Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-11818 State: PUBLISHED Published: 2019-05-08T15:34:45 Last Updated: 2024-08-04T23:03:32.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name), which will be executed whenever the affected snippet is loaded. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alkacon/opencms-core/issues/635 - https://www.openwall.com/lists/oss-security/2019/04/30/3
CVE ID: CVE-2019-11819 State: PUBLISHED Published: 2019-05-08T15:35:06 Last Updated: 2024-08-04T23:03:32.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alkacon/opencms-core/issues/636 - https://www.openwall.com/lists/oss-security/2019/05/05/2
CVE ID: CVE-2019-11820 State: PUBLISHED Published: 2019-05-09T05:35:13.458596Z Last Updated: 2024-09-16T20:12:35.910Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: Synology Products: Calendar Problem Types: CWE-522 Description: Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_21
CVE ID: CVE-2019-11821 State: PUBLISHED Published: 2019-06-30T15:00:22.620200Z Last Updated: 2024-09-17T01:46:34.857Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Synology Products: Photo Station Problem Types: CWE-89 Description: SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_01
CVE ID: CVE-2019-11822 State: PUBLISHED Published: 2019-06-30T15:00:22.668296Z Last Updated: 2024-09-17T02:41:18.093Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Synology Products: Photo Station Problem Types: CWE-23 Description: Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_01
CVE ID: CVE-2019-11823 State: PUBLISHED Published: 2020-05-04T10:00:18.576975Z Last Updated: 2024-09-16T19:35:18.333Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-125 Description: CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_11 - https://www.talosintelligence.com/vulnerability_reports/TALOS-20
/www.synology.com/security/advisory/Synology_SA_20_11 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1051
CVE ID: CVE-2019-11824 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2019-11825 State: PUBLISHED Published: 2019-06-30T15:00:18.477834Z Last Updated: 2024-09-16T20:03:10.238Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Calendar Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML via the title parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_04
CVE ID: CVE-2019-11826 State: PUBLISHED Published: 2019-06-30T15:00:13.105288Z Last Updated: 2024-09-16T16:43:02.971Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Synology Products: Photo Moments Problem Types: CWE-23 Description: Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_05
CVE ID: CVE-2019-11827 State: PUBLISHED Published: 2019-06-30T15:05:20.451500Z Last Updated: 2024-09-16T17:39:01.402Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Note Station Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web script or HTML via the object_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_08
CVE ID: CVE-2019-11828 State: PUBLISHED Published: 2019-06-30T15:05:16.315278Z Last Updated: 2024-09-17T03:03:20.048Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Office Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_11
CVE ID: CVE-2019-11829 State: PUBLISHED Published: 2019-06-30T15:05:12.214987Z Last Updated: 2024-09-16T18:04:00.490Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Synology Products: Calendar Problem Types: CWE-78 Description: OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_12
CVE ID: CVE-2019-11830 State: PUBLISHED Published: 2019-05-09T03:51:50 Last Updated: 2024-08-04T23:03:33.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-psa-2019-008/ - https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1 - https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1 - https://lists.fedoraproject.org/archives
tag/v3.1.1 - https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/
CVE ID: CVE-2019-11831 State: PUBLISHED Published: 2019-05-09T03:52:01 Last Updated: 2024-08-04T23:03:32.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2019-007 - https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1 - https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1 - https://typo3.
r-stream-wrapper/releases/tag/v3.1.1 - https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1 - https://typo3.org/security/advisory/typo3-psa-2019-007/ - https://www.synology.com/security/advisory/Synology_SA_19_22 - http://www.securityfocus.com/bid/108302 - https://www.debian.org/security/2019/dsa-4445 - https://seclists.org/bugtraq/2019/May/36 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed
g/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/
CVE ID: CVE-2019-11832 State: PUBLISHED Published: 2019-05-09T04:09:11 Last Updated: 2024-08-04T23:03:32.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-core-sa-2019-012/ - http://www.securityfocus.com/bid/108305
CVE ID: CVE-2019-11833 State: PUBLISHED Published: 2019-05-15T12:19:44 Last Updated: 2024-08-04T23:03:32.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/592acbf16821288ecdc4192c47e3774a4c48bb64 - http://www.securityfocus.com/bid/108372 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html - https://lists.fedoraproject.org
id/108372 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJGZIMGB72TL7OGWRMHIL43WHXFQWU4X/ - https://www.debian.org/security/2019/dsa-4465 - https://lists.debian.org/debian-lts-announce/2019/06/msg00010.html - https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html - https://seclists.org/bugtraq/2019/Jun/26 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html - https://usn.ubuntu.com/4068-1/ - https://usn.ubuntu.com/4068-2/ - https://usn.ubuntu.com/4069-1
/2019-06/msg00048.html - https://usn.ubuntu.com/4068-1/ - https://usn.ubuntu.com/4068-2/ - https://usn.ubuntu.com/4069-1/ - https://usn.ubuntu.com/4076-1/ - https://usn.ubuntu.com/4069-2/ - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029 - https://usn.ubuntu.com/4095-2/ - https://usn.ubuntu.com/4118-1/ - http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html - https://access.redhat.com/errata/RHSA-2019:3309 - https://access.redhat.com/errata/RHSA-2019:3517
