Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
" to any targeted file. This issue occurs because permissions on the Temp directory were set incorrectly. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN319697
CVE ID: CVE-2019-3750 State: PUBLISHED Published: 2019-12-03T20:20:16.832347Z Last Updated: 2024-09-16T23:11:52.600Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: Dell Products: Dell Command Update (DCU) Problem Types: CWE-427 Description: Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentially could exploit this vulnerability to delete arbitrary files by creating a symlink from the "Temp\IC\ICDebugLog.txt" to any targeted file. This issue occurs because of insecure handling of Temp directory permissions that were set incorrectly. Additional Analyst Not
ssue occurs because of insecure handling of Temp directory permissions that were set incorrectly. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN319697
CVE ID: CVE-2019-3751 State: PUBLISHED Published: 2019-09-03T16:52:53.854744Z Last Updated: 2024-09-17T02:47:44.353Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: DELL EMC Products: Dell EMC Enterprise Copy Data Management (eCDM) Problem Types: CWE-295 Description: Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and intercepting the victim's traffic to view or modify a victim’s data in transit. Additional Analyst Notes: -
ificate and intercepting the victim's traffic to view or modify a victim’s data in transit. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/536848/DSA-2019-118-Dell-EMC-Enterprise-Copy-Data-Management-eCDM-Improper-Certificate-Validation-Vuln
CVE ID: CVE-2019-3752 State: PUBLISHED Published: 2021-07-16T21:20:09.995409Z Last Updated: 2024-09-16T23:40:28.519Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Dell Products: Avamar Problem Types: CWE-611 Description: Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4. contain an XML External Entity(XXE) Injection vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability to cause Denial of Service or information exposure by supplying specially crafted document type definitions (DTDs) in an XML request. Addi
Service or information exposure by supplying specially crafted document type definitions (DTDs) in an XML request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/537853/DSA-2019-119-Dell-EMC-Avamar-XML-External-Entity-Injection-Vulnerability
CVE ID: CVE-2019-3753 State: PUBLISHED Published: 2019-08-20T18:47:01.835298Z Last Updated: 2024-09-16T20:48:15.827Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: PowerConnect 8024, PowerConnect 7000, PowerConnect M6348, PowerConnect M6220, PowerConnect M8024, PowerConnect M8024-K Problem Types: CWE-312 Description: Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the
text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the exposed password to use it in further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/sln318359/
CVE ID: CVE-2019-3754 State: PUBLISHED Published: 2019-09-03T16:52:53.915317Z Last Updated: 2024-09-17T02:00:48.399Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: DELL EMC Products: Unity Operating Environment, UnityVSA Operating Environment, VNXe3200 Operating Environment Problem Types: CWE-79 Description: Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim a
e cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/536796/DSA-2019-125-Dell-EMC-Unity-and-VNXe3200-Family-Reflected-Cross-Site-Scripting-Vulnerability
CVE ID: CVE-2019-3756 State: PUBLISHED Published: 2019-09-18T22:23:10.177981Z Last Updated: 2024-09-16T17:39:15.211Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA Archer Problem Types: CWE-209 Description: RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-106759
CVE ID: CVE-2019-3758 State: PUBLISHED Published: 2019-09-18T22:23:10.217159Z Last Updated: 2024-09-16T17:08:48.274Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: RSA Archer Problem Types: CWE-288 Description: RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-106759
CVE ID: CVE-2019-3759 State: PUBLISHED Published: 2019-09-11T19:17:30.305420Z Last Updated: 2024-09-17T01:06:30.738Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Dell Products: RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance Problem Types: CWE-94 Description: The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system. Additional Analyst Notes: - CVE Pr
scripts to gain limited access to view or modify information on the Workflow system. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-106943 - http://packetstormsecurity.com/files/158324/RSA-IG-L-Aveksa-7.1.1-Remote-Code-Execution.html
CVE ID: CVE-2019-3760 State: PUBLISHED Published: 2019-09-11T19:17:30.353240Z Last Updated: 2024-09-17T04:18:59.375Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Dell Products: RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance Problem Types: CWE-20 Description: The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection vulnerability in Workflow Architect. A remote authenticated malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted
to execute SQL commands on the back-end database to gain unauthorized access to the data by supplying specially crafted input data to the affected application. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-106943
