Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15827 State: PUBLISHED Published: 2019-08-30T13:08:25 Last Updated: 2024-08-05T00:56:22.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9478 - https://wordpress.org/plugins/onesignal-free-web-push-notifications/#developers - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5530.php
CVE ID: CVE-2019-15828 State: PUBLISHED Published: 2019-08-30T13:10:10 Last Updated: 2024-08-05T00:56:22.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: The one-click-ssl plugin before 1.4.7 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9448 - https://wordpress.org/plugins/one-click-ssl/#developers
CVE ID: CVE-2019-15829 State: PUBLISHED Published: 2019-08-30T13:11:38 Last Updated: 2024-08-05T00:56:22.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9443 - https://wordpress.org/plugins/photoblocks-grid-gallery/#developers
CVE ID: CVE-2019-15830 State: PUBLISHED Published: 2019-08-30T13:12:58 Last Updated: 2024-08-05T00:56:22.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9440 - https://wordpress.org/plugins/icegram/#developers - https://blog.sucuri.net/2019/07/icegram-persistent-cross-site-scripting.html
CVE ID: CVE-2019-15831 State: PUBLISHED Published: 2019-08-30T13:27:05 Last Updated: 2024-08-05T00:56:22.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9420 - https://wordpress.org/plugins/visitors-traffic-real-time-statistics/#developers
CVE ID: CVE-2019-15832 State: PUBLISHED Published: 2019-08-30T13:31:08 Last Updated: 2024-08-05T00:56:22.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9420 - https://wordpress.org/plugins/visitors-traffic-real-time-statistics/#developers
CVE ID: CVE-2019-15833 State: PUBLISHED Published: 2019-08-30T13:32:26 Last Updated: 2024-08-05T00:56:22.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9418 - https://wordpress.org/plugins/simple-mail-address-encoder/#developers
CVE ID: CVE-2019-15834 State: PUBLISHED Published: 2019-08-30T16:06:04 Last Updated: 2024-08-05T00:56:22.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9400 - https://wordpress.org/plugins/webp-converter-for-media/#developers
CVE ID: CVE-2019-15835 State: PUBLISHED Published: 2019-08-30T16:07:28 Last Updated: 2024-08-05T00:56:22.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9398 - https://wordpress.org/plugins/wp-better-permalinks/#developers
CVE ID: CVE-2019-15836 State: PUBLISHED Published: 2019-08-30T16:08:56 Last Updated: 2024-08-05T00:56:22.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9394 - https://wordpress.org/plugins/wp-ultimate-recipe/#developers
CVE ID: CVE-2019-15837 State: PUBLISHED Published: 2019-08-30T16:10:56 Last Updated: 2024-08-05T00:56:22.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: The webp-express plugin before 0.14.8 for WordPress has stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9389 - https://wordpress.org/plugins/webp-express/#developers
CVE ID: CVE-2019-15838 State: PUBLISHED Published: 2019-08-30T16:12:02 Last Updated: 2024-08-05T00:56:22.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/custom-404-pro/#developers - https://wpvulndb.com/vulnerabilities/9857
CVE ID: CVE-2019-15839 State: PUBLISHED Published: 2019-08-30T16:14:10 Last Updated: 2024-08-05T00:56:22.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9368 - https://wordpress.org/plugins/sina-extension-for-elementor/#developers - https://www.pluginvulnerabilities.com/2019/06/18/our-proactive-monitoring-caught-a-local-file-inclusion-lfi-vulnerability-being-added-in-to-sina-extension-for-elementor/
CVE ID: CVE-2019-15840 State: PUBLISHED Published: 2019-08-30T16:15:31 Last Updated: 2024-08-05T00:56:22.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/facebook-for-woocommerce/#developers
CVE ID: CVE-2019-15841 State: PUBLISHED Published: 2019-08-30T16:16:57 Last Updated: 2024-08-05T00:56:22.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/facebook-for-woocommerce/#developers
CVE ID: CVE-2019-15842 State: PUBLISHED Published: 2019-08-30T16:19:06 Last Updated: 2024-08-05T00:56:22.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/easy-pdf-restaurant-menu-upload/#developers
CVE ID: CVE-2019-15843 State: PUBLISHED Published: 2019-09-18T14:29:44 Last Updated: 2024-08-05T00:56:22.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition involving a man-in-the-middle attack may lead to partial data leakage or malicious file writing. Additional Analyst Notes: - CVE Program Container: References: - https://sec.xiaomi.com/post/152
CVE ID: CVE-2019-15845 State: PUBLISHED Published: 2019-11-26T16:45:08 Last Updated: 2024-08-05T01:03:32.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/449617 - https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html - https://usn.ubuntu.com/4201-1/ - https://seclists.org/bugtraq/2019/Dec/31 - https://seclists.org/bugtraq/2019/Dec/32 - https://www.debian.org/security/2019/dsa-4587 - https://www.oracle.com/security-alerts/cpujan2020.html - https://secur
