Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-13383 State: PUBLISHED Published: 2019-07-16T16:54:34 Last Updated: 2024-08-04T23:49:24.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13383.md - http://packetstormsecurity.com/files/153667/CentOS-Control-Web-Panel-0.9.8.838-User-Enumeration.html - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
CVE ID: CVE-2019-13385 State: PUBLISHED Published: 2019-07-26T12:05:59 Last Updated: 2024-08-04T23:49:24.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log. Additional Analyst Notes: - CVE Program Container: References: - https://centos-webpanel.com/changelog-cwp7 - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13385.md - http://packetstormsecurity.com/files/153877/CentOS-Control-Web-Panel-0.9.8.840-User-Enumeration.html
CVE ID: CVE-2019-13386 State: PUBLISHED Published: 2019-07-26T12:06:29 Last Updated: 2024-08-04T23:49:24.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege. Additional Analyst Notes: - CVE Program Container: References: - https://centos-webpanel.com/changelog-cwp7 - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13386.md - http://packetstormsecurity.com/files/153876/CentOS-Control-Web-Panel-0.9.8.836-Remote-Command-Execution.html
CVE ID: CVE-2019-13387 State: PUBLISHED Published: 2019-07-26T12:06:57 Last Updated: 2024-08-04T23:49:24.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website. Additional Analyst Notes: - CVE Program Container: References: - https://centos-webpanel.com/changelog-cwp7 - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13387.md - http://packetstormsecurity.com/files/153878/CentOS-Control-Web-Panel-0.9.8.846-Cross-Site-Scripting.html
CVE ID: CVE-2019-13389 State: PUBLISHED Published: 2020-03-20T00:00:00 Last Updated: 2024-08-04T23:49:24.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RainLoop/rainloop-webmail/commit/8eb4588917b4741889fdd905d4c32e3e86317693 - https://lists.debian.org/debian-lts-announce/2023/05/msg00027.html
CVE ID: CVE-2019-13390 State: PUBLISHED Published: 2019-07-07T21:16:28 Last Updated: 2024-08-04T23:49:24.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. Additional Analyst Notes: - CVE Program Container: References: - https://trac.ffmpeg.org/ticket/7979 - http://www.securityfocus.com/bid/109090 - https://security.gentoo.org/glsa/202003-65 - https://www.debian.org/security/2020/dsa-4722 - https://lists.debian.org/debian-lts-announce/2020/07/msg00022.html - https://usn.ubuntu.com/4431-1/
CVE ID: CVE-2019-13391 State: PUBLISHED Published: 2019-07-07T21:16:44 Last Updated: 2024-08-04T23:49:24.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1588 - https://github.com/ImageMagick/ImageMagick/commit/7c2c5ba5b8e3a0b2b82f56c71dfab74ed4006df7 - https://github.com/ImageMagick/ImageMagick6/commit/f6ffc702c6eecd963587273a429dcd608c648984 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg
gick6/commit/f6ffc702c6eecd963587273a429dcd608c648984 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html - https://usn.ubuntu.com/4192-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2019-13392 State: PUBLISHED Published: 2019-10-15T23:52:24 Last Updated: 2024-08-04T23:49:25.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid. Additional Analyst Notes: - CVE Program Container: References: - https://mindpalette.com/tag/natemail/ - https://twitter.com/mindpalette - https://www.d
Program Container: References: - https://mindpalette.com/tag/natemail/ - https://twitter.com/mindpalette - https://www.doyler.net/security-not-included/natemail-vulnerabilities
CVE ID: CVE-2019-13393 State: PUBLISHED Published: 2020-03-13T17:27:33 Last Updated: 2024-08-04T23:49:24.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared key. Either an attack against HTTP Basic Authentication or an attack against WPA2 could be used to determine this passphrase. Additional Analyst Notes: - CVE Program Container: References: - https://www.doyler.net/security-not-included/voo-netgear-cg3700b-vulnerabilities
CVE ID: CVE-2019-13394 State: PUBLISHED Published: 2020-03-13T17:26:17 Last Updated: 2024-08-04T23:49:25.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://www.doyler.net/security-not-included/voo-netgear-cg3700b-vulnerabilities
CVE ID: CVE-2019-13395 State: PUBLISHED Published: 2020-03-13T17:24:30 Last Updated: 2024-08-04T23:49:25.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys, restore the router to factory settings, or even upload an entire malicious configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.doyler.net/security-not-included/voo-netgear-cg3700b-vulnerabilities
CVE ID: CVE-2019-13396 State: PUBLISHED Published: 2019-07-10T13:45:05 Last Updated: 2024-08-04T23:49:25.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module. Additional Analyst Notes: - CVE Program Container: References: - http://getflightpath.com/node/2650 - http://packetstormsecurity.com/files/153626/FlightPath-Local-File-Inclusion.html
