Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-16641 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-12T17:53:14.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found on the Ruijie EG-2000 series gateway. There is a buffer overflow in client.so. Consequently, an attacker can use login.php to login to any account, without providing its password. This affects EG-2000SE EG_RGOS 11.1(1)B1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://0x.mk/?p=239
CVE ID: CVE-2019-16642 State: PUBLISHED Published: 2019-09-20T14:32:50 Last Updated: 2024-08-05T01:17:40.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yeyinshi/tuzicms/issues/6
CVE ID: CVE-2019-16643 State: PUBLISHED Published: 2019-09-20T15:06:32 Last Updated: 2024-08-05T01:17:41.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/94fzb/zrlog/issues/54
CVE ID: CVE-2019-16644 State: PUBLISHED Published: 2019-09-20T15:16:52 Last Updated: 2024-08-05T01:17:41.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yeyinshi/tuzicms/issues/6
CVE ID: CVE-2019-16645 State: PUBLISHED Published: 2019-09-20T18:24:15 Last Updated: 2024-08-05T01:17:41.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/GoAhead%20Web%20server%20HTTP%20Header%20Injection - http://packetstormsecurity.com/files/154652/GoAhead-2.5.0-Host-Header-Injection.html
CVE ID: CVE-2019-16647 State: PUBLISHED Published: 2019-10-29T16:04:11 Last Updated: 2024-08-05T01:17:41.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows. Additional Analyst Notes: - CVE Program Container: References: - http://forum.maxthon.com/index.php?/topic/24472-unquoted-search-path-and-potential-abuses/ - https://safebreach.com/Post/Maxthon-Browser-for-Windows-Unquoted-Search-Path-and-Potential-Abuses-CVE-2019-16647
CVE ID: CVE-2019-16649 State: PUBLISHED Published: 2019-09-21T01:54:55 Last Updated: 2024-08-05T01:17:41.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC. Additional Analyst Notes: - CVE Program Container: References: - https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/ - https://github.com/eclypsium/USBAnywhere
com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/ - https://github.com/eclypsium/USBAnywhere - https://www.supermicro.com/support/security_BMC_virtual_media.cfm
CVE ID: CVE-2019-16650 State: PUBLISHED Published: 2019-09-21T01:54:41 Last Updated: 2024-08-05T01:17:41.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC. Additional Analyst Notes: - CVE Program Container: References: - https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/ - https://github.com/eclypsium/USBAnywhere - h
/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/ - https://github.com/eclypsium/USBAnywhere - https://www.supermicro.com/support/security_BMC_virtual_media.cfm
CVE ID: CVE-2019-16651 State: PUBLISHED Published: 2021-09-20T13:26:26 Last Updated: 2024-08-05T01:17:41.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebinding to leak the WAN IP address of a user (if they are using certain VPN implementations, this would decloak them). Additional Analyst Notes: - CVE Program Container: References: - https://fidusinfosec.com/silently-unmasking-virgin-media-vpn-users-in-seconds-cve-2019-16651/ - https://portswigger.net/daily-swig/vpn-users-unmasked-
tly-unmasking-virgin-media-vpn-users-in-seconds-cve-2019-16651/ - https://portswigger.net/daily-swig/vpn-users-unmasked-by-zero-day-vulnerability-in-virgin-media-routers
CVE ID: CVE-2019-16652 State: PUBLISHED Published: 2020-04-29T12:56:11 Last Updated: 2024-08-05T01:17:41.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BPM component in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://www2.deloitte.com/it/it/pages/risk/articles/security-advisory-article---deloitte-italy---risk.html
CVE ID: CVE-2019-16653 State: PUBLISHED Published: 2020-04-29T13:02:10 Last Updated: 2024-08-05T01:17:41.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An application plugin in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to gain admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www2.deloitte.com/it/it/pages/risk/articles/security-advisory-article---deloitte-italy---risk.html