- https://www.debian.org/security/2019/dsa-4587 - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.gentoo.org/glsa/202003-06 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
CVE ID: CVE-2019-15846 State: PUBLISHED Published: 2019-09-06T10:15:43 Last Updated: 2024-08-05T01:03:32.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. Additional Analyst Notes: - CVE Program Container: References: - http://exim.org/static/doc/security/CVE-2019-15846.txt - https://www.openwall.com/lists/oss-security/2019/09/06/1 - https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html - https://seclists.org/bugtraq/2019/Sep/13 - http://www.openwall.com/lists/oss-security/2019/09/06/2 - https://www.debian.org/security/2019/dsa-4517 - https://usn.ubuntu.com/4124-1
wall.com/lists/oss-security/2019/09/06/2 - https://www.debian.org/security/2019/dsa-4517 - https://usn.ubuntu.com/4124-1/ - https://www.kb.cert.org/vuls/id/672565 - http://www.openwall.com/lists/oss-security/2019/09/06/6 - http://www.openwall.com/lists/oss-security/2019/09/06/4 - http://www.openwall.com/lists/oss-security/2019/09/06/5 - https://security.gentoo.org/glsa/201909-06 - http://www.openwall.com/lists/oss-security/2019/09/06/8 - http://www.openwall.com/lists/oss-security/2019/09/07/1 - http://www.openwall.com/lists/oss-security/2019/09/07/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/ - https://l
oject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/ - http://www.openwall.com/lists/oss-security/2019/09/08/1 - http://www.openwall.com/lists/oss-security/2019/09/09/1 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/ - https://usn.ubuntu.com/4124-2/ - https://exim.org/static/doc/security/CVE-2019-15846.txt
CVE ID: CVE-2019-15847 State: PUBLISHED Published: 2019-09-02T22:03:34 Last Updated: 2024-08-05T01:03:30.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same. Additional Analyst Notes: - CVE Program Container: References: - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481 - http://lists.opensuse.org/ope
CVE Program Container: References: - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html
CVE ID: CVE-2019-15848 State: PUBLISHED Published: 2019-09-05T19:38:45 Last Updated: 2024-08-05T01:03:30.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/teamcity/2019/09/important-security-notice-xss-vulnerability-allowing-rce/ - https://twitter.com/JLLeitschuh/status/1169332316612644864?s=20 - https://www.softwaresecured.com/jetbrains-teamcity-reflected-xss/ - https://gist.github.
atus/1169332316612644864?s=20 - https://www.softwaresecured.com/jetbrains-teamcity-reflected-xss/ - https://gist.github.com/JLLeitschuh/fe6784391254b58de680bbda78a04a70
CVE ID: CVE-2019-15849 State: PUBLISHED Published: 2019-10-17T13:33:20 Last Updated: 2024-08-05T01:03:30.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.eq-3.com/products/homematic.html - https://noskill1337.github.io/homematic-ccu3-session-fixation
CVE ID: CVE-2019-15850 State: PUBLISHED Published: 2019-10-17T13:38:15 Last Updated: 2024-08-05T01:03:30.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.eq-3.com/products/homematic.html - https://noskill1337.github.io/homematic-ccu3-remote-code-execution
CVE ID: CVE-2019-15851 State: REJECTED Published: 2019-09-03T04:52:40 Last Updated: 2019-09-03T17:33:38 Description: No description available.
CVE ID: CVE-2019-15854 State: PUBLISHED Published: 2020-01-17T16:41:57 Last Updated: 2024-08-05T01:03:30.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Maarch RM before 2.5. A privilege escalation vulnerability allows an authenticated user with lowest privileges to give herself highest administration privileges via a crafted PUT request to an unauthorized resource. Additional Analyst Notes: - CVE Program Container: References: - https://labs.maarch.org/maarch/maarchRM/blob/master/CHANGELOG.md
CVE ID: CVE-2019-15855 State: PUBLISHED Published: 2020-01-17T16:38:06 Last Updated: 2024-08-05T01:03:30.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Maarch RM before 2.5. A path traversal vulnerability allows an unauthenticated remote attacker to overwrite any files with a crafted POST request if the default installation procedure was followed. This results in a permanent Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://labs.maarch.org/maarch/maarchRM/blob/master/CHANGELOG.md
CVE ID: CVE-2019-15858 State: PUBLISHED Published: 2019-09-03T06:14:03 Last Updated: 2024-08-05T01:03:32.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9490 - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugin-lead-to-remote-code-execution/
CVE ID: CVE-2019-15859 State: PUBLISHED Published: 2019-10-09T15:04:24 Last Updated: 2024-08-05T01:03:30.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /password.jsn URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.socomec.com/single-circuit-multifunction-meters_en.html - http://seclists.org/fulldisclosure/2019/Oct/10 - http://packetstormsecurity.com/files/154764/Socomec-DIRIS-A-40-Password-Disclosure.html