CVE ID: CVE-2019-11834 State: PUBLISHED Published: 2019-05-09T04:38:26 Last Updated: 2024-08-04T23:03:32.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/DaveGamble/cJSON/issues/337 - https://github.com/DaveGamble/cJSON/releases/tag/v1.7.11 - https://github.com/DaveGamble/cJSON/compare/c69134d...93688cb
CVE ID: CVE-2019-11835 State: PUBLISHED Published: 2019-05-09T04:38:38 Last Updated: 2024-08-04T23:03:32.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/DaveGamble/cJSON/releases/tag/v1.7.11 - https://github.com/DaveGamble/cJSON/compare/c69134d...93688cb - https://github.com/DaveGamble/cJSON/issues/338
CVE ID: CVE-2019-11836 State: PUBLISHED Published: 2019-05-09T12:23:12 Last Updated: 2024-08-04T23:03:32.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rediffmail (aka com.rediff.mail.and) application 2.2.6 for Android has cleartext mail content in file storage, persisting after a logout. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/811Rishi/status/1122603147183017985
CVE ID: CVE-2019-11837 State: PUBLISHED Published: 2019-05-09T13:07:21 Last Updated: 2024-08-04T23:03:32.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxt_utf8_next in nxt/nxt_utf8.h and njs_string_offset in njs/njs_string.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nginx/njs/issues/155
CVE ID: CVE-2019-11838 State: PUBLISHED Published: 2019-05-09T13:07:29 Last Updated: 2024-08-04T23:03:32.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njs_array_prototype_splice in njs/njs_array.c, because of njs_array_expand size mishandling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nginx/njs/issues/153
CVE ID: CVE-2019-11839 State: PUBLISHED Published: 2019-05-09T13:07:38 Last Updated: 2024-08-04T23:03:32.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs_array_prototype_push in njs/njs_array.c, because of njs_array_expand size mishandling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nginx/njs/issues/152
CVE ID: CVE-2019-11840 State: PUBLISHED Published: 2019-05-09T00:00:00 Last Updated: 2024-08-04T23:03:32.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa packages. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of co
incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ - https://bugzilla.redhat.com/show_bug.cgi?id=1691529 - https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d - https://github.com/golang/go/issues/30965 - https://lists.debian.org/debian-lts-announce/2019/06/msg00029.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html - https://lists.debian.org/debi
19/06/msg00029.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00016.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00030.html - https://lists.debian.org/debian-lts-announce/2021/01/msg00015.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html - https://pkg.go.dev/vuln/GO-2022-0209
CVE ID: CVE-2019-11841 State: PUBLISHED Published: 2019-05-22T00:00:00 Last Updated: 2024-08-04T23:03:32.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The "Hash" Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a vict
ackage ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/ - https://go.googlesource.com/crypto/ - http://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html - https://sec-consul
tp://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html - https://sec-consult.com/en/blog/advisories/cleartext-message-spoofing-in-go-cryptography-libraries-cve-2019-11841/ - https://lists.debian.org/debian-lts-announce/2019/09/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
CVE ID: CVE-2019-11842 State: PUBLISHED Published: 2019-05-09T17:06:43 Last Updated: 2024-08-04T23:03:32.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID. Additional Analyst Notes: - CVE Program Container: References: - https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/
CVE ID: CVE-2019-11843 State: PUBLISHED Published: 2020-06-02T16:45:17 Last Updated: 2024-08-04T23:03:32.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS). Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/mailpoet/#developers - https://github.com/mailpoet/mailpoet/releases/tag/3.23.2 - https://pluginarchive.com/wordpress/mailpoet/v/3-23-2
CVE ID: CVE-2019-11844 State: PUBLISHED Published: 2019-05-14T17:42:13 Last Updated: 2024-08-04T23:03:32.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/152790/RICOH-SP-4520DN-Printer-HTML-Injection.html
CVE ID: CVE-2019-11845 State: PUBLISHED Published: 2019-05-14T17:39:13 Last Updated: 2024-08-04T23:03:32.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/152789/RICOH-SP-4510DN-Printer-HTML-Injection.html
CVE ID: CVE-2019-11846 State: PUBLISHED Published: 2019-05-14T17:26:54 Last Updated: 2024-08-04T23:03:32.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/152788/dotCMS-5.1.1-HTML-Injection.html
CVE ID: CVE-2019-11847 State: PUBLISHED Published: 2020-08-21T18:40:24.325789Z Last Updated: 2024-09-17T01:46:40.701Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shell. Additional Analyst Notes: - CVE Program Container: References: - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE ID: CVE-2019-11848 State: PUBLISHED Published: 2020-08-21T18:44:31.302049Z Last Updated: 2024-09-17T03:49:13.339Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: n/a Problem Types: n/a Description: An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values. Additional Analyst Notes: - CVE Program Container: References: - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE ID: CVE-2019-11849 State: PUBLISHED Published: 2020-08-21T18:41:32.311622Z Last Updated: 2024-09-16T21:07:58.758Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution. Additional Analyst Notes: - CVE Program Container: References: - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/
CVE ID: CVE-2019-11850 State: PUBLISHED Published: 2020-08-21T18:42:53.195665Z Last Updated: 2024-09-16T16:47:49.506Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution Additional Analyst Notes: - CVE Program Container: References: - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/