CVE ID: CVE-2019-13397 State: PUBLISHED Published: 2019-07-09T16:54:45 Last Updated: 2024-08-04T23:49:25.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40sarapremashish/osticket-1-10-1-unauthenticated-stored-xss-allows-an-attacker-to-gain-admin-privileges-6a0348761a3a
CVE ID: CVE-2019-13398 State: PUBLISHED Published: 2019-07-08T00:01:43 Last Updated: 2024-08-04T23:49:25.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE ID: CVE-2019-13399 State: PUBLISHED Published: 2019-07-08T00:01:53 Last Updated: 2024-08-04T23:49:25.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation. Additional Analyst Notes: - CVE Program Container: References: - https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE ID: CVE-2019-13400 State: PUBLISHED Published: 2019-07-08T00:02:05 Last Updated: 2024-08-04T23:49:24.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info. Additional Analyst Notes: - CVE Program Container: References: - https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE ID: CVE-2019-13401 State: PUBLISHED Published: 2019-07-08T00:02:12 Last Updated: 2024-08-04T23:49:25.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/. Additional Analyst Notes: - CVE Program Container: References: - https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE ID: CVE-2019-13402 State: PUBLISHED Published: 2019-07-08T00:02:20 Last Updated: 2024-08-04T23:49:24.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset. Additional Analyst Notes: - CVE Program Container: References: - https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE ID: CVE-2019-13403 State: PUBLISHED Published: 2019-07-17T16:04:43 Last Updated: 2024-08-04T23:49:24.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/B3Bo1d/CVE-2019-13403/
CVE ID: CVE-2019-13404 State: PUBLISHED Published: 2019-07-08T00:54:41 Last Updated: 2024-08-04T23:49:24.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x Additional Analyst Notes: - CVE Program Container: References: - https://docs.python.org/2/faq/w
n the default for 2.7.x Additional Analyst Notes: - CVE Program Container: References: - https://docs.python.org/2/faq/windows.html
CVE ID: CVE-2019-13405 State: PUBLISHED Published: 2019-08-29T00:19:23.331985Z Last Updated: 2024-09-16T22:24:40.037Z Vendors: AndroVideo Products: Advan VD-1 firmware Problem Types: Broken access control Description: A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md - https://
st.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md - https://tvn.twcert.org.tw/taiwanvn/TVN-201906006 - http://surl.twcert.org.tw/VeNHn
CVE ID: CVE-2019-13406 State: PUBLISHED Published: 2019-08-29T00:19:32.626025Z Last Updated: 2024-09-16T23:16:16.188Z Vendors: AndroVideo Products: Advan VD-1 firmware Problem Types: Broken access control Description: A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md - https://tvn.twcert.org.tw/taiwanvn/TVN-201906007 - http://surl.twcert.org.tw/hVut7
CVE ID: CVE-2019-13407 State: PUBLISHED Published: 2019-08-29T00:19:39.243018Z Last Updated: 2024-09-16T22:16:10.244Z Vendors: AndroVideo Products: Advan VD-1 firmware Problem Types: CWE-79 Description: A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md - https://tvn.twcert.org.tw/taiwanvn/TVN-201906008 - http://surl.twcert.org.t
deo-advan-vd-1-multiple-vulnerabilities-md - https://tvn.twcert.org.tw/taiwanvn/TVN-201906008 - http://surl.twcert.org.tw/SpTwh
CVE ID: CVE-2019-13408 State: PUBLISHED Published: 2019-08-29T00:18:52.900362Z Last Updated: 2024-09-17T01:26:55.568Z Vendors: AndroVideo Products: Advan VD-1 firmware Problem Types: CWE-23 Description: A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md - https://tvn.twcert.org.tw/taiwanvn/TVN-201906009 - http://surl.twcert.org.tw/2bvXq
CVE ID: CVE-2019-13409 State: PUBLISHED Published: 2019-10-17T19:24:35.696598Z Last Updated: 2024-09-16T20:17:31.925Z Vendors: TOPOO Technology Products: TOPMeeting Problem Types: CWE-89 Description: A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19). An attacker can use a union based injection query string though a search meeting room feature to get databases schema and username/password. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/en/cp-128-3019-f0dd8-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201907001
CVE ID: CVE-2019-13410 State: PUBLISHED Published: 2019-10-17T19:25:59.880594Z Last Updated: 2024-09-16T18:12:58.445Z Vendors: TOPOO Technology Products: TOPMeeting Problem Types: CWE-200 Description: TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/en/cp-128-3020-27eb5-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201907002
