rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-10615 
u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value and size of keymaster bob which can lead to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SA415M, SA515M, SA6155P, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
Problem types: description: Integer Overflow to Buffer Overflow in Trusted Application
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Published: 2020-09-08T09:31:26.000Z
CVE-2019-10616 
Possibility of null pointer access if the SPDM commands are executed in the non-standard way in TZ. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8016, MDM9150, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8998, SA6155P, SDX24
Problem types: description: Null Pointer Dereference Issue in Trustzone
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Published: 2020-03-05T08:56:10.000Z
CVE-2019-10617 
Low privilege users can access service configuration which contains registry data that admins uses to create or delete entries in the registry in QCA6174_9377.WIN.1.0 in QCA6174_9377
Problem types: description: Permissions, Privileges and Access control Issues in Bluetooth Host
Affected products: vendor: Qualcomm, Inc.
product: QCA6174_9377.WIN.1.0
Published: 2019-11-21T14:38:22.000Z
CVE-2019-10618 
Driver may access an invalid address while processing IO control due to lack of check of address validation in Snapdragon Connectivity in QCA6390
Problem types: description: Information Exposure Issue in WLAN Host
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Connectivity
Published: 2019-12-12T08:30:41.000Z
CVE-2019-10620 
Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24, SM8150
Problem types: description: Buffer Copy Without Checking Size of Input in Display
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Published: 2020-04-16T10:46:05.000Z
CVE-2019-10621 
Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in Nicobar, QCS405, Rennell, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
Problem types: description: Use After Free Issue in Neural Processing Unit
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Published: 2020-04-16T10:46:05.000Z
CVE-2019-10622 
Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8096AU, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, QCN7605, QCS605, SC8180X, SDM710, SDX24, SDX55, SM8150, SM8250, SXR2130
Problem types: description: Buffer Over-read issue in Audio
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Published: 2020-04-16T10:46:06.000Z
CVE-2019-10623 
Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCN7605, QCS605, Rennell, SC8180X, SDA845, SDM710, SDX24, SDX55, SM7150, SM8150, SM8250, SXR2130
Problem types: description: Integer Overflow to Buffer Overflow in WLAN Host
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Published: 2020-04-16T10:46:06.000Z
CVE-2019-10624 
While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 data type in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, MSM8996AU, QCA6574AU, QCN7605, Rennell, SC8180X, SDM710, SDX55, SM7150, SM8150, SM8250, SXR2130
Problem types: description: Integer Overflow to Buffer Overflow in WLAN Host
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Published: 2020-04-16T10:46:07.000Z
CVE-2019-10625 
Out of bound access in diag services when DCI command buffer reallocation is not done properly with required capacity in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, QCS605, Rennell, SC8180X, SDM429W, SDM710, SDX55, SM7150, SM8150
Problem types: description: Buffer Over-read Issue in Diag Services
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Published: 2020-04-16T10:46:07.000Z
CVE-2019-10626 
Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Rennell, Saipan, SC8180X, SDA660, SDA845, SDM429W, SDM439, SDM670, SDM710, SDX20, SDX24, SDX55, SM8150, SM8250, SXR1130, SXR2130
Problem types: description: Information Exposure Issue inVideo
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Published: 2020-06-22T07:10:34.000Z
CVE-2019-10627 
Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters due to incorrect buffer size calculation. in PostScript and PDF printers that use IPS versions prior to 2019.2 in PostScript and PDF printers that use IPS versions prior to 2019.2
Problem types: description: Buffer overflow vulnerability in the PostScript- and PDF-compatible interpreters
Affected products: vendor: Qualcomm, Inc.
product: PostScript and PDF printers that use IPS versions prior to 2019.2
Published: 2019-11-21T14:38:22.000Z
CVE-2019-10628 
u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8098, Bitra, MDM9205, MDM9650, MSM8998, Nicobar, QCA6390, QCN7605, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA6155P, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
Problem types: description: Improper Validation of Array Index in Kernel
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Published: 2020-09-08T09:31:27.000Z
CVE-2019-10629 
u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Bitra, IPQ6018, IPQ8074, MDM9205, Nicobar, QCA8081, QCN7605, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA6155P, Saipan, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
Problem types: description: Improper Validation of Array Index in kernel
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Published: 2020-09-08T09:31:27.000Z
CVE-2019-10630 
A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T04:59:27.000Z
CVE-2019-10631 
Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T04:59:43.000Z
CVE-2019-10632 
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T04:59:51.000Z
CVE-2019-10633 
An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T05:00:10.000Z
CVE-2019-10634 
An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T05:00:20.000Z
CVE-2019-10636 
Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1087, 88SS1090, 88SS1100, 88SS1084, 88SS1088, & 88SS1098) devices allow reprogramming flash memory to bypass the secure boot protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-04T20:42:52.000Z
CVE-2019-10637 
Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1087, 88SS1090, 88SS1100, 88SS1084, 88SS1088, & 88SS1098) devices are vulnerable in manipulating a combination of IO pins to bypass the secure boot protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T15:52:53.000Z
CVE-2019-10638 
In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-05T22:07:13.000Z
CVE-2019-10639 
The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-05T22:07:27.000Z
CVE-2019-10640 
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-15T18:58:17.000Z
CVE-2019-10641 
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T18:46:39.000Z
CVE-2019-10642 
Contao 4.7 allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T18:54:30.000Z
CVE-2019-10643 
Contao 4.7 allows Use of a Key Past its Expiration Date.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T18:50:52.000Z
CVE-2019-10644 
An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T02:13:07.000Z
CVE-2019-10646 
Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T02:30:10.000Z
CVE-2019-10647 
ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T12:30:59.000Z
CVE-2019-10648 
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T12:53:57.000Z
CVE-2019-10649 
In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T13:13:48.000Z
CVE-2019-10650 
In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T13:14:06.000Z
CVE-2019-10651 
An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code execution. In other words, the issue affects 2017.3, 2018.1, and 2018.3 installations that lack the April 2019 update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T17:31:15.000Z
CVE-2019-10652 
An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T13:48:44.000Z
CVE-2019-10653 
An issue was discovered in Hsycms V1.1. There is a SQL injection vulnerability via a /news/*.html page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T13:59:19.000Z
CVE-2019-10654 
The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10, as used in Long Range Zip (aka lrzip) 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive, a different vulnerability than CVE-2017-8845.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T14:36:55.000Z
CVE-2019-10655 
Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication. This can be exploited remotely or via CSRF because the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:42:06.000Z
CVE-2019-10656 
Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply update_nds_webroot_from_tmp API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:42:23.000Z
CVE-2019-10657 
Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:42:42.000Z
CVE-2019-10658 
Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/controller.icc.update_nds_webroot_from_tmp update_nds_webroot_from_tmp API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:42:54.000Z
CVE-2019-10659 
Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:43:08.000Z
CVE-2019-10660 
Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:43:21.000Z
CVE-2019-10661 
On Grandstream GXV3611IR_HD before 1.0.3.23 devices, the root account lacks a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:43:32.000Z
CVE-2019-10662 
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:43:42.000Z
CVE-2019-10663 
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-30T16:43:52.000Z
CVE-2019-10664 
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-31T13:14:17.000Z
CVE-2019-10665 
An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T12:56:43.000Z