Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-18845 State: PUBLISHED Published: 2019-11-09T17:05:16 Last Updated: 2024-08-05T02:02:39.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, by mapping \Device\PhysicalMemory into the calling process via ZwOpenSection and ZwMapViewOfSection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-012.md
CVE ID: CVE-2019-18846 State: PUBLISHED Published: 2020-02-21T20:53:19 Last Updated: 2024-08-05T02:02:39.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.2 allows SSRF. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/156474/Open-Xchange-App-Suite-Documents-Server-Side-Request-Forgery.html - http://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html
CVE ID: CVE-2019-18847 State: PUBLISHED Published: 2020-08-26T13:47:52 Last Updated: 2024-08-05T02:02:39.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.akamai.com/sitr/ - https://blogs.akamai.com/2020/08/enterprise-application-access-client-eaa-vulnerability-cve-2019-18847.html
CVE ID: CVE-2019-18848 State: PUBLISHED Published: 2019-11-12T14:23:54 Last Updated: 2024-08-05T02:02:39.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nov/json-jwt/commit/ada16e772906efdd035e3df49cb2ae372f0f948a - https://github.com/nov/json-jwt/compare/v1.10.2...v1.11.0 - https://lists.debian.org/debian-lts-announce/2020/10/msg00001.html
CVE ID: CVE-2019-18849 State: PUBLISHED Published: 2019-11-11T03:21:55 Last Updated: 2024-08-05T02:02:39.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/verdammelt/tnef/pull/40 - https://github.com/verdammelt/tnef/compare/1.4.17...1.4.18 - https://lists.debian.org/debian-lts-announce/2019/11/msg00035.html - https://lists.fedoraproject.org/archives/list/package
tps://lists.debian.org/debian-lts-announce/2019/11/msg00035.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMKFSHPMOZL7MDWU5RYOTIBTRWSZ4Z6X/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7CPKBW4QZ4VIY4UXIUVUSHRJ4R2FROE/ - https://usn.ubuntu.com/4524-1/ - https://lists.debian.org/debian-lts-announce/2021/08/msg00025.html
CVE ID: CVE-2019-18850 State: PUBLISHED Published: 2019-12-04T12:42:03 Last Updated: 2024-08-05T02:02:39.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITE_PATH_QUERY". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/trustedsec/trevorc2/blob/master/CHANGELOG.txt - https://github.com/trustedsec/trevorc2/issues/18
CVE ID: CVE-2019-18852 State: PUBLISHED Published: 2019-11-11T13:42:47 Last Updated: 2024-08-05T02:02:39.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 (for DCN), DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842 C1 v3.00. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChandlerChin/Dlink_vuls/blob/master/A%20hard%20coded%20telnet%20user%20was%20discovered%20in%20multiple%20Dlink%20routers.pdf
CVE ID: CVE-2019-18853 State: PUBLISHED Published: 2019-11-11T14:36:15 Last Updated: 2024-08-05T02:02:39.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to SVG and libxml2. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/zeroday/FG-VD-19-136 - https://github.com/ImageMagick/ImageMagick/commit/ec9c8944af2bfc65c697ca44f93a727a99b405f1
CVE ID: CVE-2019-18854 State: PUBLISHED Published: 2019-11-11T14:36:02 Last Updated: 2024-08-05T02:02:39.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9937 - https://fortiguard.com/zeroday/FG-VD-19-113 - https://plugins.trac.wordpress.org/changeset/2185438 - https://wordpress.org/plugins/safe-svg/#developers
CVE ID: CVE-2019-18855 State: PUBLISHED Published: 2019-11-11T14:35:49 Last Updated: 2024-08-05T02:02:39.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9937 - https://fortiguard.com/zeroday/FG-VD-19-113 - https://plugins.trac.wordpress.org/changeset/2185438 - https://wordpress.org/plugins/safe-svg/#developers
CVE ID: CVE-2019-18856 State: PUBLISHED Published: 2019-11-11T14:35:14 Last Updated: 2024-08-05T02:02:39.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/zeroday/FG-VD-19-115 - https://git.drupalcode.org/project/svg_sanitizer/commit/e1b0666
CVE ID: CVE-2019-18857 State: PUBLISHED Published: 2019-11-11T14:34:59 Last Updated: 2024-08-05T02:02:39.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0 - https://github.com/darylldoyle/svg-sanitizer/compare/0.11.0...0.12.0