CVE ID: CVE-2019-3761 State: PUBLISHED Published: 2019-09-11T19:17:30.396232Z Last Updated: 2024-09-16T18:12:57.898Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Dell Products: RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance Problem Types: CWE-79 Description: The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users
it this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the stored malicious code would gets executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-106943
CVE ID: CVE-2019-3762 State: PUBLISHED Published: 2020-03-18T18:20:16.283199Z Last Updated: 2024-09-16T23:15:44.160Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Dell Products: Data Protection Central Problem Types: CWE-296 Description: Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid system to compromise the integrity of data. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/s
ompromise the integrity of data. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/537007/DSA-2019-135-Dell-EMC-Data-Protection-Central-Improper-Chain-of-Trust-Vulnerability
CVE ID: CVE-2019-3763 State: PUBLISHED Published: 2019-09-11T19:17:30.440600Z Last Updated: 2024-09-16T22:20:25.143Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance Problem Types: CWE-532 Description: The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerability. The Office 365 user password may get logged in a plain text format in the Office 365 connector debug log file. An authenticated malicious local user with access to the debug logs may obtain the exposed password to use
bug log file. An authenticated malicious local user with access to the debug logs may obtain the exposed password to use in further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-106943
CVE ID: CVE-2019-3764 State: PUBLISHED Published: 2019-11-07T18:05:40.346130Z Last Updated: 2024-09-17T04:04:38.776Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Dell Products: Integrated Dell Remote Access Controller (iDRAC) Problem Types: CWE-285 Description: Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes. Additional Analyst Notes: - CVE Program Container: References: - htt
tain sensitive information such as password hashes. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/sln319317/dsa-2019-137-idrac-improper-authorization-vulnerability?lang=en
CVE ID: CVE-2019-3765 State: PUBLISHED Published: 2019-10-09T19:20:45.226308Z Last Updated: 2024-09-16T21:02:30.184Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Dell Products: Avamar, Integrated Data Protection Appliance Problem Types: CWE-732 Description: Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A remote authenticated malicious user potentially could exploit this vulnerability to view or modify sensitive backup data. This could be used to make backups corrupt
ly could exploit this vulnerability to view or modify sensitive backup data. This could be used to make backups corrupt or potentially to trick a user into restoring a backup with malicious files in place. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/537649/DSA-2019-138-Dell-EMC-Avamar-Incorrect-Permission-Assignment-for-Critical-Resource-Vulnerability
CVE ID: CVE-2019-3766 State: PUBLISHED Published: 2019-09-27T20:22:13.683831Z Last Updated: 2024-09-17T02:01:43.249Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Elastic Cloud Storage Problem Types: CWE-307 Description: Dell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive authentication attempts vulnerability. An unauthenticated remote attacker may potentially perform a password brute-force attack to gain access to the targeted accounts. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/537465/DSA-2019-140-Dell-EMC-Elastic-Cloud-Storage-ECS-Impro
nces: - https://www.dell.com/support/security/en-us/details/537465/DSA-2019-140-Dell-EMC-Elastic-Cloud-Storage-ECS-Improper-Restriction-of-Excessive-Authenticatio
CVE ID: CVE-2019-3767 State: PUBLISHED Published: 2019-10-14T17:10:38.958778Z Last Updated: 2024-09-17T01:21:08.167Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: ImageAssist Problem Types: CWE-200 Description: Dell ImageAssist versions prior to 8.7.15 contain an information disclosure vulnerability. Dell ImageAssist stores some sensitive encrypted information in the images it creates. A privileged user of a system running an operating system that was deployed with Dell ImageAssist could potentially retrieve this sensitive information to then compromise the system and related systems. Additional Analyst Notes: - CVE Program Container: Referenc
formation to then compromise the system and related systems. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/19/sln318831/dsa-2019-139
CVE ID: CVE-2019-3768 State: PUBLISHED Published: 2020-01-03T22:35:12.019568Z Last Updated: 2024-09-17T04:19:05.205Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA Authentication Manager Problem Types: CWE-611 Description: RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to cause information disclosure of local system files by supplying specially crafted XML message. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-108320/DSA-2019-148-RS
s: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-108320/DSA-2019-148-RSA&#174%3B-Authentication-Manager-Software-XML-Entity-Injection-Vulnerability