CVE ID: CVE-2019-16655 State: PUBLISHED Published: 2019-09-21T17:02:45 Last Updated: 2024-08-05T01:17:41.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/441
CVE ID: CVE-2019-16656 State: PUBLISHED Published: 2019-09-21T17:02:35 Last Updated: 2024-08-05T01:17:41.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/442
CVE ID: CVE-2019-16657 State: PUBLISHED Published: 2019-09-21T17:02:24 Last Updated: 2024-08-05T01:17:41.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yeyinshi/tuzicms/issues/5
CVE ID: CVE-2019-16658 State: PUBLISHED Published: 2019-09-21T17:02:13 Last Updated: 2024-08-05T01:17:41.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yeyinshi/tuzicms/issues/4
CVE ID: CVE-2019-16659 State: PUBLISHED Published: 2019-09-21T17:02:05 Last Updated: 2024-08-05T01:17:41.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yeyinshi/tuzicms/issues/3
CVE ID: CVE-2019-16660 State: PUBLISHED Published: 2019-09-21T17:01:56 Last Updated: 2024-08-05T01:17:41.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/440
CVE ID: CVE-2019-16661 State: PUBLISHED Published: 2019-09-21T17:01:46 Last Updated: 2024-08-05T01:17:41.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ogma CMS 0.5 has XSS via creation of a new blog. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/n00dles/ogma-CMS/issues/42
CVE ID: CVE-2019-16662 State: PUBLISHED Published: 2019-10-28T11:52:13 Last Updated: 2024-08-05T01:17:41.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mhaskar/ceb65fa4ca57c3cdccc1edfe2390902e - https://drive.google.com/open?id=1OXI5cNuwWqc6y-7BgNCfYHgFPK2cpvnu - https://drive.google.com/file/d/1bTpTn4-alJ8qGCEATLq-oVM6HbhE65iY/
oogle.com/open?id=1OXI5cNuwWqc6y-7BgNCfYHgFPK2cpvnu - https://drive.google.com/file/d/1bTpTn4-alJ8qGCEATLq-oVM6HbhE65iY/view?usp=sharing - https://rconfig.com/download - https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/ - http://packetstormsecurity.com/files/154999/rConfig-3.9.2-Remote-Code-Execution.html - http://packetstormsecurity.com/files/155186/rConfig-3.9.2-Command-Injection.html
CVE ID: CVE-2019-16663 State: PUBLISHED Published: 2019-10-28T11:53:02 Last Updated: 2024-08-05T01:17:41.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution. Additional Analyst Notes: - CVE Program Container: References: - https://rconfig.com/download - https://gist.github.com/mhaskar/e7e454c7cb0dd9a139b0a43691e258a0 - https://drive.google.com/open?id=1XmR2MSMb3cKARFk3XxmPkwz6GhAP1JxL - https://drive.google.com/open?id=1kQGmboKfwo
58a0 - https://drive.google.com/open?id=1XmR2MSMb3cKARFk3XxmPkwz6GhAP1JxL - https://drive.google.com/open?id=1kQGmboKfwob4RwlMjnv6ER2Za1GUptOi - https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
CVE ID: CVE-2019-16664 State: PUBLISHED Published: 2019-09-21T17:45:11 Last Updated: 2024-08-05T01:17:41.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinksaas/ThinkSAAS/issues/20
CVE ID: CVE-2019-16665 State: PUBLISHED Published: 2019-09-21T17:44:59 Last Updated: 2024-08-05T01:17:41.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinksaas/ThinkSAAS/issues/21
CVE ID: CVE-2019-16667 State: PUBLISHED Published: 2019-09-26T18:38:48 Last Updated: 2024-08-05T01:17:41.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/TEJdu9LN - http://packetstormsecurity.com/files/158614/pfSense-2.4.4-p3-Cross-Site-Request-Forgery.html
CVE ID: CVE-2019-16669 State: PUBLISHED Published: 2019-09-21T18:41:39 Last Updated: 2024-08-05T01:17:41.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pagekit/pagekit/issues/935
CVE ID: CVE-2019-16670 State: PUBLISHED Published: 2019-12-06T17:05:02 Last Updated: 2024-08-05T01:17:41.093Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. The Authentication mechanism has no brute-force prevention. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories - https://cert.vde.com/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/mediadelivery/asset/900_102694 - https://www.us-cert.
