Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12922 State: PUBLISHED Published: 2019-09-13T12:27:04 Last Updated: 2024-08-04T23:32:55.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Sep/23 - http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html - https://www.exploit-db.com/exploits/47385 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00078.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBLBE6CSC2ZLINIRBU
ml - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBLBE6CSC2ZLINIRBUU5XBLXYVBTF3KA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCB3PTGHZ7AJCM6BKCQRRP6HG3OKYCMN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QJ5BW2VEMD2P23ZYRWHDBEQHOKGKGWD6/ - https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161 - https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html
CVE ID: CVE-2019-12923 State: PUBLISHED Published: 2019-07-08T20:58:30 Last Updated: 2024-08-04T23:32:55.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly performing actions within the application (such as sending email, adding contacts, or changing settings) on behalf of the attacker. Additional Analyst Notes: - CVE Program Container: References: - http://www.mailenable.com/Premium-R
lf of the attacker. Additional Analyst Notes: - CVE Program Container: References: - http://www.mailenable.com/Premium-ReleaseNotes.txt - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
CVE ID: CVE-2019-12924 State: PUBLISHED Published: 2019-07-08T21:00:00 Last Updated: 2024-08-04T23:32:55.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all credentials were stored in a cleartext file, it was possible to steal all users' credentials (including the highest privileged users). Additional Analyst Notes: - CVE Program Container: References: - http://www.mailenable.com/Premium-R
privileged users). Additional Analyst Notes: - CVE Program Container: References: - http://www.mailenable.com/Premium-ReleaseNotes.txt - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
CVE ID: CVE-2019-12925 State: PUBLISHED Published: 2019-07-08T21:01:24 Last Updated: 2024-08-04T23:32:55.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to reading other users' credentials including those of SYSADMIN accounts, reading other users' emails, or adding emails or files to other users' accounts. Additional Analyst Notes: - CVE Program Container: References: - http://www.mailenable.com/Premium-ReleaseNotes.txt - https://www.nccgroup.trust
: - CVE Program Container: References: - http://www.mailenable.com/Premium-ReleaseNotes.txt - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
CVE ID: CVE-2019-12926 State: PUBLISHED Published: 2019-07-08T21:03:06 Last Updated: 2024-08-04T23:32:55.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas within the application for which the accounts used were supposed to have insufficient access. Additional Analyst Notes: - CVE Program Container: References: - http://www.mailenable.com/Premium-ReleaseNotes.txt - https://www.nccgroup.trus
s: - CVE Program Container: References: - http://www.mailenable.com/Premium-ReleaseNotes.txt - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
CVE ID: CVE-2019-12927 State: PUBLISHED Published: 2019-07-08T21:04:35 Last Updated: 2024-08-04T23:32:55.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.mailenable.com/Premium-ReleaseNotes.txt - https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
CVE ID: CVE-2019-12928 State: PUBLISHED Published: 2019-06-24T10:06:44 Last Updated: 2024-08-04T23:32:55.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue Additional Analyst Notes: - CVE Program
ia a tcp socket open to the internet, then it is an insecure configuration issue Additional Analyst Notes: - CVE Program Container: References: - https://fakhrizulkifli.github.io/posts/2019/06/05/CVE-2019-12928/
CVE ID: CVE-2019-12929 State: PUBLISHED Published: 2019-06-24T10:07:43 Last Updated: 2024-08-04T23:32:55.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue Additional Analyst Notes: - CVE Program Container: Refer
pen to the internet, then it is an insecure configuration issue Additional Analyst Notes: - CVE Program Container: References: - https://fakhrizulkifli.github.io/posts/2019/06/06/CVE-2019-12929/
CVE ID: CVE-2019-12930 State: PUBLISHED Published: 2019-07-08T19:20:28 Last Updated: 2024-08-04T23:32:55.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/wikindx/code/2787 - https://sourceforge.net/p/wikindx/code/2788 - https://sourceforge.net/p/wikindx/news/2019/07/wikindx-581-released/
CVE ID: CVE-2019-12932 State: PUBLISHED Published: 2019-06-28T17:19:38 Last Updated: 2024-08-04T23:32:55.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out.Viewfolder.php. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG
CVE ID: CVE-2019-12933 State: REJECTED Published: 2019-06-22T18:07:20 Last Updated: 2019-08-05T19:56:44 Description: No description available.