CVE ID: CVE-2019-3769 State: PUBLISHED Published: 2020-03-13T20:30:21.965511Z Last Updated: 2024-09-16T16:43:16.810Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Dell Products: Wyse Management Suite Problem Types: CWE-79 Description: Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious payload in the device heartbeat request. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Addition
eir browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN319512
CVE ID: CVE-2019-3770 State: PUBLISHED Published: 2020-03-13T20:30:22.359692Z Last Updated: 2024-09-17T02:02:12.080Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Dell Products: Wyse Management Suite Problem Types: CWE-79 Description: Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregistering a device. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious HTML or JavaScript code. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable applicati
a through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN319512
CVE ID: CVE-2019-3772 State: PUBLISHED Published: 2019-01-18T22:00:00Z Last Updated: 2024-09-16T16:23:25.840Z Vendors: Spring Products: Spring Integration Problem Types: CWE-611 Description: Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-3772 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - http://www.securityfocus.com/bid/106749
CVE ID: CVE-2019-3773 State: PUBLISHED Published: 2019-01-18T22:00:00Z Last Updated: 2024-09-17T03:33:35.558Z Vendors: Spring Products: Spring Web Services Problem Types: CWE-611 Description: Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujan2021.html - https://pivotal.io/security/cve-2019-3773 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.c
om/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20231227-0011/
CVE ID: CVE-2019-3774 State: PUBLISHED Published: 2019-01-18T22:00:00Z Last Updated: 2024-09-16T20:57:23.130Z Vendors: Spring Products: Spring Batch Problem Types: CWE-611 Description: Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-3774 - https://lists.apache.org/thread.html/rcd26a5409af7356b5f69b2fafae3cf621bff8bf155f50e9ccf9ed5f6%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/rfea6eebfebb13bc015f258e7fa31d4e24a4202601be3b307da28d53
servicemix.apache.org%3E - https://lists.apache.org/thread.html/rfea6eebfebb13bc015f258e7fa31d4e24a4202601be3b307da28d530%40%3Ccommits.servicemix.apache.org%3E - https://lists.apache.org/thread.html/ree71c6425d2cc0e36b77bda6902965a657c1e09c7229459811d66474%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r47c7f67a3067ec09262eef0705abc42ea1b646699d9198bcaf8dad02%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r2349237482bcec43632d9d78d7d2804520d9a82f4d8b1fd96bb616b8%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/rcd4945d66d8bb2fc92396af56a70ede4af983a2c98166f1281338346%40%3Cissues.servicemix.apache.org%3E - ht
ache.org/thread.html/rcd4945d66d8bb2fc92396af56a70ede4af983a2c98166f1281338346%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/ra62a3bf48ab4e0e9aaed970b03d79a73224d68a4275858c707542f6c%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r01292194daa9ed3117b34dabec0c26929f6db13b9613fc144f720d52%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/ra8c7573911082e9968f4835943045ad0952232bb6314becf23dc3de5%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/raae74a9290784e20e86fcd4e2525fa8700aeed6f65f3613b5b04bb11%40%3Ccommits.servicemix.apache.org%3E - https://lists.apache.org/thread.html/rb9fe3ae
4e2525fa8700aeed6f65f3613b5b04bb11%40%3Ccommits.servicemix.apache.org%3E - https://lists.apache.org/thread.html/rb9fe3ae33246d7f11604a1c85c861cb013a1e32248a43a0c22457107%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r0153a08177fcfac7584c7b9ea3027f1e8f18f770126f905b9989190e%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r96d90e59bb12af5e5c631dcf7d7d80857a52bf3dc44d5b85553e7fc4%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r78645ca0eef44a276e144447fb2087db758b1fb8826d0330b3f0da1a%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/ra329bb85da9da93ac6f9b5fc0fc5446a3af0ee2a62c5de484da
ues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/ra329bb85da9da93ac6f9b5fc0fc5446a3af0ee2a62c5de484da0af54%40%3Ccommits.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r5fbb63e405d2211c16524d33f52e3b122109d3bc88d5f74623fb212d%40%3Ccommits.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r08e7ddc354bdcbf95d88399f18b3d804865034f8bc706095e594b29f%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/r79991aeb5d0c53c67e400e037c72758a06607752ca2f23b5302dd61f%40%3Cissues.servicemix.apache.org%3E - https://lists.apache.org/thread.html/rf83697efcbcfe1131e31bbc7025cb3ee1db5d9185e9481093b2ef961%40%3Cissues.servicemix.apache.org%3E
CVE ID: CVE-2019-3775 State: PUBLISHED Published: 2019-03-07T19:00:00Z Last Updated: 2024-09-16T22:31:19.423Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: Cloud Foundry Products: UAA Release (OSS) Problem Types: CWE-290 Description: Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3775
CVE ID: CVE-2019-3776 State: PUBLISHED Published: 2019-03-07T19:00:00Z Last Updated: 2024-09-17T00:11:48.970Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L) Vendors: Pivotal Products: Pivotal Ops Manager Problem Types: CWE-79 Description: Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser. Additional Analyst Notes: - CVE Program Container: References: - h