rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-7434 
PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:48:06.000Z
CVE-2019-7435 
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:51:32.000Z
CVE-2019-7436 
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:53:45.000Z
CVE-2019-7437 
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T19:56:30.000Z
CVE-2019-7438 
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T20:03:19.000Z
CVE-2019-7439 
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T20:05:20.000Z
CVE-2019-7440 
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T20:07:57.000Z
CVE-2019-7441 
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T20:10:37.000Z
CVE-2019-7442 
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-08T20:54:48.000Z
CVE-2019-7443 
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T18:41:37.000Z
CVE-2019-7474 
A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloading certificate with specific extension. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
Problem types: cwe_id: CWE-248
description: CWE-248: Uncaught Exception
Affected products: vendor: SonicWall
product: SonicOS
vendor: SonicWall
product: SonicOSv
Published: 2019-04-02T17:20:39.000Z
CVE-2019-7475 
A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access advanced routing services. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: SonicWall
product: SonicOS
vendor: SonicWall
product: SonicOSv
Published: 2019-04-02T17:20:39.000Z
CVE-2019-7476 
A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. This vulnerability affects GMS versions 9.1, 9.0, 8.7, 8.6, 8.4, 8.3 and earlier.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: SonicWall
product: Global Management System (GMS)
Published: 2019-04-26T20:25:46.000Z
CVE-2019-7477 
A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: SonicWall
product: SonicOS
vendor: SonicWall
product: SonicOSv
Published: 2019-04-02T17:20:39.000Z
CVE-2019-7478 
A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS versions GMS 8.4, 8.5, 8.6, 8.7, 9.0 and 9.1.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SonicWall
product: GMS
Published: 2019-12-30T23:50:10.000Z
CVE-2019-7479 
A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version 5.9.1.12-4o and earlier, Gen 6 version 6.2.7.4-32n, 6.5.1.4-4n, 6.5.2.3-4n, 6.5.3.3-3n, 6.2.7.10-3n, 6.4.1.0-3n, 6.5.3.3-3n, 6.5.1.9-4n and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: SonicWall
product: SonicOS
vendor: SonicWall
product: SonicOSv
Published: 2019-12-31T01:30:14.000Z
CVE-2019-7481 
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SonicWall
product: SMA100
Published: 2019-12-17T22:25:16.000Z
CVE-2019-7482 
Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: SonicWall
product: SMA100
Published: 2019-12-19T00:35:43.000Z
CVE-2019-7483 
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: SonicWall
product: SMA100
Published: 2019-12-19T00:35:43.000Z
CVE-2019-7484 
Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SonicWall
product: SMA100
Published: 2019-12-19T00:35:44.000Z
CVE-2019-7485 
Buffer overflow in SonicWall SMA100 allows an authenticated user to execute arbitrary code in DEARegister CGI script. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: SonicWall
product: SMA100
Published: 2019-12-19T00:35:44.000Z
CVE-2019-7486 
Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impacted SMA100 version 9.0.0.4 and earlier.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: SonicWall
product: SMA100
Published: 2019-12-19T00:35:44.000Z
CVE-2019-7487 
Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow code execution.
Problem types: cwe_id: CWE-428
description: CWE-428: Unquoted Search Path or Element
Affected products: vendor: SonicWall
product: SonicOS
Published: 2019-12-19T00:35:45.000Z
CVE-2019-7488 
Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database. This vulnerability affected Email Security Appliance version 10.0.2 and earlier.