CVE ID: CVE-2019-18858 State: PUBLISHED Published: 2019-11-20T17:04:25 Last Updated: 2024-08-05T02:02:39.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/fileadmin/data/customers/security/2019/Advisory2019-10_CDS-68341.pdf - https://www.tenable.com/security/research/tra-2019-48
CVE ID: CVE-2019-18859 State: PUBLISHED Published: 2020-01-09T20:07:12 Last Updated: 2024-08-05T02:02:39.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: Digi AnywhereUSB 14 allows XSS via a link for the Digi Page. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/RNPG/e0d25ad51aa5c288b9005900f88a4f03 - http://packetstormsecurity.com/files/155926/Digi-AnywhereUSB-14-Cross-Site-Scripting.html
CVE ID: CVE-2019-18860 State: PUBLISHED Published: 2020-03-20T20:32:16.000Z Last Updated: 2025-11-05T17:04:14.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/pull/504 - https://github.com/squid-cache/squid/pull/505 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html - https://usn.ubuntu.com/4356-1/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html - https://www.debian.org/security/2020/dsa-4732
CVE ID: CVE-2019-18862 State: PUBLISHED Published: 2019-11-11T15:49:12 Last Updated: 2024-08-05T02:02:39.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode. Additional Analyst Notes: - CVE Program Container: References: - https://git.savannah.gnu.org/cgit/mailutils.git/tree/NEWS - http://packetstormsecurity.com/files/155425/GNU-Mailutils-3.7-Privilege-Escalation.html - https://security.gentoo.org/glsa/202006-12
CVE ID: CVE-2019-18863 State: PUBLISHED Published: 2020-03-02T17:52:37 Last Updated: 2024-08-05T02:02:39.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. A successful exploit may allow the attacker to intercept sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-19-0006
CVE ID: CVE-2019-18864 State: PUBLISHED Published: 2020-05-07T13:01:35 Last Updated: 2024-08-05T02:02:39.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: /server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive information about the host machine. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18865 State: PUBLISHED Published: 2020-05-07T12:56:26 Last Updated: 2024-08-05T02:02:39.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames. Additional Analyst Notes: - CVE Program Container: References: - https://lodestonesecurity.com - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18866 State: PUBLISHED Published: 2020-05-07T13:03:01 Last Updated: 2024-08-05T02:02:39.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract arbitrary data from the rkc database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18867 State: PUBLISHED Published: 2020-05-07T12:59:45 Last Updated: 2024-08-05T02:02:39.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: Browsable directories in Blaauw Remote Kiln Control through v3.00r4 allow an attacker to enumerate sensitive filenames and locations, including source code. This affects /ajax/, /common/, /engine/, /flash/, /images/, /Images/, /jscripts/, /lang/, /layout/, /programs/, and /sms/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18868 State: PUBLISHED Published: 2020-05-07T12:57:47 Last Updated: 2024-08-05T02:02:39.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lang/en.bak. Additional Analyst Notes: - CVE Program Container: References: - https://lodestonesecurity.com - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18869 State: PUBLISHED Published: 2020-05-07T13:07:37 Last Updated: 2024-08-05T02:02:39.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18870 State: PUBLISHED Published: 2020-05-07T13:05:31 Last Updated: 2024-08-05T02:02:39.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary files from the host machine. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18871 State: PUBLISHED Published: 2020-05-07T13:06:36 Last Updated: 2024-08-05T02:02:39.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18872 State: PUBLISHED Published: 2020-05-07T13:04:24 Last Updated: 2024-08-05T02:02:39.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE ID: CVE-2019-18873 State: PUBLISHED Published: 2019-11-12T01:01:11 Last Updated: 2024-08-05T02:02:39.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. The problem is in admsession.php and admuser.php. Additional Analyst Notes: - CVE Program Container: References: -
rver. The problem is in admsession.php and admuser.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fuzzlove/FUDforum-XSS-RCE - https://sourceforge.net/p/fudforum/code/6321/
