVE-2019-20798 State: PUBLISHED Published: 2020-05-17T23:06:16 Last Updated: 2024-08-05T02:53:09.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://logicaltrust.net/blog/2019/11/cherokee.html - https://github.com/cherokee/webserver/issues/1227 - https://security.gentoo.org/glsa/2020
t/blog/2019/11/cherokee.html - https://github.com/cherokee/webserver/issues/1227 - https://security.gentoo.org/glsa/202012-09
CVE ID: CVE-2019-20799 State: PUBLISHED Published: 2020-05-17T23:06:01 Last Updated: 2024-08-05T02:53:09.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server. Additional Analyst Notes: - CVE Program Container: References: - https://logicaltrust.net/blog/2019/11/cherokee.html - https://github.com/cherokee/webserver/issues/1226 - https://github.com/cherokee/webserver/issues/1225 - https://github.com/cherokee/webserver/issues/1222 - https://github.com/cherokee/webserver/issues/1221 - https://security.gentoo.org/glsa/202012-09
CVE ID: CVE-2019-20800 State: PUBLISHED Published: 2020-05-17T23:05:45 Last Updated: 2024-08-05T02:53:09.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request headers, as demonstrated by a GET request with many "Host: 127.0.0.1" headers. Additional Analyst Notes: - CVE Program Container: References: - https://logicaltrust.net/blog/2019/11/cherokee.html - https://github.com/cherokee/webserver/issues/1224 - https://security.gentoo.org/glsa/202012-09
CVE ID: CVE-2019-20801 State: PUBLISHED Published: 2020-05-17T23:05:30 Last Updated: 2024-08-05T02:53:09.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code (that accesses a user's data) via cross-origin requests. Additional Analyst Notes: - CVE Program Container: References: - https://apps.apple.com/us/app/documents-by-readdle/id364901807 - https://logicaltrust.net/blog/2019/12/documents.html#authorization
CVE ID: CVE-2019-20802 State: PUBLISHED Published: 2020-05-17T23:05:13 Last Updated: 2024-08-05T02:53:09.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names, leading to Stored XSS, which may be used to steal a user's data. This requires user interaction because there is no known direct way for an attacker to create a crafted directory name on a victim's device. However, a crafted directory name can occur if a victim extracts a ZIP archive that was provided by an attacker. Additional Analyst Notes: - CVE Program Container: Refere
ictim extracts a ZIP archive that was provided by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://apps.apple.com/us/app/documents-by-readdle/id364901807 - https://logicaltrust.net/blog/2019/12/documents.html#xss
CVE ID: CVE-2019-20803 State: PUBLISHED Published: 2020-05-21T21:51:11 Last Updated: 2024-08-05T02:53:09.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_theme. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GilaCMS/gila/issues/56 - http://seclists.org/fulldisclosure/2020/Jun/29 - http://packetstormsecurity.com/files/158201/GilaCMS-1.11.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE ID: CVE-2019-20804 State: PUBLISHED Published: 2020-05-21T21:51:03 Last Updated: 2024-08-05T02:53:09.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GilaCMS/gila/issues/57 - http://seclists.org/fulldisclosure/2020/Jun/29 - http://packetstormsecurity.com/files/158201/GilaCMS-1.11.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE ID: CVE-2019-20805 State: PUBLISHED Published: 2020-06-01T13:50:27 Last Updated: 2024-08-05T02:53:09.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/upx/upx/commit/8be9da8280dfa69d5df4417d4d81bda1cab78010 - https://github.com/upx/upx/issues/317