rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-12219 
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T16:33:21.000Z
CVE-2019-12220 
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T16:33:29.000Z
CVE-2019-12221 
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T16:33:37.000Z
CVE-2019-12222 
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T16:33:48.000Z
CVE-2019-12223 
An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The username triggers a buffer overflow in the main process controlling operation of the DVR system, rendering services unavailable during the reboot operation. A repeated attack affects availability as long as the attacker has network access to the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-05T14:55:03.000Z
CVE-2019-12239 
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T19:38:49.000Z
CVE-2019-12240 
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T19:39:01.000Z
CVE-2019-12241 
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T19:39:11.000Z
CVE-2019-12243 
Istio 1.1.x through 1.1.6 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T14:41:06.000Z
CVE-2019-12245 
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-25T18:41:07.000Z
CVE-2019-12246 
SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-19T16:29:37.000Z
CVE-2019-12247 
QEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of the argument list or the number of environment variables. NOTE: This has been disputed as not exploitable
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T14:22:54.000Z
CVE-2019-12248 
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to load external image resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T00:00:00.000Z
CVE-2019-12250 
IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maintainer disputes that this is a vulnerability because the request logger is not part of IdentityServer but only our development test host
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T15:22:43.000Z
CVE-2019-12251 
sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T15:39:59.000Z
CVE-2019-12252 
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T17:24:18.000Z
CVE-2019-12253 
my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T17:00:36.000Z
CVE-2019-12254 TECSON/GOK: Improper Authentication and Access Control on multiple devices
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: TECSON
product: e-litro net
vendor: TECSON
product: LX-Net
vendor: TECSON
product: LX-Q-Net
vendor: GOK
product: SmartBox 4 LAN
vendor: GOK
product: SmartBox 4 LAN PRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Maxim Rupp (rupp.it) reported this vulnerability to CERT@VDE.
Published: 2022-05-06T17:30:12.071Z
CVE-2019-12255 
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T19:18:03.000Z
CVE-2019-12256 
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T17:57:13.000Z
CVE-2019-12257 
Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T17:49:48.000Z
CVE-2019-12258 
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T20:00:44.000Z
CVE-2019-12259 
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T18:05:16.000Z
CVE-2019-12260 
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T20:18:30.000Z
CVE-2019-12261 
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a remote host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T20:27:25.000Z
CVE-2019-12262 
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vulnerability: Handling of unsolicited Reverse ARP replies (Logical Flaw).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T19:18:13.000Z
CVE-2019-12263 
Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T18:10:00.000Z
CVE-2019-12264 
Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T17:34:25.000Z
CVE-2019-12265 
Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T18:14:23.000Z
CVE-2019-12266 Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3
Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Wyze
product: Cam Pan v2
vendor: Wyze
product: Cam v2
vendor: Wyze
product: Cam v3
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Bitdefender Labs
Published: 2022-03-30T19:55:17.041Z
CVE-2019-12269 
Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T19:50:08.000Z
CVE-2019-12270 
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The share is used to retrieve documents for processing, and to store processed documents for display in the browser. The only required share level access is read/write by the JobProcessor service account. At the local filesystem level, the only additional required permissions would be read/write from the servlet engine, such as Tomcat. (The affected server components are not installed with Content Server by default, and must be installed separately.) NOTE: the vendor's position is that customers are not supposed to use this default setting without consulting the documentation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T20:07:21.000Z
CVE-2019-12271 
Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is not enforced on the server side.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T18:16:03.000Z
CVE-2019-12272 
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T14:13:31.000Z
CVE-2019-12273 
OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a *.outsystemsenterprise.com domain name.) NOTE: The vendor claims that the independent researcher created the report without any type of validation and that no such vulnerability exists
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T14:16:20.000Z
CVE-2019-12274 
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T15:07:30.000Z
CVE-2019-12276 
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T17:30:01.000Z
CVE-2019-12277 
Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for .. in a pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T14:07:03.000Z
CVE-2019-12278 
Opera through 53 on Android allows Address Bar Spoofing. Characters from several languages are displayed in Right-to-Left order, due to mishandling of several Unicode characters. The rendering mechanism, in conjunction with the "first strong character" concept, may improperly operate on a numerical IP address or an alphabetic string, leading to a spoofed URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T21:48:40.000Z
CVE-2019-12279 
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T15:04:48.000Z
CVE-2019-12280 
PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-25T20:55:14.000Z
CVE-2019-12288 
An issue was discovered in upgrade_htmls.cgi on VStarcam 100T (C7824WIP) KR75.8.53.20 and 200V (C38S) KR203.18.1.20 devices. The web service, network, and account files can be manipulated through a web UI firmware update without any authentication. The attacker can achieve access to the device through a manipulated web UI firmware update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T17:49:37.000Z
CVE-2019-12289 
An issue was discovered in upgrade_firmware.cgi on VStarcam 100T (C7824WIP) CH-sys-48.53.75.119~123 and 200V (C38S) CH-sys-48.53.203.119~123 devices. A remote command can be executed through a system firmware update without authentication. The attacker can modify the files within the internal firmware or even steal account information by executing a command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T17:52:33.000Z
CVE-2019-12290 
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T15:14:06.000Z
CVE-2019-12291 
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T16:35:38.000Z
CVE-2019-12292 
Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T15:55:42.000Z
CVE-2019-12293 
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T04:54:12.000Z
CVE-2019-12295 
In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T11:56:29.000Z
CVE-2019-12297 
An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled Format String, reachable via TCP port 8010 or UDP port 8080.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T13:02:06.000Z
CVE-2019-12298 
Leanify 0.4.3 allows remote attackers to trigger an out-of-bounds write (1024 bytes) via a modified input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T13:40:45.000Z
CVE-2019-12299 
Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T18:20:28.000Z
CVE-2019-12300 
Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T14:18:06.000Z
CVE-2019-12301 
The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T15:07:22.000Z
CVE-2019-12303 
In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T15:02:39.000Z
CVE-2019-12305 
In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration panel of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-16T19:11:40.000Z
CVE-2019-12308 
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T16:24:31.000Z
CVE-2019-12309 
dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T19:21:17.000Z
CVE-2019-12310 
ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view and retrieve verbose logging information. Files within this directory were observed to contain sensitive run-time information, including Base64 encoded 'support' credentials, leading to administrative access of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T18:59:47.000Z
CVE-2019-12311 
Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T18:23:02.000Z
CVE-2019-12312 
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T13:06:41.000Z
CVE-2019-12313 
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T13:30:50.000Z
CVE-2019-12314 
Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T13:46:44.000Z
CVE-2019-12315 
Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the "print from file" feature, as demonstrated by the sws/swsAlert.sws?popupid=successMsg msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T15:23:08.000Z