Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-14351 State: PUBLISHED Published: 2019-07-28T15:27:05 Last Updated: 2024-08-05T00:12:43.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espocrm/espocrm/issues/1357
CVE ID: CVE-2019-14352 State: PUBLISHED Published: 2019-07-28T16:40:59 Last Updated: 2024-08-05T00:12:43.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists, as demonstrated by jw/web/userview/crm_community/crm_userview_sales/_/account_new with the Account ID or Account Name field. NOTE: the vendor disputes the relevance of this finding because CSV is not the intended export format for spreadsheet applications Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jogetworkflow/jw-community/issues/20
CVE ID: CVE-2019-14353 State: PUBLISHED Published: 2019-08-08T18:52:43 Last Updated: 2024-08-05T00:12:43.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-c
s, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: this CVE applies exclusively to the Trezor One, and does not refer to any issues with OLED displays on other devices. Additional Analyst Notes: - CVE Program Container: References: - https://blog.trezor.io/details-of-the-oled-vulnerability-and-its-mitigation-d331c4e2001a
CVE ID: CVE-2019-14354 State: PUBLISHED Published: 2019-08-10T15:07:20 Last Updated: 2024-08-05T00:12:43.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-
ds, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. Additional Analyst Notes: - CVE Program Container: References: - https://ledger-donjon.github.io/oled-vuln/
CVE ID: CVE-2019-14355 State: PUBLISHED Published: 2019-08-10T15:41:57 Last Updated: 2024-08-05T00:12:43.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover secret data shown on the display. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a
ant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is "insignificant risk. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/shapeshift-stories/shapeshift-security-update-5b0dd45c93db
CVE ID: CVE-2019-14356 State: PUBLISHED Published: 2019-10-31T17:59:42 Last Updated: 2024-08-05T00:12:43.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-cons
the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemon
n the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: At Coinkite, we’ve already mitigated it, even though we feel strongly that it is not a legitimate issue. In our opinion, it is both unproven (might not even work) and also completely impractical—even if it could be made to work perfectly Additio
s both unproven (might not even work) and also completely impractical—even if it could be made to work perfectly Additional Analyst Notes: - CVE Program Container: References: - https://github.com/someone42/hardware-bitcoin-wallet/blob/master/pic32/ssd1306.c - https://blog.coinkite.com/noise-troll/
CVE ID: CVE-2019-14357 State: PUBLISHED Published: 2019-08-10T15:54:57 Last Updated: 2024-08-05T00:12:43.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at
vant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that an attack is not "realistically implementable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/limpkin/mooltipass/blob/master/CVE-2019-14357_statement.md
CVE ID: CVE-2019-14358 State: PUBLISHED Published: 2019-11-02T16:26:43 Last Updated: 2024-08-05T00:12:43.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Archos Safe-T devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption
e channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. Additional Analyst Notes: - CVE Program Container: References: - https://blog.inhq.net/posts/oled-side-channel-status-summary/
CVE ID: CVE-2019-14359 State: PUBLISHED Published: 2019-08-12T22:31:34 Last Updated: 2024-08-05T00:12:43.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover a data value. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data
er has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is no security impact: the only potentially leaked information is the number of characters in the PIN Additional Analyst Notes: - CVE Program Container: References: - https://bc-vault.com/2019/08/our-response-to-cve-2019-14359
CVE ID: CVE-2019-14360 State: PUBLISHED Published: 2019-11-02T16:27:28 Last Updated: 2024-08-05T00:12:43.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Hyundai Pay Kasse HK-1000 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power
rds, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. Additional Analyst Notes: - CVE Program Container: References: - https://blog.inhq.net/posts/oled-side-channel-status-summary/
CVE ID: CVE-2019-14361 State: REJECTED Published: 2019-07-31T10:13:49 Last Updated: 2019-07-31T10:13:49 Description: No description available.