CVE ID: CVE-2019-12934 State: PUBLISHED Published: 2019-07-19T23:47:55 Last Updated: 2024-08-04T23:32:55.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-code-highlightjs/#developers - https://zeroauth.ltd/blog/2019/07/17/cve-2019-12934-wp-code-highlightjs-wordpress-plugin-csrf-leads-to-blog-wide-injected-script-html/ - http://www.securityfocus.com/bid/10933
code-highlightjs-wordpress-plugin-csrf-leads-to-blog-wide-injected-script-html/ - http://www.securityfocus.com/bid/109331
CVE ID: CVE-2019-12935 State: PUBLISHED Published: 2019-06-23T22:23:15 Last Updated: 2024-08-04T23:32:55.570Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/153145/Shopware-5.5.6-Cross-Site-Scripting.html - https://www.netsparker.com/web-applications-advisories/ns-19-004-cross-site-scripting-in-shopware/ - https://www.shopware.com/en/changelog/#5-5-8 - http://seclists.org/fulldisclosure/2019/Jun/32
CVE ID: CVE-2019-12936 State: PUBLISHED Published: 2019-06-23T22:35:30 Last Updated: 2024-08-04T23:32:55.586Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions. Additional Analyst Notes: - CVE Program Container: References: - https://support.bluestacks.com/hc/en-us/articles/360028842471 - https://support.bluestacks.com/hc/en-us/articles/360021469391-Release-Notes
CVE ID: CVE-2019-12937 State: PUBLISHED Published: 2019-06-23T22:54:45 Last Updated: 2024-08-04T23:32:55.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: apps/gsudo.c in gsudo in ToaruOS through 1.10.9 has a buffer overflow allowing local privilege escalation to the root user via the DISPLAY environment variable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mehsauce/kowasuos/blob/master/exploits/kowasu-gsudo.c
CVE ID: CVE-2019-12938 State: PUBLISHED Published: 2019-06-24T13:07:31 Last Updated: 2024-08-04T23:32:55.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak - https://poste.io/changelog
CVE ID: CVE-2019-12939 State: PUBLISHED Published: 2019-06-24T15:06:25 Last Updated: 2024-08-04T23:32:55.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter. Additional Analyst Notes: - CVE Program Container: References: - https://forums.livezilla.net/index.php?/topic/10980-fg-vd-19-082-livezilla-server-is-vulnerable-to-sql-injection/ - http://www.securityfocus.com/bid/108890
CVE ID: CVE-2019-12940 State: PUBLISHED Published: 2019-06-24T15:06:36 Last Updated: 2024-08-04T23:32:55.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php via a large integer value of the depth parameter. Additional Analyst Notes: - CVE Program Container: References: - https://forums.livezilla.net/index.php?/topic/10981-fg-vd-19-084-livezilla-server-is-vulnerable-to-denial-of-service/
CVE ID: CVE-2019-12941 State: PUBLISHED Published: 2019-10-14T17:02:22 Last Updated: 2024-08-04T23:32:55.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output (input is only 8 characters), which allows an attacker to deduce the WiFi password from the WiFi SSID. Additional Analyst Notes: - CVE Program Container: References: - https://www.kth.se/nse/research/software-systems-architecture-and-securit
Notes: - CVE Program Container: References: - https://www.kth.se/nse/research/software-systems-architecture-and-security/ - http://www.diva-portal.org/smash/get/diva2:1334244/FULLTEXT01.pdf - https://www.kth.se/polopoly_fs/1.931922.1571071632%21/Burdzovic_Matsson_dongle_v2.pdf
CVE ID: CVE-2019-12942 State: PUBLISHED Published: 2019-09-10T20:48:24 Last Updated: 2024-08-04T23:32:55.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://www.kth.se/polopoly_fs/1.923565.1568098364%21/Vulnerability_Report_TTLock_State_Consistency.pdf
CVE ID: CVE-2019-12943 State: PUBLISHED Published: 2019-09-10T20:51:05 Last Updated: 2024-08-04T23:32:55.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information about valid account names. Additional Analyst Notes: - CVE Program Container: References: - https://www.kth.se/polopoly_fs/1.923564.1568098316%21/Vulnerability_Report_TTLock_Password_Reset.pdf
CVE ID: CVE-2019-12944 State: PUBLISHED Published: 2019-10-15T13:56:36 Last Updated: 2024-08-04T23:32:55.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://www.kth.se/polopoly_fs/1.931930.1571073241%21/Vulnerability_Report_Glue_State_Consistency.pdf - https://www.kth.se/polopoly_fs/1.914054.1561620889%21/Examensarbete%20Final.pdf
CVE ID: CVE-2019-12945 State: REJECTED Published: 2019-07-19T16:39:42 Last Updated: 2019-07-19T16:39:42 Description: No description available.
