rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-15042 
An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T16:41:34.000Z
CVE-2019-15043 
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-03T11:47:35.000Z
CVE-2019-15045 
AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:26:18.000Z
CVE-2019-15046 
Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T14:51:40.000Z
CVE-2019-15047 
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBits at Core/Ap4Utils.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:12:19.000Z
CVE-2019-15048 
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4RtpAtom.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:12:02.000Z
CVE-2019-15049 
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4Dec3Atom.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:11:53.000Z
CVE-2019-15050 
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_AvccAtom class at Core/Ap4AvccAtom.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:11:43.000Z
CVE-2019-15051 
An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to command injection via a maliciously crafted form parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T19:12:31.000Z
CVE-2019-15052 
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T19:38:41.000Z
CVE-2019-15053 
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T16:05:33.000Z
CVE-2019-15054 
Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a privileged context via a crafted HTML mail message. This vulnerability is distinct from CVE-2015-4657.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T20:28:27.000Z
CVE-2019-15055 
MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T20:12:52.000Z
CVE-2019-15058 
stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T20:30:35.000Z
CVE-2019-15059 
In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX information including extension numbers, contacts, and passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-12T19:12:33.000Z
CVE-2019-15060 
The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an IP address input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:56:43.000Z
CVE-2019-15062 
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T22:54:51.000Z
CVE-2019-15064 HiNet GPON firmware version < I040GWR190731 allows a user login to device without any authentication
HiNet GPON firmware version < I040GWR190731 allows an attacker login to device without any authentication.
Problem types: description: Authentication bypass
Affected products: vendor: HiNET
product: GPON
Credits: lang: en
value: DEVCORE
Published: 2019-10-17T19:19:53.093Z
CVE-2019-15065 A vulnerability was discovered in HiNet GPON firmware < I040GWR190731 that allows an attacker to read arbitrary files
A service which is hosted on port 6998 in HiNet GPON firmware < I040GWR190731 allows an attacker to execute a specific command to read arbitrary files. CVSS 3.0 Base score 9.3. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L).
Problem types: description: read arbitrary files
Affected products: vendor: HiNET
product: GPON
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: DEVCORE
Published: 2019-10-17T19:23:13.111Z
CVE-2019-15066 A remote command execution vulnerability was discovered in HiNet GPON firmware < I040GWR190731 port 6998
An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 6998. CVSS 3.0 Base score 10.0. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Problem types: description: execute arbitrary command
Affected products: vendor: HiNET
product: GPON
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: DEVCORE
Published: 2019-10-17T19:22:14.824Z
CVE-2019-15067 An authentication bypass vulnerability discovered in Smart Battery A2-25DE
An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page.
Problem types: description: Authentication bypass
Affected products: vendor: Gigastone
product: Smart Battery A2-25DE
Credits: lang: en
value: Leon Chen, Y.D. Chen, Laura Tzou, Mars Cheng, Julian Chen
Published: 2019-09-25T18:10:15.597Z
CVE-2019-15068 A broken access control vulnerability discovered in Smart Battery A4
A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 allows an attacker to get/reset administrator’s password without any authentication.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Gigastone
product: Smart Battery A4
Credits: lang: en
value: Leon Chen, Y.D. Chen, Laura Tzou, Mars Cheng
Published: 2019-09-25T18:10:15.674Z
CVE-2019-15069 An unsafe authentication interface was discovered in Smart Battery A4
An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 . An attacker can bypass authentication without modifying device file and gain web page management privilege.
Problem types: description: unsafe authentication interface
Affected products: vendor: Gigastone
product: Smart Battery A4
Credits: lang: en
value: Leon Chen, Y.D. Chen, Laura Tzou, Mars Cheng
Published: 2019-09-25T18:10:15.721Z
CVE-2019-15071 Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Openfind
product: MAIL2000
Credits: lang: en
value: Tony Kuo (CHT Security), Vtim (CHT Security)
Published: 2019-11-20T04:06:20.948Z
CVE-2019-15072 Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Openfind
product: MAIL2000
Credits: lang: en
value: Tony Kuo (CHT Security), Vtim (CHT Security)
Published: 2019-11-20T04:16:18.705Z
CVE-2019-15073 Openfind MAIL2000 Webmail Pre-Auth Open Redirect
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Openfind
product: MAIL2000
Credits: lang: en
value: Tony Kuo (CHT Security), Vtim (CHT Security)
Published: 2019-11-20T04:16:09.274Z
CVE-2019-15074 
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:23:04.000Z
CVE-2019-15075 
An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T17:05:54.000Z
CVE-2019-15078 
An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The name of the constructor has a typo (wrong case: XBornID versus XBORNID) that allows an attacker to change the owner of the contract and obtain cryptocurrency for free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T19:53:56.000Z
CVE-2019-15079 
A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This vulnerability could be used by an attacker to acquire EAI tokens for free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T19:57:36.000Z
CVE-2019-15080 
An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract (which is inherited by MORPH Token) allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for free and can perform a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-30T19:59:25.000Z
CVE-2019-15081 
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T14:25:18.000Z
CVE-2019-15082 
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T13:29:04.000Z
CVE-2019-15083 
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-14T13:45:08.000Z
CVE-2019-15084 
Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. As a result, a local attacker can escalate to SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T23:23:56.000Z
CVE-2019-15085 
An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:41:12.000Z
CVE-2019-15086 
An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:41:46.000Z
CVE-2019-15087 
An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:42:17.000Z
CVE-2019-15088 
An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:42:40.000Z
CVE-2019-15089 
An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:43:08.000Z
CVE-2019-15090 
An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions, there is an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T23:47:47.000Z
CVE-2019-15091 
filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T12:10:46.000Z
CVE-2019-15092 
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T20:51:38.000Z
CVE-2019-15095 
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T00:28:29.000Z
CVE-2019-15098 
drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T01:15:39.000Z
CVE-2019-15099 
drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T01:15:29.000Z
CVE-2019-15102 
An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does not have any authentication mechanism. This allow an attacker to execute an arbitrary script on the remote Sahi Pro server. There is also a password-protected web interface intended for remote access to scripts. This web interface lacks server-side validation, which allows an attacker to create/modify/delete a script remotely without any password. Chaining both of these issues results in remote code execution on the Sahi Pro server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-06T16:15:02.000Z
CVE-2019-15104 
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T02:44:45.000Z
CVE-2019-15105 
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T02:44:35.000Z
CVE-2019-15106 
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T02:44:19.000Z
CVE-2019-15107 
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T02:44:04.000Z
CVE-2019-15108 
An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-upload feature of the event simulator component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T03:07:56.000Z
CVE-2019-15109 
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T11:50:47.000Z
CVE-2019-15110 
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:01:02.000Z
CVE-2019-15111 
The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:02:18.000Z
CVE-2019-15112 
The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:37:36.000Z
CVE-2019-15113 
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:20:26.000Z
CVE-2019-15114 
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:18:44.000Z
CVE-2019-15115 
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:13:36.000Z
CVE-2019-15116 
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:12:04.000Z
CVE-2019-15117 
parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T13:45:02.000Z
CVE-2019-15118 
check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T13:44:50.000Z
CVE-2019-15119 
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T14:02:31.000Z
CVE-2019-15120 
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T14:16:26.000Z
CVE-2019-15123 
The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-12T20:42:46.000Z
CVE-2019-15124 
In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-19T18:09:05.000Z
CVE-2019-15126 
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T16:17:37.000Z