Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-5147 State: PUBLISHED Published: 2020-01-25T17:53:12 Last Updated: 2024-08-04T19:47:56.667Z Vendors: n/a Products: AMD Problem Types: out of bounds read Description: An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13003.1007. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0936
CVE ID: CVE-2019-5148 State: PUBLISHED Published: 2020-02-25T15:57:49 Last Updated: 2024-08-04T19:47:56.642Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Moxa Problem Types: CWE-125 Description: An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packet while unauthenticated to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerabi
vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0938
CVE ID: CVE-2019-5149 State: PUBLISHED Published: 2020-03-10T21:59:28 Last Updated: 2024-08-04T19:47:56.584Z Vendors: Wago Products: WAGO PFC200 Firmware, WAGO PFC100 Firmware Problem Types: denial of service Description: The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs. However, the default configuration of this module appears to limit the number of concurrent php-cgi processes to two, which can be abused to cause a denial of service of the entir
o limit the number of concurrent php-cgi processes to two, which can be abused to cause a denial of service of the entire web server. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12) and version 03.02.02(14). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0939
CVE ID: CVE-2019-5150 State: PUBLISHED Published: 2019-10-31T19:32:12 Last Updated: 2024-08-04T19:47:56.603Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H) Vendors: n/a Products: YouPHPTube Problem Types: CWE-89 Description: An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the "VideoTags" plugin is enabled, a specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container
n. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0940
CVE ID: CVE-2019-5151 State: PUBLISHED Published: 2019-10-31T19:43:30 Last Updated: 2024-08-04T19:47:56.630Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H) Vendors: n/a Products: YouPHPTube Problem Types: CWE-89 Description: An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintellig
st to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0941
CVE ID: CVE-2019-5152 State: PUBLISHED Published: 2019-12-18T14:31:56 Last Updated: 2024-08-04T19:47:56.594Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: n/a Products: Shadowsocks Problem Types: CWE-306 Description: An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher, a specially crafted set of network packets can cause an outbound connection from the server, resulting in information disclosure. An attacker can send arbitrary packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelli
ets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0942
CVE ID: CVE-2019-5153 State: PUBLISHED Published: 2020-02-25T15:48:09 Last Updated: 2024-08-04T19:47:56.757Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Moxa Problem Types: CWE-121 Description: An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause an overflow of an error message buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https:
ow privilege user to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0944
CVE ID: CVE-2019-5154 State: PUBLISHED Published: 2019-12-11T23:47:20 Last Updated: 2024-08-04T19:47:56.900Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: LEADTOOLS Problem Types: CWE-122 Description: An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20.0.2019.3.15. A specially crafted J2K image file can cause an out of bounds write of a null byte in a heap buffer, potentially resulting in code execution. An attack can specially craft a J2K image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TA
Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0945
CVE ID: CVE-2019-5155 State: PUBLISHED Published: 2020-03-10T21:59:24 Last Updated: 2024-08-04T19:47:56.642Z Vendors: Wago Products: WAGO PFC200 Firmware Problem Types: “Command Injection” Description: An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. This affects WAGO PFC200 Firmware version 03.02.02(14), version 03.01.07(13), and version 03.00.39(12) Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0948
CVE ID: CVE-2019-5156 State: PUBLISHED Published: 2020-03-10T23:14:34 Last Updated: 2024-08-04T19:47:56.664Z Vendors: Wago Products: WAGO PFC200 Firmware Problem Types: command injection Description: An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). An attacker can inject operating system commands into the TimeoutPrepared parameter value contained in the firmware update command. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0949
CVE ID: CVE-2019-5157 State: PUBLISHED Published: 2020-03-10T23:14:31 Last Updated: 2024-08-04T19:47:56.654Z Vendors: Wago Products: WAGO PFC200 Firmware Problem Types: command injection Description: An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). An attacker can inject OS commands into the TimeoutUnconfirmed parameter value contained in the Firmware Update command. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0950
CVE ID: CVE-2019-5158 State: PUBLISHED Published: 2020-03-10T23:14:27 Last Updated: 2024-08-04T19:47:56.569Z Vendors: Wago Products: WAGO e!COCKPIT Problem Types: improper input validation Description: An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation software v1.6.1.5. A specially crafted firmware update file can allow an attacker to install an older firmware version while the user thinks a newer firmware version is being installed. An attacker can create a custom firmware update package with invalid metadata in order to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References
h invalid metadata in order to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0951
CVE ID: CVE-2019-5159 State: PUBLISHED Published: 2020-03-10T22:35:47 Last Updated: 2024-08-04T19:47:56.607Z Vendors: Wago Products: WAGO e!COCKPIT Problem Types: improper input validation Description: An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.6.0.7. A specially crafted firmware update file can allow an attacker to write arbitrary files to arbitrary locations on WAGO controllers as a part of executing a firmware update, potentially resulting in code execution. An attacker can create a malicious firmware update package file using any zip utility. The user must initiate a firmware update through e
reate a malicious firmware update package file using any zip utility. The user must initiate a firmware update through e!COCKPIT and choose the malicious wup file using the file browser to trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0952
CVE ID: CVE-2019-5160 State: PUBLISHED Published: 2020-03-10T22:35:44 Last Updated: 2024-08-04T19:47:56.585Z Vendors: Wago Products: WAGO PFC200 Firmware Problem Types: improper access control Description: An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized access to firmware update functionality. An attacker can send an authenticated HTTPS POST request to direct the Cloud Connectivity software to connect to an attacker controlled Azure IoT Hub
