Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-7575 State: PUBLISHED Published: 2019-02-07T00:00:00 Last Updated: 2024-08-04T20:54:27.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html - https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html - https://bugzilla.libsdl.org/show_bug.cgi?id=4493 - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-0
.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html - https://security.gentoo.org/glsa/201909-07 - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/d
s/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-17
CVE ID: CVE-2019-7576 State: PUBLISHED Published: 2019-02-07T00:00:00 Last Updated: 2024-08-04T20:54:28.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html - https://bugzilla.libsdl.org/show_bug.cgi?id=4490 - https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensus
5.html - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html - https://security.gentoo.org/glsa/201909-07 - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ -
.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-17
CVE ID: CVE-2019-7577 State: PUBLISHED Published: 2019-02-07T00:00:00 Last Updated: 2024-08-04T20:54:28.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html - https://bugzilla.libsdl.org/show_bug.cgi?id=4492 - https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - https://lists.fedoraproject.org/archives/list/package-announce%40lists
/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFYUCO6D5APPM7IOZ5WOCYVY4DKSXFKD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MD6EIV2CS6QNDU3UN2RVXPQOFQNHXCP7/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html - https://security.gentoo.org/glsa/201909-07 - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://lists.debian.org/debian-lts-announ
201909-07 - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-17
CVE ID: CVE-2019-7578 State: PUBLISHED Published: 2019-02-07T00:00:00 Last Updated: 2024-08-04T20:54:28.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html - https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html - https://bugzilla.libsdl.org/show_bug.cgi?id=4494 - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04
libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html - https://security.gentoo.org/glsa/201909-07 - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/de
/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-17
CVE ID: CVE-2019-7579 State: PUBLISHED Published: 2019-06-17T18:26:48 Last Updated: 2024-08-04T20:54:28.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dynamic/js/setup.js.localized file on the router's webserver, allowing for an attacker to identify possible passwords that the system uses to set the default guest network password. An attacker can use this list of 30 words along with a random 2 digit number to brute force their access onto a router's guest network. Additional Analyst Notes: - CVE Program Container: Referen
er to brute force their access onto a router's guest network. Additional Analyst Notes: - CVE Program Container: References: - https://robot-security.blogspot.com - http://www.x0rsecurity.com/2019/06/09/my-second-cve-linksys-wrt-acs-cve-2019-7579-or-as-i-call-it-acceptance-no-one-considers-security-by-design/
CVE ID: CVE-2019-7580 State: PUBLISHED Published: 2019-02-07T17:00:00Z Last Updated: 2024-09-16T19:50:55.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection. Additional Analyst Notes: - CVE Program Container: References: - https://xz.aliyun.com/t/3997 - https://github.com/shadowsock5/ThinkCMF-5.0.190111/blob/master/README.md
CVE ID: CVE-2019-7581 State: PUBLISHED Published: 2019-02-07T18:00:00 Last Updated: 2024-08-04T20:54:27.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure, a different vulnerability than CVE-2018-7876. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/173
CVE ID: CVE-2019-7582 State: PUBLISHED Published: 2019-02-07T18:00:00 Last Updated: 2024-08-04T20:54:28.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/172
CVE ID: CVE-2019-7585 State: PUBLISHED Published: 2019-02-07T18:00:00 Last Updated: 2024-08-04T20:54:28.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caokang/waimai/issues/11
CVE ID: CVE-2019-7587 State: PUBLISHED Published: 2019-02-07T19:00:00Z Last Updated: 2024-09-16T17:39:10.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function. Additional Analyst Notes: - CVE Program Container: References: - https://c3tsec.wordpress.com/2019/01/12/sql-injection-in-bo-blog-wind-cms/
CVE ID: CVE-2019-7588 State: PUBLISHED Published: 2019-06-18T13:23:05.440120Z Last Updated: 2024-09-16T18:13:34.586Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Exacq Technologies, Inc. Products: exacqVision Enterprise System Manager (ESM) Problem Types: The exacqVision Enterprise System Manager (ESM) privilege escalation vulnerability is possible due to insecure file permission in the Windows operating system. Description: A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of
ege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows operating system. This issue does not impact any Windows Server OSs, or Linux deployments with permissions that are not inherited from the root directory. Authorized Users have ‘modify’ permission to the ESM folders, which allows a low privilege account to modify files located in these directories. An executable can be renamed and replaced by a malicious file that could connect back to a bad actor providing system level privileges. A low privileged user is not able to restart the service, but a restart of the system would trigger the execution of t
