rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-14251 
An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage downloadDocServer() to traverse the file system and access files or directories that are outside of the restricted directory because WealthT24/GetImage is used with the docDownloadPath and uploadLocation parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T16:39:37.000Z
CVE-2019-14252 
An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, one is able to inject arbitrary PHP code by using the adminCons.php form. The code is then stored in the E:\PUBLISURE\webservice\webpages\AdminDir\Templates\ folder even if removed from the adminCons.php view (i.e., the rogue PHP file can be hidden).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-18T15:35:24.000Z
CVE-2019-14253 
An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and perform a query on PHP forms within the /AdminDir folder that should be restricted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-18T15:37:08.000Z
CVE-2019-14254 
An issue was discovered in the secure portal in Publisure 2.1.2. Because SQL queries are not well sanitized, there are multiple SQL injections in userAccFunctions.php functions. Using this, an attacker can access passwords and/or grant access to the user account "user" in order to become "Administrator" (for example).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-18T15:38:31.000Z
CVE-2019-14255 
A Server Side Request Forgery (SSRF) vulnerability in go-camo up to version 1.1.4 allows a remote attacker to perform HTTP requests to internal endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T12:41:01.000Z
CVE-2019-14257 
pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:35:35.000Z
CVE-2019-14258 
The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:33:52.000Z
CVE-2019-14259 
On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T14:44:12.000Z
CVE-2019-14260 
On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T19:15:14.000Z
CVE-2019-14261 
An issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices. Due to an insufficient implementation of jamming detection, an attacker is able to suppress correctly received RF messages sent between wireless peripheral components, e.g., wireless detectors or remote controls, and the ABUS Secvest alarm central. An attacker is able to perform a "reactive jamming" attack. The reactive jamming simply detects the start of a RF message sent by a component of the ABUS Secvest wireless alarm system, for instance a wireless motion detector (FUBW50000) or a remote control (FUBE50014 or FUBE50015), and overlays it with random data before the original RF message ends. Thereby, the receiver (alarm central) is not able to properly decode the original transmitted signal. This enables an attacker to suppress correctly received RF messages of the wireless alarm system in an unauthorized manner, for instance status messages sent by a detector indicating an intrusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-03T17:53:38.000Z
CVE-2019-14262 
MetadataExtractor 2.1.0 allows stack consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-25T04:35:51.000Z
CVE-2019-14266 
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-25T15:07:07.000Z
CVE-2019-14267 
PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T15:13:49.000Z
CVE-2019-14268 
In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.3. The fix was back-ported to LTS 2019.6.5 as well as LTS 2019.3.7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-25T15:55:20.000Z
CVE-2019-14270 
Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with the Comodo Container feature, are vulnerable to Sandbox Escape.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-25T16:28:27.000Z
CVE-2019-14271 
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T17:05:57.000Z
CVE-2019-14272 
In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T11:50:53.000Z
CVE-2019-14273 
In SilverStripe assets 4.0, there is broken access control on files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T11:42:49.000Z
CVE-2019-14274 
MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T03:15:42.000Z
CVE-2019-14275 
Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T03:16:12.000Z
CVE-2019-14276 
WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T11:49:08.000Z
CVE-2019-14277 
Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks (i.e., SSRF with resultant remote code execution). NOTE: The vendor disputes this issues as not being a vulnerability because “All attacks that use external entities are blocked (no external DTD or file inclusions, no SSRF). The impact on confidentiality, integrity and availability is not proved on any version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T03:33:12.000Z
CVE-2019-14278 
In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-05T17:29:00.000Z
CVE-2019-14280 
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T03:52:46.000Z
CVE-2019-14281 
The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T04:06:23.000Z
CVE-2019-14282 
The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T04:06:40.000Z
CVE-2019-14283 
In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T12:24:47.000Z
CVE-2019-14284 
In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T12:25:01.000Z
CVE-2019-14286 
In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T17:02:34.000Z
CVE-2019-14287 
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T17:03:28.000Z
CVE-2019-14288 
An issue was discovered in Xpdf 4.01.01. There is an Integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "one byte per line" case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:39:45.000Z
CVE-2019-14289 
An issue was discovered in Xpdf 4.01.01. There is an integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "multiple bytes per line" case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:39:51.000Z
CVE-2019-14290 
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:39:58.000Z
CVE-2019-14291 
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:40:04.000Z
CVE-2019-14292 
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:40:12.000Z
CVE-2019-14293 
An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:40:18.000Z
CVE-2019-14294 
An issue was discovered in Xpdf 4.01.01. There is a use-after-free in the function JPXStream::fillReadBuf at JPXStream.cc, due to an out of bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:40:27.000Z
CVE-2019-14295 
An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:40:33.000Z
CVE-2019-14296 
canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T18:40:41.000Z
CVE-2019-14297 
Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T22:36:27.000Z
CVE-2019-14298 
Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T22:36:53.000Z
CVE-2019-14299 
Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T18:50:21.000Z
CVE-2019-14300 
Several Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T14:22:06.000Z
CVE-2019-14301 
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T18:00:09.000Z
CVE-2019-14302 
On Ricoh SP C250DN 1.06 devices, a debug port can be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T17:59:46.000Z
CVE-2019-14303 
Ricoh SP C250DN 1.05 devices allow denial of service (issue 1 of 3). Some Ricoh printers were affected by a wrong LPD service implementation that lead to a denial of service vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T18:49:00.000Z
CVE-2019-14304 
Ricoh SP C250DN 1.06 devices allow CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T17:58:30.000Z
CVE-2019-14305 
Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for Wi-Fi, mDNS, POP3, SMTP, and notification alerts, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T14:19:54.000Z
CVE-2019-14306 
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T17:59:24.000Z
CVE-2019-14307 
Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for SNMP, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T14:18:04.000Z
CVE-2019-14308 
Several Ricoh printers have multiple buffer overflows parsing LPD packets, which allow an attacker to cause a denial of service or code execution via crafted requests to the LPD service. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T13:28:30.000Z
CVE-2019-14309 
Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer firmware. This would allow to an attacker to access and read information stored on the shared FTP folders.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T18:47:15.000Z
CVE-2019-14310 
Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). Unauthenticated crafted packets to the IPP service will cause a vulnerable device to crash. A memory corruption has been identified in the way of how the embedded device parsed the IPP packets
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T18:45:22.000Z
CVE-2019-14312 
Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-09T12:31:53.000Z
CVE-2019-14313 
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T17:31:06.000Z
CVE-2019-14314 
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T15:58:40.000Z
CVE-2019-14315 
A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T00:23:02.000Z
CVE-2019-14317 
wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bits of the generated nonces.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T17:30:30.000Z
CVE-2019-14318 
Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp (prime field curves, small leakage) and algebra.cpp (binary field curves, large leakage) is not constant time and leaks the bit length of the scalar among other information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T16:26:56.000Z
CVE-2019-14319 
The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker to extract private sensitive information by sniffing network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-04T19:57:59.000Z
CVE-2019-14322 
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T12:36:59.000Z
CVE-2019-14323 
SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T12:43:39.000Z
CVE-2019-14326 
An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23) with root privileges in the emulated Android system. This can be exploited by remote attackers to gain full access to the device, or by malicious apps installed inside the emulator to perform privilege escalation from a normal user to root (unlike with standard methods of getting root privileges on Android - e.g., the SuperSu program - the user is not asked for consent). There is no authentication performed - access to a root shell is given upon a successful connection. NOTE: although this was originally published with a slightly different CVE ID number, the correct ID for this Andy vulnerability has always been CVE-2019-14326.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-14T18:58:23.000Z