.com/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/mediadelivery/asset/900_102694 - https://www.us-cert.gov/ics/advisories/icsa-19-339-02
CVE ID: CVE-2019-16671 State: PUBLISHED Published: 2019-12-06T17:06:23 Last Updated: 2024-08-05T01:17:41.066Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Remote authenticated users can crash a device with a special packet because of Uncontrolled Resource Consumption. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories - https://cert.vde.com/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/m
s://cert.vde.com/en-us/advisories - https://cert.vde.com/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/mediadelivery/asset/900_102694 - https://www.us-cert.gov/ics/advisories/icsa-19-339-02
CVE ID: CVE-2019-16672 State: PUBLISHED Published: 2019-12-06T17:07:21 Last Updated: 2024-08-05T01:17:41.071Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sensitive Credentials data is transmitted in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories - https://cert.vde.com/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/mediadelivery/asset/900_102694 - https://www.us-cert.gov/
/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/mediadelivery/asset/900_102694 - https://www.us-cert.gov/ics/advisories/icsa-19-339-02
CVE ID: CVE-2019-16673 State: PUBLISHED Published: 2019-12-06T17:08:23 Last Updated: 2024-08-05T01:17:41.032Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Passwords are stored in cleartext and can be read by anyone with access to the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories - https://cert.vde.com/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/mediadelivery/asset/900_102694
ries - https://cert.vde.com/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/mediadelivery/asset/900_102694 - https://www.us-cert.gov/ics/advisories/icsa-19-339-02
CVE ID: CVE-2019-16674 State: PUBLISHED Published: 2019-12-06T17:09:17 Last Updated: 2024-08-05T01:17:41.079Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories - https://cert.vde.com/en-us/advisories/vde-2019-018 - https://mdco
References: - https://cert.vde.com/en-us/advisories - https://cert.vde.com/en-us/advisories/vde-2019-018 - https://mdcop.weidmueller.com/mediadelivery/asset/900_102694 - https://www.us-cert.gov/ics/advisories/icsa-19-339-02
CVE ID: CVE-2019-16675 State: PUBLISHED Published: 2019-10-31T21:22:59 Last Updated: 2024-08-05T01:17:41.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside. After manipulation, the attacker needs to exchange the original files with the manipulated ones on the application programming workstation. Additional Analyst Notes: - CVE Program Containe
s with the manipulated ones on the application programming workstation. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories - https://www.zerodayinitiative.com/advisories/ZDI-19-922/ - https://www.us-cert.gov/ics/advisories/icsa-19-302-01 - https://www.zerodayinitiative.com/advisories/ZDI-19-991/
CVE ID: CVE-2019-16676 State: PUBLISHED Published: 2019-09-30T11:43:11 Last Updated: 2024-08-05T01:17:41.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/plataformatec/simple_form/commits/master - https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx - http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676/
CVE ID: CVE-2019-16677 State: PUBLISHED Published: 2019-09-21T19:51:21 Last Updated: 2024-08-05T01:17:41.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/76
CVE ID: CVE-2019-16678 State: PUBLISHED Published: 2019-09-21T19:51:06 Last Updated: 2024-08-05T01:17:41.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/27
CVE ID: CVE-2019-16679 State: PUBLISHED Published: 2019-09-21T20:00:35 Last Updated: 2024-08-05T01:17:41.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GilaCMS/gila/issues/33 - https://github.com/GilaCMS/gila/releases/tag/1.11.1 - http://packetstormsecurity.com/files/154578/Gila-CMS-Local-File-Inclusion.html
CVE ID: CVE-2019-16680 State: PUBLISHED Published: 2019-09-21T20:33:21 Last Updated: 2024-08-05T01:17:41.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.gnome.org/show_bug.cgi?id=794337 - https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2 - https://gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1 - https://usn.ubuntu.com/4139-1/ - http
tlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1 - https://usn.ubuntu.com/4139-1/ - https://www.debian.org/security/2019/dsa-4537 - https://seclists.org/bugtraq/2019/Sep/57 - https://lists.debian.org/debian-lts-announce/2019/09/msg00032.html
CVE ID: CVE-2019-16681 State: PUBLISHED Published: 2019-09-21T20:42:40 Last Updated: 2024-08-05T01:17:41.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitrary URLs, which can inject deceptive content into the UI. (When in physical possession of the device, opening local files is also possible.) NOTE: As of 2019-09-23, the vendor has not agreed that this issue has serious impact. The vendor states that the issue is not critical because it does not allow Elevation of Privilege, Sensitive Data Leakage, or any critical unauthorized activity fro
ical because it does not allow Elevation of Privilege, Sensitive Data Leakage, or any critical unauthorized activity from a malicious user. The vendor also states that a victim must first install a malicious APK to their application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability
CVE ID: CVE-2019-16682 State: PUBLISHED Published: 2019-10-16T18:46:50 Last Updated: 2024-08-05T01:17:41.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://extensions.typo3.org/extension/url_redirect/ - https://typo3.org/security/advisory/typo3-ext-sa-2019-015/
CVE ID: CVE-2019-16683 State: PUBLISHED Published: 2019-09-30T15:15:23 Last Updated: 2024-08-05T01:17:41.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XOOPS/XoopsCore25/commits/master - https://xoops.org/modules/publisher/ - https://blog.nirajkhatiwada.com.np/cve-2019-16683-stored-cross-site-scripting/
CVE ID: CVE-2019-16684 State: PUBLISHED Published: 2019-09-30T15:28:03 Last Updated: 2024-08-05T01:17:41.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit page, the payload executes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XOOPS/XoopsCore25/commits/master - https://xoops.org/modules/publisher/ - https://blog.nirajkhatiwada.com.np/cve-2019-16684-stored-cross-site-scripting/