Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
pment Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux
o 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/s
prior to 4.3.1-lp151.2.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1153921
CVE ID: CVE-2019-3697 State: PUBLISHED Published: 2020-01-24T12:10:11.878267Z Last Updated: 2024-09-17T01:31:57.295Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: openSUSE Products: Leap 15.1 Problem Types: CWE-59 Description: UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to root. This issue affects: openSUSE Leap 15.1 gnump3d version 3.0-lp151.2.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1154229
CVE ID: CVE-2019-3698 State: PUBLISHED Published: 2020-02-28T13:20:14.152354Z Last Updated: 2024-09-16T16:33:41.138Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11, Factory Problem Types: CWE-59 Description: UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions.
ges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html - https://bugzilla.suse.com/show_bug.cgi?id=1156309
CVE ID: CVE-2019-3699 State: PUBLISHED Published: 2020-01-24T12:25:12.967744Z Last Updated: 2024-09-16T21:02:19.137Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: openSUSE Products: Leap 15.1, Factory Problem Types: CWE-59 Description: UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3.0.28-2.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.
and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1157449
CVE ID: CVE-2019-3700 State: PUBLISHED Published: 2020-01-24T12:45:14.347248Z Last Updated: 2024-09-17T01:26:30.443Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: openSUSE Products: Factory Problem Types: CWE-327 Description: yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defaults in 4.2.6 and used the new configuration file locations. Password created during this time used DES password encryption and are not prope
d the new configuration file locations. Password created during this time used DES password encryption and are not properly protected against attackers that are able to access the password hashes. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1157541
CVE ID: CVE-2019-3701 State: PUBLISHED Published: 2019-01-03T16:00:00 Last Updated: 2024-08-04T19:19:16.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. The privileged user "root" with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data length code a higher value than the available CAN frame data size. In combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of
ed checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=linux-netdev&m=154651842302479&w=2 - http://www.securityfocus.com/bid/106443 - https://bugzilla.suse.com/show_bug.cgi?id=1120386 - https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html -
https://bugzilla.suse.com/show_bug.cgi?id=1120386 - https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html - https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html - https://usn.ubuntu.com/3932-1/ - https://usn.ubuntu.com/3932-2/ - https://support.f5.com/csp/article/K17957133 - https://marc.info/?l=linux-netdev&m=154661373531512&w=2 - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=0aaa81377c5a01f686bcdb8c7a6929a7bf330c68 - https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html - https://usn.ubuntu.com/4115-1/ - https://usn.ubuntu.com/4118-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html
CVE ID: CVE-2019-3702 State: PUBLISHED Published: 2019-05-13T16:54:22 Last Updated: 2024-08-04T19:19:17.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request. Additional Analyst Notes: - CVE Program Container: References: - https://www.sva.de/solutions/it-security.html - https://www.lifesize.com/en/video-conferencing-cameras - https://atomic111.github.io/article/lifesize-icon-remote-code-execution
CVE ID: CVE-2019-3704 State: PUBLISHED Published: 2019-02-07T19:00:00Z Last Updated: 2024-09-16T17:58:08.973Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: VNX Control Station in Dell EMC VNX2 OE for File Problem Types: OS Command Injection Description: VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate restriction configured in sudores, a local authenticated malicious user could potentially execute arbitrary OS commands as root by exploiting this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.c
ploiting this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106954 - https://seclists.org/fulldisclosure/2019/Feb/8
CVE ID: CVE-2019-3705 State: PUBLISHED Published: 2019-04-26T18:22:08.963679Z Last Updated: 2024-09-16T23:25:37.495Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: iDRAC Problem Types: CWE-120 Description: Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to crash the webserver or execute arbitrary code on the system with privileges of the webserver by sending specially crafted input data to the affec
ecute arbitrary code on the system with privileges of the webserver by sending specially crafted input data to the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en
CVE ID: CVE-2019-3706 State: PUBLISHED Published: 2019-04-26T18:22:09.012297Z Last Updated: 2024-09-17T00:26:34.078Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Dell EMC Products: iDRAC Problem Types: Web Interface Authentication Bypass Vulnerability Description: Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted data to the iDRAC web interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/supp
a to the iDRAC web interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en
CVE ID: CVE-2019-3707 State: PUBLISHED Published: 2019-04-26T18:22:09.049204Z Last Updated: 2024-09-16T18:09:07.804Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Dell EMC Products: iDRAC Problem Types: WS-MAN Authentication Bypass Vulnerability Description: Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted input data to the WS-MAN interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028
alyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en
CVE ID: CVE-2019-3708 State: PUBLISHED Published: 2019-04-17T13:32:35.525018Z Last Updated: 2024-09-17T00:36:59.730Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Dell EMC Products: Dell EMC IsilonSD Management Server Problem Types: Cross-Site Scripting Vulnerability Description: IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Apr/16
CVE ID: CVE-2019-3709 State: PUBLISHED Published: 2019-04-17T13:32:35.568029Z Last Updated: 2024-09-16T20:21:39.930Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Dell EMC Products: Dell EMC IsilonSD Management Server Problem Types: Cross-Site Scripting Vulnerability Description: IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Ap
admin user. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Apr/16