Problem types: cwe_id: CWE-255
description: CWE-255: Credentials Management
Affected products: vendor: SonicWall
product: Email Security Appliance
Published: 2019-12-23T21:50:12.000Z
CVE-2019-7489 
A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. This vulnerability affected Email Security Appliance version 10.0.2 and earlier.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: SonicWall
product: Email Security Appliance
Published: 2019-12-23T21:50:12.000Z
CVE-2019-7524 
In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-28T13:45:20.000Z
CVE-2019-7535 
index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as the backend technology.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T15:00:00.000Z
CVE-2019-7537 
An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, resulting in command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T19:55:42.000Z
CVE-2019-7539 
A code injection issue was discovered in ipycache through 2016-05-31.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T20:53:57.000Z
CVE-2019-7541 
Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T18:50:54.000Z
CVE-2019-7543 
In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T21:00:00.000Z
CVE-2019-7544 
An issue was discovered in MyWebSQL 3.7. The Add User function of the User Manager pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name Field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T21:00:00.000Z
CVE-2019-7545 
In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T21:00:00.000Z
CVE-2019-7546 
An issue was discovered in SIDU 6.0. The dbs parameter of the conn.php page has a reflected Cross-site Scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T21:00:00.000Z
CVE-2019-7547 
An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name containing an XSS Payload, leading to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T21:00:00.000Z
CVE-2019-7548 
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T21:00:00.000Z
CVE-2019-7549 
An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.7.3. It has Incorrect Access Control. The GitLab pipelines feature is vulnerable to authorization issues that allow unauthorized users to view job information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T15:42:42.000Z
CVE-2019-7550 
In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T20:00:00.000Z
CVE-2019-7551 
Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would enable performing actions as users, including administrative users. This could enable account creation and deletion as well as deletion of information contained within the app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-10T16:31:36.000Z
CVE-2019-7552 
An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. Stored XSS was found in the the My Profile Section. This is due to lack of sanitization in the Edit Name section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T15:36:18.000Z
CVE-2019-7553 
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T00:00:00.000Z
CVE-2019-7554 
An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-results.php d2 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T15:27:53.000Z
CVE-2019-7559 
In btor2parser/btor2parser.c in Boolector Btor2Tools before 2019-01-15, opening a specially crafted input file leads to an out of bounds write in pusht_bfr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T07:00:00.000Z
CVE-2019-7560 
In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get_failed_assumptions or btor_delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T07:00:00.000Z
CVE-2019-7564 
An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type of authentication. By making a POST request to the regx/wireless/wl_security_2G.asp URI, the attacker can change the password of the Wi-FI network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T18:52:43.000Z
CVE-2019-7566 
CSZ CMS 1.1.8 has CSRF via admin/users/new/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T07:00:00.000Z
CVE-2019-7567 
An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T07:00:00.000Z
CVE-2019-7568 
An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T07:00:00.000Z
CVE-2019-7569 
An issue was discovered in DOYO (aka doyocms) 2.3(20140425 update). There is a CSRF vulnerability that can add a super administrator account via admin.php?c=a_adminuser&a=add&run=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T07:00:00.000Z
CVE-2019-7570 
A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T07:00:00.000Z
CVE-2019-7572 
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T00:00:00.000Z
CVE-2019-7573 
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T00:00:00.000Z
CVE-2019-7574 
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T00:00:00.000Z
CVE-2019-7575 
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T00:00:00.000Z
CVE-2019-7576 
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T00:00:00.000Z
CVE-2019-7577 
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T00:00:00.000Z
CVE-2019-7578 
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T00:00:00.000Z
CVE-2019-7579 
An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dynamic/js/setup.js.localized file on the router's webserver, allowing for an attacker to identify possible passwords that the system uses to set the default guest network password. An attacker can use this list of 30 words along with a random 2 digit number to brute force their access onto a router's guest network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T18:26:48.000Z
CVE-2019-7580 
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T17:00:00.000Z
CVE-2019-7581 
The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure, a different vulnerability than CVE-2018-7876.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T18:00:00.000Z
CVE-2019-7582 
The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T18:00:00.000Z
CVE-2019-7585 
An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T18:00:00.000Z
CVE-2019-7587 
Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-07T19:00:00.000Z
CVE-2019-7588 exacqVision Enterprise System Manager (ESM) privilege escalation
A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows operating system. This issue does not impact any Windows Server OSs, or Linux deployments with permissions that are not inherited from the root directory. Authorized Users have ‘modify’ permission to the ESM folders, which allows a low privilege account to modify files located in these directories. An executable can be renamed and replaced by a malicious file that could connect back to a bad actor providing system level privileges. A low privileged user is not able to restart the service, but a restart of the system would trigger the execution of the malicious file. This issue affects: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) Version 5.12.2 and prior versions; This issue does not affect: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) 19.03 and above.
Problem types: description: The exacqVision Enterprise System Manager (ESM) privilege escalation vulnerability is possible due to insecure file permission in the Windows operating system.
Affected products: vendor: Exacq Technologies, Inc.
product: exacqVision Enterprise System Manager (ESM)
Credits: lang: en
value: @bzyo_
Published: 2019-06-18T13:23:05.440Z