rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-13465 
An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. ROS_ASSERT_MSG only works when ROS_ASSERT_ENABLED is defined. This leads to a problem in the remove() function in clients/roscpp/src/libros/spinner.cpp. When ROS_ASSERT_ENABLED is not defined, the iterator loop will run out of the scope of the array, and cause denial of service for other components (that depend on the communication-related functions of this package). NOTE: The reporter of this issue now believes it was a false alarm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T17:50:01.000Z
CVE-2019-13466 
Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-30T17:52:04.000Z
CVE-2019-13467 
Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-30T18:30:27.000Z
CVE-2019-13470 
MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T21:00:25.000Z
CVE-2019-13472 
PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T21:57:37.000Z
CVE-2019-13473 
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have an undocumented TELNET service within the BusyBox subsystem, leading to root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-11T00:00:00.000Z
CVE-2019-13474 
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have insufficient access control for the /set_dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T00:00:00.000Z
CVE-2019-13475 
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T21:58:05.000Z
CVE-2019-13476 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T19:02:13.000Z
CVE-2019-13477 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:55:04.000Z
CVE-2019-13478 
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T22:35:20.000Z
CVE-2019-13481 
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to SetWanSettings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T19:53:29.000Z
CVE-2019-13482 
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T19:53:39.000Z
CVE-2019-13483 
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-25T19:34:58.000Z
CVE-2019-13484 
In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of &nbsp; expansion in appfeed.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T16:26:53.000Z
CVE-2019-13485 
In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the history viewer component via a long hostname or service parameter to history.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T16:25:52.000Z
CVE-2019-13486 
In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of &nbsp; expansion in svcstatus.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T16:01:29.000Z
CVE-2019-13488 
A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web script or HTML via the country, query, or refer parameter to the /register URI, because the jQuery prepend() method is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T21:18:38.000Z
CVE-2019-13489 
Trape through 2019-05-08 has SQL injection via the data[2] variable in core/db.py, as demonstrated by the /bs t parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T21:18:52.000Z
CVE-2019-13493 
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T19:10:51.000Z
CVE-2019-13494 
nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long variable string in a Map Objects text file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-12T03:57:39.000Z
CVE-2019-13495 
In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-31T17:04:56.000Z
CVE-2019-13496 
One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and replacing a failed SAML response with a successful SAML response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-04T16:56:36.000Z
CVE-2019-13497 
One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-04T17:08:14.000Z
CVE-2019-13498 
One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks. This issue is fixed in version 8.1.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T16:01:19.000Z
CVE-2019-13503 
mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T01:49:10.000Z
CVE-2019-13504 
There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T00:00:00.000Z
CVE-2019-13505 
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T12:26:29.000Z
CVE-2019-13506 
@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:07:05.000Z
CVE-2019-13507 
hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:26:09.000Z
CVE-2019-13508 
FreeTDS through 1.1.11 has a Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T20:55:15.000Z
CVE-2019-13509 
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T15:34:59.000Z
CVE-2019-13510 
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an unsuspecting user may result in the application crashing or the execution of arbitrary code.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416 (CVE-2019-13510)
Affected products: vendor: n/a
product: Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier
Published: 2019-08-15T18:15:24.000Z
CVE-2019-13511 
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation.
Problem types: cwe_id: CWE-200
description: INFORMATION EXPOSURE CWE-200 (CVE-2019-13511)
Affected products: vendor: n/a
product: Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier
Published: 2019-08-15T18:15:13.000Z
CVE-2019-13512 
Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an attacker to read limited information from the device.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Fuji Electric FRENIC Loader 3.5.0.0 and prior
Published: 2019-08-15T18:08:22.000Z
CVE-2019-13513 
In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger multiple out-of-bounds read vulnerabilities, which may allow information disclosure, remote code execution, or crash of the application.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Industrial Automation DOPSoft
Published: 2019-08-15T18:20:18.000Z
CVE-2019-13514 
In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger a use-after-free vulnerability, which may allow information disclosure, remote code execution, or crash of the application.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: n/a
product: Delta Industrial Automation DOPSoft
Published: 2019-08-15T18:42:51.000Z
CVE-2019-13515 
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.
Problem types: cwe_id: CWE-532
description: INCLUSION OF SENSITIVE INFORMATION IN LOG FILES CWE-532
Affected products: vendor: n/a
product: OSIsoft PI Web API
Published: 2019-08-15T18:39:36.000Z
CVE-2019-13516 
In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.
Problem types: cwe_id: CWE-693
description: PROTECTION MECHANISM FAILURE CWE-693
Affected products: vendor: n/a
product: OSIsoft PI Web API
Published: 2019-08-15T18:49:15.000Z
CVE-2019-13517 
In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not restricted in coordination with the expiration of access based on active directory user account changes when the device is joined to an AD domain.
Problem types: cwe_id: CWE-384
description: SESSION FIXATION CWE-384
Affected products: vendor: n/a
product: BD
Published: 2019-09-06T13:50:43.000Z
CVE-2019-13518 
An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the EZ Touch Editor Versions 2.1.0 and prior.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: EZ Touch Editor
Published: 2019-09-04T14:40:56.000Z
CVE-2019-13519 
A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell Automation has released version 16.00.01 of Arena Simulation Software to address the reported vulnerabilities.