. A low privileged user is not able to restart the service, but a restart of the system would trigger the execution of the malicious file. This issue affects: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) Version 5.12.2 and prior versions; This issue does not affect: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) 19.03 and above. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-164-01 - https://packetstormsecurity.com/files/151691/exacqvisionesm5122-escalate.txt - https://exacq.com/kb?crc=31399 - https://www.johnsoncontrols.com/-/media/jci/be/united-states/specialty-pages/product-secu
tps://exacq.com/kb?crc=31399 - https://www.johnsoncontrols.com/-/media/jci/be/united-states/specialty-pages/product-security/files/cpp-psa-2019-01-v2-exacqvision-esm.pdf
CVE ID: CVE-2019-7589 State: PUBLISHED Published: 2020-03-10T19:32:39 Last Updated: 2024-08-04T20:54:28.476Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: Kantech EntraPass Corporate Edition, Kantech EntraPass Global Edition Problem Types: CWE-20 Description: A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior. Additional An
traPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.us-cert.gov/ics/advisories/icsa-20-070-04
CVE ID: CVE-2019-7590 State: PUBLISHED Published: 2019-07-19T20:56:07.852988Z Last Updated: 2024-09-17T01:40:35.591Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Exacq Technologies, Inc. Products: exacqVision Server Problem Types: CWE-428, The exacqVision Server unquoted service path privilege escalation vulnerability is possible in the Windows operating system. Description: ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authentic
in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/152128/exacqVision-9.8-Unquoted-Service-Path-Privilege-Escalation.html - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.p
sion-9.8-Unquoted-Service-Path-Privilege-Escalation.html - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.php - https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341 - https://www.us-cert.gov/ics/advisories/icsa-19-199-01 - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - http://www.securityfocus.com/bid/109307
CVE ID: CVE-2019-7593 State: PUBLISHED Published: 2019-08-20T18:22:43 Last Updated: 2024-08-04T20:54:27.934Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Johnson Controls Products: Metasys versions prior to 9.0 Problem Types: CWE-323 Description: Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP). Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf - https://www.us-cert.gov/ics/advisori
ns/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf - https://www.us-cert.gov/ics/advisories/icsa-19-227-01
CVE ID: CVE-2019-7594 State: PUBLISHED Published: 2019-08-20T18:24:56 Last Updated: 2024-08-04T20:54:28.360Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Johnson Controls Products: Metasys versions prior to 9.0 Problem Types: CWE-321 Description: Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP). Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf - https://www.us-cert.gov/ics/advisories
/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf - https://www.us-cert.gov/ics/advisories/icsa-19-227-01
CVE ID: CVE-2019-7608 State: PUBLISHED Published: 2019-03-25T18:34:06 Last Updated: 2024-08-04T20:54:28.307Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 - https://www.elastic.co/community/security - https://access.redhat.com/errata/RHSA-2019:2860 - https://access.redhat.com/errata/RHBA-2019:2824
CVE ID: CVE-2019-7609 State: PUBLISHED Published: 2019-03-25T00:00:00.000Z Last Updated: 2025-10-21T23:45:41.577Z Vendors: Elastic Products: Kibana Problem Types: CWE-94 Description: Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-up
ontainer: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 - https://www.elastic.co/community/security - https://access.redhat.com/errata/RHSA-2019:2860 - https://access.redhat.com/errata/RHBA-2019:2824 - http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html
CVE ID: CVE-2019-7610 State: PUBLISHED Published: 2019-03-25T18:34:06 Last Updated: 2024-08-04T20:54:28.309Z Vendors: Elastic Products: Kibana Problem Types: CWE-94 Description: Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-up
st Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 - https://www.elastic.co/community/security - https://access.redhat.com/errata/RHSA-2019:2860 - https://access.redhat.com/errata/RHBA-2019:2824
CVE ID: CVE-2019-7611 State: PUBLISHED Published: 2019-03-25T18:34:06 Last Updated: 2024-08-04T20:54:28.532Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-284 Description: A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a re
ata available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 - https://www.elastic.co/community/security
CVE ID: CVE-2019-7612 State: PUBLISHED Published: 2019-03-25T18:34:06 Last Updated: 2024-08-04T20:54:28.269Z Vendors: Elastic Products: Logstash Problem Types: CWE-209 Description: A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 - https://www.elastic.co/community/security - https://security.netapp.com/advisory/ntap-2019041
5-security-update/169077 - https://www.elastic.co/community/security - https://security.netapp.com/advisory/ntap-20190411-0002/
CVE ID: CVE-2019-7613 State: PUBLISHED Published: 2019-03-25T18:34:06 Last Updated: 2024-08-04T20:54:28.314Z Vendors: Elastic Products: Logstash Problem Types: CWE-778 Description: Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry could prevent Winlogbeat from recording the event. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-stack-6-6-2-and-5-6-16-security-update/173180
CVE ID: CVE-2019-7614 State: PUBLISHED Published: 2019-07-30T21:15:47 Last Updated: 2024-08-04T20:54:28.068Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-362 Description: A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/
CVE ID: CVE-2019-7615 State: PUBLISHED Published: 2019-07-30T21:15:47 Last Updated: 2024-08-04T20:54:27.931Z Vendors: Elastic Products: Elastic APM agent for Ruby Problem Types: CWE-295 Description: A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'server_ca_cert' setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/