CVE ID: CVE-2019-3710 State: PUBLISHED Published: 2019-03-28T17:58:38 Last Updated: 2024-08-04T19:19:17.923Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell EMC Products: Dell EMC Networking OS10 Problem Types: Undocumented Default Cryptographic Key Description: Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to intercept communications or operate the system with elevated privileges. Additional Analyst Notes: - CVE Prog
be able to intercept communications or operate the system with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN316558/
CVE ID: CVE-2019-3711 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-16T20:17:34.908Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: RSA Authentication Manager Problem Types: insecure credential management Description: RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Mar/5
attacks. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Mar/5 - http://www.securityfocus.com/bid/107210
CVE ID: CVE-2019-3712 State: PUBLISHED Published: 2019-03-07T19:00:00Z Last Updated: 2024-09-17T03:12:51.680Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: Dell Products: Wyse Device Agent, Wyse ThinLinux HAgent Problem Types: buffer overflow vulnerability Description: Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on the system with privileges of the FTP client by sending specially crafted input data to the affected system. The FTP code that contained th
vileges of the FTP client by sending specially crafted input data to the affected system. The FTP code that contained the vulnerability has been removed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107376 - https://www.dell.com/support/article/us/en/19/sln316391
CVE ID: CVE-2019-3715 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-16T18:43:54.780Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: RSA Archer Problem Types: Information Exposure Vulnerability Description: RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Mar/19 - http://w
itional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Mar/19 - http://www.securityfocus.com/bid/107443
CVE ID: CVE-2019-3716 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-16T22:39:54.202Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: RSA Archer Problem Types: Information Exposure Vulnerability Description: RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed password to use it in further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Mar/19 -
cks. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Mar/19 - http://www.securityfocus.com/bid/107406
CVE ID: CVE-2019-3717 State: PUBLISHED Published: 2019-08-05T16:38:20.346820Z Last Updated: 2024-09-16T16:43:43.212Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H) Vendors: Dell Products: Dell Client Commercial and Consumer platforms Problem Types: Improper Access Control Description: Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system during platform boot. Refer to https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019
installed in the system during platform boot. Refer to https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en for versions affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en
CVE ID: CVE-2019-3718 State: PUBLISHED Published: 2019-04-18T19:58:22.877225Z Last Updated: 2024-09-16T21:57:00.834Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: Dell Products: SupportAssist Client Problem Types: Improper Origin Validation Description: Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/19/sln316857/dsa-2019-051-dell-supportassist-client-multiple
r: References: - https://www.dell.com/support/article/us/en/19/sln316857/dsa-2019-051-dell-supportassist-client-multiple-vulnerabilities?lang=en - http://www.securityfocus.com/bid/108020
CVE ID: CVE-2019-3719 State: PUBLISHED Published: 2019-04-18T19:58:22.916438Z Last Updated: 2024-09-16T18:40:02.152Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: SupportAssist Client Problem Types: Remote Code Execution Vulnerability Description: Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites. Additional Analyst Notes: - CVE Program Cont
arbitrary executables via SupportAssist client from attacker hosted sites. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/19/sln316857/dsa-2019-051-dell-supportassist-client-multiple-vulnerabilities?lang=en
CVE ID: CVE-2019-3720 State: PUBLISHED Published: 2019-04-25T20:17:37.154067Z Last Updated: 2024-09-16T16:32:39.543Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell EMC Products: Open Manage System Administrator Problem Types: Directory Traversal Vulnerability Description: Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain a Directory Traversal Vulnerability. A remote authenticated malicious user with admin privileges could potentially exploit this vulnerability to gain unauthorized access to the file system by exploiting insufficient sanitization of input parameters. Additional Analyst Notes: - CVE Program Container: Refer
em by exploiting insufficient sanitization of input parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln316915/dsa-2019-060-dell-emc-open-manage-system-administrator-multiple-vulnerabilities?lang=en - http://www.securityfocus.com/bid/108092
CVE ID: CVE-2019-3721 State: PUBLISHED Published: 2019-04-25T20:17:37.195342Z Last Updated: 2024-09-16T19:20:31.480Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell EMC Products: Open Manage System Administrator Problem Types: Improper Range Header Vulnerability Description: Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated attacker may send crafted requests with overlapping ranges to cause the application to compress each of the requested bytes, resulting in a crash due to excessive memory consumption and preventing users from accessing the system
requested bytes, resulting in a crash due to excessive memory consumption and preventing users from accessing the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln316915/dsa-2019-060-dell-emc-open-manage-system-administrator-multiple-vulnerabilities?lang=en - http://www.securityfocus.com/bid/108092
CVE ID: CVE-2019-3722 State: PUBLISHED Published: 2019-06-06T19:13:51.076423Z Last Updated: 2024-09-16T17:22:35.591Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell EMC Products: OpenManage Server Administrator Problem Types: XML External Entity (XXE) Injection Vulnerability Description: Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary server system files by supplying specially crafted document type definitions (DTDs) in an XML request. Additional Analys
server system files by supplying specially crafted document type definitions (DTDs) in an XML request. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln317441/dsa-2019-074-dell-emc-openmanage-server-administrator-multiple-vulnerabilities?lang=en - http://www.securityfocus.com/bid/108685