rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-12928 
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T10:06:44.000Z
CVE-2019-12929 
The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T10:07:43.000Z
CVE-2019-12930 
A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T19:20:28.000Z
CVE-2019-12932 
A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out.Viewfolder.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-28T17:19:38.000Z
CVE-2019-12934 
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T23:47:55.000Z
CVE-2019-12935 
Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-23T22:23:15.000Z
CVE-2019-12936 
BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-23T22:35:30.000Z
CVE-2019-12937 
apps/gsudo.c in gsudo in ToaruOS through 1.10.9 has a buffer overflow allowing local privilege escalation to the root user via the DISPLAY environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-23T22:54:45.000Z
CVE-2019-12938 
The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T13:07:31.000Z
CVE-2019-12939 
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T15:06:25.000Z
CVE-2019-12940 
LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php via a large integer value of the depth parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T15:06:36.000Z
CVE-2019-12941 
AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output (input is only 8 characters), which allows an attacker to deduce the WiFi password from the WiFi SSID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-14T17:02:22.000Z
CVE-2019-12942 
TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is unavailable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T20:48:24.000Z
CVE-2019-12943 
TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information about valid account names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T20:51:05.000Z
CVE-2019-12944 
Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-15T13:56:36.000Z
CVE-2019-12946 
Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T13:59:02.000Z
CVE-2019-12948 
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T15:16:41.000Z
CVE-2019-12949 
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a server. Then, the remote attacker can run any command with root privileges on that server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-25T10:55:17.000Z
CVE-2019-12950 
An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T16:16:40.000Z
CVE-2019-12951 
An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T22:05:46.000Z
CVE-2019-12953 
Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T19:33:13.000Z
CVE-2019-12954 
SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T16:42:27.000Z
CVE-2019-12957 
In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T23:27:17.000Z
CVE-2019-12958 
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in FoFiType1C::convertToType0 in fofi/FoFiType1C.cc when it is trying to access the second privateDicts array element, because the privateDicts array has only one element allocated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-24T23:27:28.000Z
CVE-2019-12959 
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T17:33:08.000Z
CVE-2019-12960 
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_dt_s_d.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-25T12:55:17.000Z
CVE-2019-12961 
LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-25T12:55:28.000Z
CVE-2019-12962 
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-25T12:55:43.000Z
CVE-2019-12963 
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-25T12:55:52.000Z
CVE-2019-12964 
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-25T12:56:01.000Z
CVE-2019-12966 
FeHelper through 2019-06-19 allows arbitrary code execution during a JSON format operation, as demonstrated by the {"a":(function(){confirm(1)})()} input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T11:31:17.000Z
CVE-2019-12967 
Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T14:58:19.000Z
CVE-2019-12968 
A vulnerability was found in the Sonic Robo Blast 2 (SRB2) plugin (EP_Versions 9 to 11 inclusive) distributed with Doomseeker 1.1 and 1.2. Affected plugin versions did not discard IP packets with an unnaturally long response length from a Sonic Robo Blast 2 master server, allowing a remote attacker to cause a potential crash / denial of service in Doomseeker. The issue has been remediated in the Doomseeker 1.3 release with source code patches to the SRB2 plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T12:02:55.000Z
CVE-2019-12970 
XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-01T10:32:05.000Z
CVE-2019-12971 
BKS EBK Ethernet-Buskoppler Pro before 3.01 allows Unrestricted Upload of a File with a Dangerous Type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-05T19:39:51.000Z
CVE-2019-12972 
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T13:27:41.000Z
CVE-2019-12973 
In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:07:51.000Z
CVE-2019-12974 
A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:07:59.000Z
CVE-2019-12975 
ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:08:07.000Z
CVE-2019-12976 
ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:08:56.000Z
CVE-2019-12977 
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:09:05.000Z
CVE-2019-12978 
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:09:13.000Z
CVE-2019-12979 
ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:09:24.000Z
CVE-2019-12980 
In Ming (aka libming) 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the SWFInput_readSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:09:31.000Z
CVE-2019-12981 
Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:09:38.000Z
CVE-2019-12982 
Ming (aka libming) 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in libutil.a. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:09:46.000Z
CVE-2019-12984 
A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-26T17:10:03.000Z
CVE-2019-12985 
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:53:12.000Z
CVE-2019-12986 
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:47:04.000Z
CVE-2019-12987 
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:42:46.000Z
CVE-2019-12988 
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:39:56.000Z
CVE-2019-12989 
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:32:44.000Z
CVE-2019-12990 
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:29:01.000Z
CVE-2019-12991 
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:16:38.000Z
CVE-2019-12992 
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:12:31.000Z
CVE-2019-12994 
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T17:31:45.000Z
CVE-2019-12995 
Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is related to a jwt_authenticator.cc segmentation fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-28T09:55:48.000Z
CVE-2019-12996 
In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentially unsafe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T18:43:06.000Z
CVE-2019-12997 
In Loopchain through 2.2.1.3, an attacker can escalate privileges from a low-privilege shell by changing the environment (aka injection in the DEFAULT_SCORE_HOST environment variable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-28T10:28:14.000Z
CVE-2019-12998 
c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "It can be used for testing, but it should not be used for real funds."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T19:36:05.000Z
CVE-2019-12999 
Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T19:38:31.000Z
CVE-2019-13000 
Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "it is beta-quality software and don't put too much money in it."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T19:40:03.000Z
CVE-2019-13001 
An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue that allowed unauthorized users to add comments to a private snippet. It allows authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T14:49:10.000Z
CVE-2019-13002 
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last merge request. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T14:51:46.000Z
CVE-2019-13003 
An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T14:53:30.000Z
CVE-2019-13004 
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments section would become inaccessible. It has Incorrect Access Control (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T14:54:59.000Z
CVE-2019-13005 
An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authorization issues that disclosed restricted user, group, and repository metadata to unauthorized users. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T14:57:24.000Z
CVE-2019-13006 
An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T16:57:39.000Z
CVE-2019-13007 
An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T17:03:04.000Z
CVE-2019-13009 
An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T17:06:14.000Z
CVE-2019-13010 
An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific formats were used. It allows Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T17:07:50.000Z
CVE-2019-13011 
An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T17:09:40.000Z
CVE-2019-13012 
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-28T14:07:42.000Z
CVE-2019-13013 
Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root.
Problem types: cwe_id: CWE-264
description: CWE-264: Permissions, Privileges, and Access Controls
Affected products: vendor: n/a
product: Little Snitch
Published: 2019-08-23T16:58:49.000Z