CVE ID: CVE-2019-18874 State: PUBLISHED Published: 2019-11-12T01:30:29 Last Updated: 2024-08-05T02:02:39.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/giampaolo/psutil/pull/1616 - https://lists.debian.org/debian-lts-announce/2019/11/msg00018.html - https://usn.ubuntu.com/4204-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P7QI7MOTZTFXQYU23CP3RAWXCERMOAS/ -
s.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P7QI7MOTZTFXQYU23CP3RAWXCERMOAS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLETTJYZL2SMBUI4Q2NGBMGPDPP54SRG/
CVE ID: CVE-2019-18881 State: PUBLISHED Published: 2019-11-12T02:56:20 Last Updated: 2024-08-05T02:02:40.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0625
CVE ID: CVE-2019-18882 State: PUBLISHED Published: 2019-11-12T02:56:10 Last Updated: 2024-08-05T02:02:39.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0625
CVE ID: CVE-2019-18883 State: PUBLISHED Published: 2019-11-13T19:55:05 Last Updated: 2024-08-05T02:02:39.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LavaLite/cms/ - http://packetstormsecurity.com/files/155241/LavaLite-CMS-5.7-Cross-Site-Scripting.html
CVE ID: CVE-2019-18884 State: PUBLISHED Published: 2019-11-13T19:51:32 Last Updated: 2024-08-05T02:02:39.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users. Additional Analyst Notes: - CVE Program Container: References: - https://codecanyon.net/item/rise-ultimate-project-manager/15455641 - http://packetstormsecurity.com/files/155242/RISE-Ultimate-Project-Manager-2.3-Cross-Site-Request-Forgery.html
CVE ID: CVE-2019-18885 State: PUBLISHED Published: 2019-11-14T13:53:44 Last Updated: 2024-08-05T02:02:39.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4254-1/ - https://usn.ubuntu.com/4254-2/ - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00019.html - https://www.o
1/ - https://usn.ubuntu.com/4287-2/ - https://lists.debian.org/debian-lts-announce/2020/08/msg00019.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://github.com/torvalds/linux/commit/09ba3bc9dd150457c506e4661380a6183af651c1 - https://github.com/bobfuzzer/CVE-2019-18885 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=09ba3bc9dd150457c506e4661380a6183af651c1 - https://security.netapp.com/advisory/ntap-20191205-0001/ - http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html
CVE ID: CVE-2019-18886 State: PUBLISHED Published: 2019-11-21T17:41:54 Last Updated: 2024-08-05T02:02:39.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/releases/tag/v4.3.8 - https://symfony.com/blog/symfony-4-3-8-released - https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using
https://symfony.com/blog/symfony-4-3-8-released - https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality
CVE ID: CVE-2019-18887 State: PUBLISHED Published: 2019-11-21T22:18:04 Last Updated: 2024-08-05T02:02:39.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel. Additional Analyst Notes: - CVE Program Container: References: - https://symfony.com/blog/symfony-4-3-8-released - https://github.com/symfony/symfony/releases/tag/v4.3.8 - https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner - https://lists.fedoraproject.org/archives/list/package-announce%4
-2019-18887-use-constant-time-comparison-in-urisigner - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
CVE ID: CVE-2019-18888 State: PUBLISHED Published: 2019-11-21T22:19:52 Last Updated: 2024-08-05T02:02:39.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x). Additional Analyst Notes: - CVE Program Container: References: - https://symfony.com/blog/symfony-4-3-8-released - https://github.com/symfony/symfony/releases/t
Container: References: - https://symfony.com/blog/symfony-4-3-8-released - https://github.com/symfony/symfony/releases/tag/v4.3.8 - https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
CVE ID: CVE-2019-18889 State: PUBLISHED Published: 2019-11-21T22:21:42 Last Updated: 2024-08-05T02:02:39.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache. Additional Analyst Notes: - CVE Program Container: References: - https://symfony.com/blog/symfony-4-3-8-released - https://github.com/symfony/symfony/releases/tag/v4.3.8 - https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances - https://lists.fedoraproject.or
om/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/