CVE ID: CVE-2019-15860 State: PUBLISHED Published: 2019-09-03T06:39:23 Last Updated: 2024-08-05T01:03:30.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/RootUp/b5de893bb2e51a4c846c5a0caa13b666
CVE ID: CVE-2019-15862 State: PUBLISHED Published: 2019-09-26T20:50:21 Last Updated: 2024-08-05T01:03:30.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the application was configured to accept files only with a defined set of extensions). This affects CKFinder for ASP, CKFinder for ASP.NET, CKFinder for ColdFusion, and CKFinder for PHP. Additional Analyst Notes: - CVE Program Container: References: - https://ckeditor.com/blog/CKFinder-3.5.1-and-CKFinder-2.6.3-released/
CVE ID: CVE-2019-15863 State: PUBLISHED Published: 2019-09-03T11:41:51 Last Updated: 2024-08-05T01:03:30.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants. Additional Analyst Notes: - CVE Program Container: References: - https://www.convertplug.com/plus/changelog/
CVE ID: CVE-2019-15864 State: PUBLISHED Published: 2019-09-03T11:49:09 Last Updated: 2024-08-05T01:03:32.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9338 - https://wordpress.org/plugins/breadcrumbs-by-menu/#developers
CVE ID: CVE-2019-15865 State: PUBLISHED Published: 2019-09-03T11:49:58 Last Updated: 2024-08-05T01:03:32.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9338 - https://wordpress.org/plugins/breadcrumbs-by-menu/#developers
CVE ID: CVE-2019-15866 State: PUBLISHED Published: 2019-09-03T11:51:33 Last Updated: 2024-08-05T01:03:32.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/crelly-slider/#developers - https://blog.nintechnet.com/arbitrary-file-upload-vulnerability-in-wordpress-crelly-slider-plugin/
CVE ID: CVE-2019-15867 State: PUBLISHED Published: 2019-09-03T11:53:12 Last Updated: 2024-08-05T01:03:30.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9317 - https://wordpress.org/plugins/slick-popup/#developers - https://www.wordfence.com/blog/2019/05/privilege-escalation-flaw-present-in-slick-popup-plugin/
CVE ID: CVE-2019-15868 State: PUBLISHED Published: 2019-09-03T11:54:55 Last Updated: 2024-08-05T01:03:32.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: The affiliates-manager plugin before 2.6.6 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/affiliates-manager/#developers - https://wpvulndb.com/vulnerabilities/9335
CVE ID: CVE-2019-15869 State: PUBLISHED Published: 2019-09-03T11:57:12 Last Updated: 2024-08-05T01:03:31.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JobCareer theme before 2.5.1 for WordPress has stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9322
CVE ID: CVE-2019-15870 State: PUBLISHED Published: 2019-09-03T11:58:37 Last Updated: 2024-08-05T01:03:32.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9258
CVE ID: CVE-2019-15871 State: PUBLISHED Published: 2019-09-03T12:19:47 Last Updated: 2024-08-05T01:03:31.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/loginpress/#developers - https://www.webarxsecurity.com/loginpress-plugin/
CVE ID: CVE-2019-15872 State: PUBLISHED Published: 2019-09-03T12:17:11 Last Updated: 2024-08-05T01:03:32.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/loginpress/#developers - https://www.webarxsecurity.com/loginpress-plugin/
CVE ID: CVE-2019-15873 State: PUBLISHED Published: 2019-09-03T12:22:19 Last Updated: 2024-08-05T01:03:32.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9086 - https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/#developers
CVE ID: CVE-2019-15874 State: PUBLISHED Published: 2020-04-28T23:41:36 Last Updated: 2024-08-05T01:03:32.237Z Vendors: n/a Products: FreeBSD Problem Types: Out-of-bounds read Description: In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in memory access after it has been freed leading to a kernel panic or other unpredictable results. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:10.ipfw.asc - https://security.netapp.com/advisory/ntap-20200511-0002/
CVE ID: CVE-2019-15875 State: PUBLISHED Published: 2020-02-18T15:26:47 Last Updated: 2024-08-05T01:03:32.435Z Vendors: n/a Products: FreeBSD Problem Types: Kernel information exposure Description: In FreeBSD 12.1-STABLE before r354734, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r354735, and 11.3-RELEASE before 11.3-RELEASE-p6, due to incorrect initialization of a stack data structure, core dump files may contain up to 20 bytes of kernel data previously stored on the stack. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:03.thrmisc.asc
CVE ID: CVE-2019-15876 State: PUBLISHED Published: 2020-04-28T19:11:39 Last Updated: 2024-08-05T01:03:31.454Z Vendors: n/a Products: FreeBSD Problem Types: Missing authorization Description: In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specific ioctl command handlers in the oce network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to send passthrough commands to the device firmware. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:05.if_oce_ioctl.asc