CVE ID: CVE-2019-14362 State: PUBLISHED Published: 2019-07-28T17:26:06 Last Updated: 2024-08-05T00:12:43.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value. Additional Analyst Notes: - CVE Program Container: References: - https://www.sitincloud.com/securite/directory-traversal-openbravo-erp/ - https://grep.blog/directory-traversal-openbravo/ - https://issues.openbravo.com/view.php?id=41413
CVE ID: CVE-2019-14363 State: PUBLISHED Published: 2019-07-28T17:33:19 Last Updated: 2024-08-05T00:12:43.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.18_1.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/reevesrs24/CVE/blob/master/Netgear_WNDR2400v3/upnp_stack_overflow/upnp_stack_overflow.md
CVE ID: CVE-2019-14364 State: PUBLISHED Published: 2019-07-28T17:43:35 Last Updated: 2024-08-05T00:12:43.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/email-subscribers/#developers - https://github.com/ivoschyk-cs/CVE-s/blob/master/Email%20Subscribers%20%26%20Newsletters%20Wordpress%20Plugin%20%28XSS%29 - https://wpvulndb.com/vulnera
VE-s/blob/master/Email%20Subscribers%20%26%20Newsletters%20Wordpress%20Plugin%20%28XSS%29 - https://wpvulndb.com/vulnerabilities/9508
CVE ID: CVE-2019-14365 State: PUBLISHED Published: 2019-11-12T20:47:16 Last Updated: 2024-08-05T00:19:39.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.). Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef
CVE ID: CVE-2019-14366 State: PUBLISHED Published: 2019-11-12T20:47:12 Last Updated: 2024-08-05T00:19:39.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.). Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef
CVE ID: CVE-2019-14367 State: PUBLISHED Published: 2019-11-12T20:47:07 Last Updated: 2024-08-05T00:19:39.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/arjunmat/slack-chat/commits/master - https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef
CVE ID: CVE-2019-14368 State: PUBLISHED Published: 2019-07-28T18:43:40 Last Updated: 2024-08-05T00:19:39.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetadata() in rafimage.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/952
CVE ID: CVE-2019-14369 State: PUBLISHED Published: 2019-07-28T00:00:00 Last Updated: 2024-08-05T00:19:39.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/953 - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE ID: CVE-2019-14370 State: PUBLISHED Published: 2019-07-28T00:00:00 Last Updated: 2024-08-05T00:19:40.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/954 - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE ID: CVE-2019-14371 State: PUBLISHED Published: 2019-07-28T18:44:03 Last Updated: 2024-08-05T00:19:39.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Libav 12.3. There is an infinite loop in the function mov_probe in the file libavformat/mov.c, related to offset and tag. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.libav.org/show_bug.cgi?id=1163
CVE ID: CVE-2019-14372 State: PUBLISHED Published: 2019-07-28T18:44:12 Last Updated: 2024-08-05T00:19:41.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.libav.org/show_bug.cgi?id=1165 - https://lists.debian.org/debian-lts-announce/2019/09/msg00000.html
CVE ID: CVE-2019-14373 State: PUBLISHED Published: 2019-07-28T18:44:19 Last Updated: 2024-08-05T00:19:39.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a heap-based buffer over-read in libpng via a crafted flif file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FLIF-hub/FLIF/issues/541
CVE ID: CVE-2019-14378 State: PUBLISHED Published: 2019-07-29T10:05:22 Last Updated: 2024-08-05T00:19:40.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/slirp/libslirp/commit/126c04acbabd7ad32c2b018fe10dfac2a3bc1210 - http://www.openwall.com/lists/oss-security/2019/08/01/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPLHB2AN663OXAWUQURF7J2X5LHD4VD3/ - https://seclists.org/bugtra
/list/package-announce%40lists.fedoraproject.org/message/UPLHB2AN663OXAWUQURF7J2X5LHD4VD3/ - https://seclists.org/bugtraq/2019/Aug/41 - https://www.debian.org/security/2019/dsa-4506 - https://blog.bi0s.in/2019/08/24/Pwn/VM-Escape/2019-07-29-qemu-vm-escape-cve-2019-14378/ - https://news.ycombinator.com/item?id=20799010 - http://packetstormsecurity.com/files/154269/QEMU-Denial-Of-Service.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html - https://www.debian.org/security/2019/dsa-4512 - https://seclists.org/bugtraq/2019/Sep/3 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html - https://support.f5.com/csp/article/K25423748 - https://lists
suse.org/opensuse-security-announce/2019-09/msg00008.html - https://support.f5.com/csp/article/K25423748 - https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html - https://support.f5.com/csp/article/K25423748?utm_source=f5support&amp%3Butm_medium=RSS - https://access.redhat.com/errata/RHSA-2019:3179 - https://access.redhat.com/errata/RHSA-2019:3403 - https://access.redhat.com/errata/RHSA-2019:3494 - https://access.redhat.com/errata/RHSA-2019:3742 - https://access.redhat.com/errata/RHSA-2019:3787 - https://usn.ubuntu.com/4191-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html - https://usn.ubuntu.com/4191-1/ - https://access.redhat.com/errata/RHSA-2019
se-security-announce/2019-11/msg00034.html - https://usn.ubuntu.com/4191-1/ - https://access.redhat.com/errata/RHSA-2019:3968 - https://access.redhat.com/errata/RHSA-2019:4344 - https://access.redhat.com/errata/RHSA-2020:0366 - https://access.redhat.com/errata/RHSA-2020:0775
CVE ID: CVE-2019-14379 State: PUBLISHED Published: 2019-07-29T11:42:42 Last Updated: 2024-08-05T00:19:40.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html - https://lists.apache.org/thread.html/e25e734c315f70d8876a846926cfe3bfa1a4888044f146e844caf72f%40%3Ccommits.ambari.apache.org%3E - https://lists.apache.org/thread.html/f
f70d8876a846926cfe3bfa1a4888044f146e844caf72f%40%3Ccommits.ambari.apache.org%3E - https://lists.apache.org/thread.html/f17f63b0f8a57e4a5759e01d25cffc0548f0b61ff5c6bfd704ad2f2a%40%3Ccommits.ambari.apache.org%3E - https://lists.apache.org/thread.html/525bcf949a4b0da87a375cbad2680b8beccde749522f24c49befe7fb%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee
he.org%3E - https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E - https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c
6d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E - https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:2743 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor
message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/ - https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:2937 - https://access.redhat.com/errata/RHSA-2019:2935 - https://access.redhat.com/errata/RHSA-2019:2936 - https://access.redhat.com/errata/RHSA-2019:2938 - https://access.redhat.com/errata/RHSA-2019:2998 - https://lists.apache.org/thread.html/859815b2e9f1575acbb2b260b73861c16ca49bca627fa0c464190