nticated HTTPS POST request to direct the Cloud Connectivity software to connect to an attacker controlled Azure IoT Hub node. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0953
CVE ID: CVE-2019-5161 State: PUBLISHED Published: 2020-03-10T23:32:14 Last Updated: 2024-08-04T19:47:56.616Z Vendors: Wago Products: WAGO PFC200 Firmware Problem Types: remote code execution Description: An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0954
CVE ID: CVE-2019-5162 State: PUBLISHED Published: 2020-02-25T15:47:30 Last Updated: 2024-08-04T19:47:56.679Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Moxa Problem Types: CWE-284 Description: An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability. Additional Analyst Notes: - CVE Progr
ommands while authenticated as a low privilege user to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0955
CVE ID: CVE-2019-5163 State: PUBLISHED Published: 2019-12-03T21:55:47 Last Updated: 2024-08-04T19:47:56.616Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Shadowsocks Problem Types: CWE-306 Description: An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html - h
s: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0956
CVE ID: CVE-2019-5164 State: PUBLISHED Published: 2019-12-03T21:56:21 Last Updated: 2024-08-04T19:47:56.612Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Shadowsocks Problem Types: CWE-306 Description: An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg000
nalyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0958
CVE ID: CVE-2019-5165 State: PUBLISHED Published: 2020-02-25T15:49:11 Last Updated: 2024-08-04T19:47:56.584Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Moxa Problem Types: CWE-288 Description: An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13. A specially configured device hostname can cause the device to interpret select remote traffic as local traffic, resulting in a bypass of web authentication. An attacker can send authenticated SNMP requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence
o trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0960
CVE ID: CVE-2019-5166 State: PUBLISHED Published: 2020-03-10T22:25:42 Last Updated: 2024-08-04T19:47:56.751Z Vendors: Wago Products: WAGO PFC200 Firmware Problem Types: stack buffer overflow Description: An exploitable stack buffer overflow vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can cause a stack buffer overflow, resulting in code execution. An attacker can send a specially crafted packet to trigger the parsing of this cache file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_report
ile. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0961
CVE ID: CVE-2019-5167 State: PUBLISHED Published: 2020-03-10T22:25:48 Last Updated: 2024-08-04T19:47:56.596Z Vendors: Wago Products: WAGO PFC200 Firmware Problem Types: command injection Description: An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/edit_dns_server %s dns-server-nr=%d dns-server-name=<contents of dns node> using sprintf(). This command is later executed via a call to system(). This is done in a loop and there is no limit to how many dns entries will be parsed from the xml file. Additional A
m(). This is done in a loop and there is no limit to how many dns entries will be parsed from the xml file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962
CVE ID: CVE-2019-5168 State: PUBLISHED Published: 2020-03-10T22:25:57 Last Updated: 2024-08-04T19:47:56.825Z Vendors: Wago Products: WAGO PFC200 Firmware Problem Types: command injection Description: An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). An attacker can send a specially crafted XML cache file At 0x1e8a8 the extracted domainname value from the xml file is used as an argument to /etc/config-tools/edit_dns_server domain-name=<contents of domainname node> using sprintf().This command is later executed via a call to system(). Additional Analyst Notes: - CVE Program Container: References: - https
command is later executed via a call to system(). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962
CVE ID: CVE-2019-5169 State: PUBLISHED Published: 2020-03-11T23:17:32 Last Updated: 2024-08-04T19:47:56.627Z Vendors: Wago Products: WAGO PFC200 Problem Types: command injection Description: An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1e900 the extracted gateway value from the xml file is used as an argument to /etc/config-tools/config_default_gateway number=0 state=enabled value=
value from the xml file is used as an argument to /etc/config-tools/config_default_gateway number=0 state=enabled value=<contents of gateway node> using sprintf(). This command is later executed via a call to system(). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962
CVE ID: CVE-2019-5170 State: PUBLISHED Published: 2020-03-11T23:17:37 Last Updated: 2024-08-04T19:47:56.643Z Vendors: Wago Products: WAGO PFC200 Problem Types: command injection Description: An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1e87c the extracted hostname value from the xml file is used as an argument to /etc/config-tools/change_hostname hostname=<contents of hostname node>
value from the xml file is used as an argument to /etc/config-tools/change_hostname hostname=<contents of hostname node> using sprintf(). This command is later executed via a call to system(). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962
CVE ID: CVE-2019-5171 State: PUBLISHED Published: 2020-03-11T23:17:48 Last Updated: 2024-08-04T19:47:56.680Z Vendors: Wago Products: WAGO PFC200 Problem Types: command injection Description: An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send specially crafted packet at 0x1ea48 to the extracted hostname value from the xml file that is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=enabled ip-address=<contents of ip node> using sprintf(). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability
sprintf(). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962
CVE ID: CVE-2019-5172 State: PUBLISHED Published: 2020-03-11T22:18:37 Last Updated: 2024-08-04T19:47:56.615Z Vendors: Wago Products: WAGO PFC200 Problem Types: command injection Description: An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1e840 the extracted ntp value from the xml file is used as an argument to /etc/config-tools/config_sntp time-server-%d=<contents of ntp node> using sprintf(). This command is later executed via a call to system(). This is done in a loop and there is no limit to h
sing sprintf(). This command is later executed via a call to system(). This is done in a loop and there is no limit to how many ntp entries will be parsed from the xml file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962
CVE ID: CVE-2019-5173 State: PUBLISHED Published: 2020-03-11T22:18:28 Last Updated: 2024-08-04T19:47:56.743Z Vendors: Wago Products: WAGO PFC200 Problem Types: command injection Description: An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1e9fc the extracted state value from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=<contents of stat
lue from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=<contents of state node> using sprintf(). This command is later executed via a call to system(). Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962