CVE ID: CVE-2019-12946 State: PUBLISHED Published: 2019-07-19T13:59:02 Last Updated: 2024-08-04T23:32:55.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://blog.contentsecurity.com.au/security-advisory-elcom-cms-sql-injection
CVE ID: CVE-2019-12948 State: PUBLISHED Published: 2019-07-29T15:16:41 Last Updated: 2024-08-04T23:32:55.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf
CVE ID: CVE-2019-12949 State: PUBLISHED Published: 2019-06-25T10:55:17 Last Updated: 2024-08-04T23:32:55.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a server. Then, the remote attacker can run any command with root privileges on that server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tarantula-team/CVE-2019-12949
CVE ID: CVE-2019-12950 State: PUBLISHED Published: 2019-08-06T16:16:40 Last Updated: 2024-08-04T23:32:55.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nilsteampassnet/TeamPass/releases - https://github.com/nilsteampassnet/TeamPass/issues/2638
CVE ID: CVE-2019-12951 State: PUBLISHED Published: 2019-06-24T22:05:46 Last Updated: 2024-08-04T23:32:55.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb - https://github.com/cesanta/mongoose/releases/tag/6.15
CVE ID: CVE-2019-12953 State: PUBLISHED Published: 2020-12-30T19:33:13 Last Updated: 2024-08-04T23:32:55.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599. Additional Analyst Notes: - CVE Program Container: References: - https://matt.ucc.asn.au/dropbear/CHANGES
CVE ID: CVE-2019-12954 State: PUBLISHED Published: 2020-02-17T16:42:27 Last Updated: 2024-08-04T23:32:55.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT. Additional Analyst Notes: - CVE Program Container: References: - https://www.esecforte.com/cve-2019-12954-solarwinds-network-performance-monitor-orion-platform-2018-npm-12-3-netpath-1-1-3-vulnerable-for-stored-xss/
CVE ID: CVE-2019-12957 State: PUBLISHED Published: 2019-06-24T23:27:17 Last Updated: 2024-08-04T23:32:55.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41813 - https://
Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41813 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/
CVE ID: CVE-2019-12958 State: PUBLISHED Published: 2019-06-24T23:27:28 Last Updated: 2024-08-04T23:32:55.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to access the second privateDicts array element, because the privateDicts array has only one element allocated. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=41815 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/ - https://lists.fedoraproject.
list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/
CVE ID: CVE-2019-12959 State: PUBLISHED Published: 2019-08-08T17:33:08 Last Updated: 2024-08-04T23:32:55.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2019-12959/
CVE ID: CVE-2019-12960 State: PUBLISHED Published: 2019-06-25T12:55:17 Last Updated: 2024-08-04T23:32:55.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_dt_s_d. Additional Analyst Notes: - CVE Program Container: References: - https://forums.livezilla.net/index.php?/topic/10983-fg-vd-19-086-livezilla-server-is-vulnerable-to-sql-injection-ii/
CVE ID: CVE-2019-12961 State: PUBLISHED Published: 2019-06-25T12:55:28 Last Updated: 2024-08-04T23:32:55.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function. Additional Analyst Notes: - CVE Program Container: References: - https://forums.livezilla.net/index.php?/topic/10985-fg-vd-19-088-livezilla-server-is-vulnerable-to-csv-injection/
CVE ID: CVE-2019-12962 State: PUBLISHED Published: 2019-06-25T12:55:43 Last Updated: 2024-08-04T23:32:55.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://forums.livezilla.net/index.php?/topic/10984-fg-vd-19-083085087-livezilla-server-are-vulnerable-to-cross-site-scripting-in-admin-panel/ - http://packetstormsecurity.com/files/161867/LiveZilla-Server-8.0.1.0-Cross-Site-Scripting.html
CVE ID: CVE-2019-12963 State: PUBLISHED Published: 2019-06-25T12:55:52 Last Updated: 2024-08-04T23:32:55.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action. Additional Analyst Notes: - CVE Program Container: References: - https://forums.livezilla.net/index.php?/topic/10984-fg-vd-19-083085087-livezilla-server-are-vulnerable-to-cross-site-scripting-in-admin-panel/
CVE ID: CVE-2019-12964 State: PUBLISHED Published: 2019-06-25T12:56:01 Last Updated: 2024-08-04T23:32:55.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject. Additional Analyst Notes: - CVE Program Container: References: - https://forums.livezilla.net/index.php?/topic/10984-fg-vd-19-083085087-livezilla-server-are-vulnerable-to-cross-site-scripting-in-admin-panel/