Problem types: cwe_id: CWE-843
description: Access of resource using incompatible type ('Type confusion') CWE-843
Affected products: vendor: Rockwell
product: Rockwell Automation Arena Simulation Software
Published: 2020-01-27T22:56:50.000Z
CVE-2019-13520 
Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-Based Buffer Overflow
Affected products: vendor: n/a
product: Alpha5 Smart Loader
Published: 2019-08-20T19:38:39.000Z
CVE-2019-13521 
A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell Automation has released version 16.00.01 of Arena Simulation Software to address the reported vulnerabilities.
Problem types: cwe_id: CWE-357
description: Insufficient UI warning of dangerous operations CWE-357
Affected products: vendor: Rockwell
product: Rockwell Automation Arena Simulation Software
Published: 2020-01-27T22:52:54.000Z
CVE-2019-13522 
An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Versions 1.8.41 and prior.
Problem types: cwe_id: CWE-119
description: IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119
Affected products: vendor: n/a
product: EZ PLC Editor
Published: 2019-09-04T14:29:00.000Z
CVE-2019-13523 
In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders), which can be accessed without authentication over the network. Affected performance IP Cameras: HBD3PR2,H4D3PRV3,HED3PR3,H4D3PRV2,HBD3PR1,H4W8PR2,HBW8PR2,H2W2PC1M,H2W4PER3,H2W2PER3,HEW2PER3,HEW4PER3B,HBW2PER1,HEW4PER2,HEW4PER2B,HEW2PER2,H4W2PER2,HBW2PER2,H4W2PER3, and HPW2P1. Affected Performance Series NVRs: HEN08104,HEN08144,HEN081124,HEN16104,HEN16144,HEN16184,HEN16204,HEN162244,HEN16284,HEN16304,HEN16384,HEN32104,HEN321124,HEN32204,HEN32284,HEN322164,HEN32304, HEN32384,HEN323164,HEN64204,HEN64304,HEN643164,HEN643324,HEN643484,HEN04103,HEN04113,HEN04123,HEN08103,HEN08113,HEN08123,HEN08143,HEN16103,HEN16123,HEN16143,HEN16163,HEN04103L,HEN08103L,HEN16103L,HEN32103L.
Problem types: cwe_id: CWE-200
description: INFORMATION EXPOSURE CWE-200
Affected products: vendor: Honeywell
product: Performance IP Cameras
vendor: Honeywell
product: Performance NVRs
Published: 2019-09-26T14:22:59.000Z
CVE-2019-13524 
GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service condition. An operator must reboot the CPU module after removing battery or energy pack to recover from halt-mode.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: GE PACSystems RX3i
Published: 2020-01-16T17:53:12.000Z
CVE-2019-13525 
In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: n/a
product: Honeywell IP-AK2
Published: 2019-10-25T17:57:13.000Z
CVE-2019-13526 
Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-288
description: AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
Affected products: vendor: n/a
product: Datalogic AV7000 Linear barcode scanner
Published: 2019-08-29T22:48:17.000Z
CVE-2019-13527 
In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized.
Problem types: cwe_id: CWE-824
description: ACCESS OF UNINITIALIZED POINTER CWE-824
Affected products: vendor: n/a
product: Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier
Published: 2019-09-24T21:16:22.000Z
CVE-2019-13528 
A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000), Niagara 4.4u3 (JACE 3e, JACE 6e, JACE 7, JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10).
Problem types: cwe_id: CWE-285
description: Improper Authorization CWE-285
Affected products: vendor: n/a
product: Niagara
Published: 2019-09-24T21:23:48.000Z
CVE-2019-13529 
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
Problem types: cwe_id: CWE-352
description: CROSS-SITE REQUEST FORGERY (CSRF) CWE-352
Affected products: vendor: SMA Solar Technology AG
product: Sunny WebBox
Published: 2019-10-09T15:26:53.000Z
CVE-2019-13530 
Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). An attacker can use these credentials to login via ftp and upload a malicious firmware.
Problem types: cwe_id: CWE-259
description: USE OF HARD-CODED PASSWORD CWE-259
Affected products: vendor: n/a
product: Philips IntelliVue WLAN, portable patient monitors
Published: 2019-09-12T19:05:08.000Z
CVE-2019-13531 Medtronic Valleylab FT10 and LS10 Improper Authentication
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments can be bypassed, allowing for inauthentic instruments to connect to the generator.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Medtronic
product: Valleylab FT10 Energy Platform (VLFT10GEN)
default_status: unaffected
vendor: Medtronic
product: Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: Medtronic reported these vulnerabilities to CISA.
Published: 2019-11-08T19:46:45.000Z
CVE-2019-13532 
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: n/a
product: CODESYS V3 web server
Published: 2019-09-13T16:58:21.000Z
CVE-2019-13533 
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves.
Problem types: cwe_id: CWE-294
description: AUTHENTICATION BYPASS BY CAPTURE-REPLAY CWE-294
Affected products: vendor: n/a
product: Omron PLC CJ and CS Series
Published: 2019-12-16T19:25:00.000Z
CVE-2019-13534 
Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Problem types: cwe_id: CWE-494
description: DOWNLOAD OF CODE WITHOUT INTEGRITY CHECK CWE-494
Affected products: vendor: n/a
product: Philips IntelliVue WLAN, portable patient monitors
Published: 2019-09-12T19:02:57.000Z