CVE ID: CVE-2019-13411 State: PUBLISHED Published: 2019-10-17T17:42:23.854782Z Last Updated: 2024-09-16T23:27:00.636Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: HiNET Products: GPON Problem Types: execute arbitrary command Description: An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 3097. CVSS 3.0 Base score 10.0. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/en/cp-128-3013-92adb-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201908005
CVE ID: CVE-2019-13412 State: PUBLISHED Published: 2019-10-17T19:21:13.687917Z Last Updated: 2024-09-16T21:02:20.317Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: HiNET Products: GPON Problem Types: read arbitrary files Description: A service which is hosted on port 3097 in HiNet GPON firmware < I040GWR190731 allows an attacker to execute a specific command to read arbitrary files. CVSS 3.0 Base score 9.3. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/en/cp-128-3014-904b1-2.html - https://tvn.twcert.org.tw/taiwanvn/TVN-201908006
CVE ID: CVE-2019-13413 State: PUBLISHED Published: 2019-07-08T13:05:15 Last Updated: 2024-08-04T23:49:25.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2119248 - https://wordpress.org/plugins/rencontre/#developers - https://wpvulndb.com/vulnerabilities/9430
CVE ID: CVE-2019-13414 State: PUBLISHED Published: 2019-07-08T13:05:24 Last Updated: 2024-08-04T23:49:24.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2119248 - https://wordpress.org/plugins/rencontre/#developers - https://wpvulndb.com/vulnerabilities/9430
CVE ID: CVE-2019-13415 State: PUBLISHED Published: 2019-08-13T18:59:59 Last Updated: 2024-08-04T23:49:25.025Z Vendors: floragunn Products: Search Guard Problem Types: CWE-280 Description: Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see. Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3
CVE ID: CVE-2019-13416 State: PUBLISHED Published: 2019-08-13T18:58:45 Last Updated: 2024-08-04T23:49:24.948Z Vendors: floragunn Products: Search Guard Problem Types: CWE-285 Description: Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s). Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3
CVE ID: CVE-2019-13417 State: PUBLISHED Published: 2019-08-12T20:51:23 Last Updated: 2024-08-04T23:49:24.956Z Vendors: floragunn Products: Search Guard Problem Types: CWE-863 Description: Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated. Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_0
CVE ID: CVE-2019-13418 State: PUBLISHED Published: 2019-08-12T21:12:11 Last Updated: 2024-08-04T23:49:24.950Z Vendors: floragunn Products: Search Guard Problem Types: CWE-311 Description: Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_0
CVE ID: CVE-2019-13419 State: PUBLISHED Published: 2019-08-13T14:28:44 Last Updated: 2024-08-04T23:49:24.983Z Vendors: floragunn Products: Search Guard Problem Types: CWE-311 Description: Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-23/changelog-searchguard-6-x-23_1
CVE ID: CVE-2019-13420 State: PUBLISHED Published: 2019-08-13T14:25:43 Last Updated: 2024-08-04T23:49:24.991Z Vendors: floragunn Products: Search Guard Problem Types: CWE-208 Description: Search Guard versions before 21.0 had an timing side channel issue when using the internal user database. Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-21/changelog-searchguard-6-x-21_0
CVE ID: CVE-2019-13421 State: PUBLISHED Published: 2019-08-23T13:26:46 Last Updated: 2024-08-04T23:49:25.010Z Vendors: floragunn Products: Search Guard Problem Types: CWE-522 Description: Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database. Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-23/changelog-searchguard-6-x-23_1 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SySS-2018-025.txt
CVE ID: CVE-2019-13422 State: PUBLISHED Published: 2019-08-23T13:35:03 Last Updated: 2024-08-04T23:49:24.959Z Vendors: floragunn Products: Search Guard Kibana Plugin Problem Types: CWE-601, CWE-79 Description: Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login. Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-25/changelog-kibana-6.x-12
CVE ID: CVE-2019-13423 State: PUBLISHED Published: 2019-08-23T13:30:26 Last Updated: 2024-08-04T23:49:24.978Z Vendors: floragunn Products: Search Guard Kibana Plugin Problem Types: CWE-287 Description: Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana is configured to use Single-Sign-On as authentication method, one of Kerberos, JWT, Proxy, Client certificate. b) The kibanaserver user is configured to use HTTP Basic as the authentication method. c) Search Guard is configured to use an SSO authe
ver user is configured to use HTTP Basic as the authentication method. c) Search Guard is configured to use an SSO authentication domain and HTTP Basic at the same time Additional Analyst Notes: - CVE Program Container: References: - https://search-guard.com/cve-advisory/ - https://docs.search-guard.com/6.x-25/changelog-kibana-6.x-12