rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-16642 
App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:32:50.000Z
CVE-2019-16643 
An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T15:06:32.000Z
CVE-2019-16644 
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T15:16:52.000Z
CVE-2019-16645 
An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T18:24:15.000Z
CVE-2019-16647 
Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-29T16:04:11.000Z
CVE-2019-16649 
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T01:54:55.000Z
CVE-2019-16650 
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T01:54:41.000Z
CVE-2019-16651 
An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebinding to leak the WAN IP address of a user (if they are using certain VPN implementations, this would decloak them).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-20T13:26:26.000Z
CVE-2019-16652 
The BPM component in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T12:56:11.000Z
CVE-2019-16653 
An application plugin in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to gain admin privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:02:10.000Z
CVE-2019-16655 
joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:02:45.000Z
CVE-2019-16656 
joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:02:35.000Z
CVE-2019-16657 
TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:02:24.000Z
CVE-2019-16658 
TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:02:13.000Z
CVE-2019-16659 
TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:02:05.000Z
CVE-2019-16660 
joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:01:56.000Z
CVE-2019-16661 
Ogma CMS 0.5 has XSS via creation of a new blog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:01:46.000Z
CVE-2019-16662 
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T11:52:13.000Z
CVE-2019-16663 
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T11:53:02.000Z
CVE-2019-16664 
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:45:11.000Z
CVE-2019-16665 
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T17:44:59.000Z
CVE-2019-16667 
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T18:38:48.000Z
CVE-2019-16669 
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T18:41:39.000Z
CVE-2019-16670 
An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. The Authentication mechanism has no brute-force prevention.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T17:05:02.000Z
CVE-2019-16671 
An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Remote authenticated users can crash a device with a special packet because of Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T17:06:23.000Z
CVE-2019-16672 
An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sensitive Credentials data is transmitted in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T17:07:21.000Z
CVE-2019-16673 
An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Passwords are stored in cleartext and can be read by anyone with access to the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T17:08:23.000Z
CVE-2019-16674 
An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T17:09:17.000Z
CVE-2019-16675 
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside. After manipulation, the attacker needs to exchange the original files with the manipulated ones on the application programming workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T21:22:59.000Z
CVE-2019-16676 
Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-30T11:43:11.000Z
CVE-2019-16677 
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T19:51:21.000Z
CVE-2019-16678 
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T19:51:06.000Z
CVE-2019-16679 
Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T20:00:35.000Z
CVE-2019-16680 
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T20:33:21.000Z
CVE-2019-16681 
The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitrary URLs, which can inject deceptive content into the UI. (When in physical possession of the device, opening local files is also possible.) NOTE: As of 2019-09-23, the vendor has not agreed that this issue has serious impact. The vendor states that the issue is not critical because it does not allow Elevation of Privilege, Sensitive Data Leakage, or any critical unauthorized activity from a malicious user. The vendor also states that a victim must first install a malicious APK to their application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-21T20:42:40.000Z
CVE-2019-16682 
The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-16T18:46:50.000Z
CVE-2019-16683 
An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-30T15:15:23.000Z
CVE-2019-16684 
An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit page, the payload executes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-30T15:28:03.000Z
CVE-2019-16685 
Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T19:05:11.000Z
CVE-2019-16686 
Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T19:09:00.000Z
CVE-2019-16687 
Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T19:11:34.000Z
CVE-2019-16688 
Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T19:14:27.000Z
CVE-2019-16692 
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-22T14:58:54.000Z
CVE-2019-16693 
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-22T14:58:45.000Z
CVE-2019-16694 
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-22T14:58:36.000Z
CVE-2019-16695 
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-22T14:58:23.000Z
CVE-2019-16696 
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-22T14:58:15.000Z
CVE-2019-16698 
The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-16T18:45:44.000Z
CVE-2019-16699 
The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-16T18:40:40.000Z
CVE-2019-16700 
The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-16T18:37:38.000Z
CVE-2019-16701 
pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-25T15:45:56.000Z
CVE-2019-16702 
Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T02:22:19.000Z
CVE-2019-16703 
admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T03:44:15.000Z
CVE-2019-16704 
admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T03:44:27.000Z
CVE-2019-16705 
Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T04:04:37.000Z
CVE-2019-16706 
kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:00:44.000Z
CVE-2019-16707 
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:46:29.000Z
CVE-2019-16708 
ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:46:19.000Z
CVE-2019-16709 
ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:46:10.000Z
CVE-2019-16710 
ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:46:01.000Z
CVE-2019-16711 
ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:45:51.000Z
CVE-2019-16712 
ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:45:42.000Z
CVE-2019-16713 
ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:45:30.000Z
CVE-2019-16714 
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T11:45:20.000Z
CVE-2019-16716 
OX App Suite through 7.10.2 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T19:43:40.000Z
CVE-2019-16717 
OX App Suite through 7.10.2 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T19:35:53.000Z
CVE-2019-16718 
In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T13:18:28.000Z
CVE-2019-16719 
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T13:35:57.000Z
CVE-2019-16720 
ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T13:35:17.000Z
CVE-2019-16721 
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T13:35:44.000Z
CVE-2019-16722 
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T13:35:32.000Z
CVE-2019-16723 
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T14:24:47.000Z
CVE-2019-16724 
File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer overflow in an HTTP POST parameter, a similar issue to CVE-2010-2330 and CVE-2010-2331.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-24T20:21:32.000Z
CVE-2019-16725 
In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-24T20:06:37.000Z
CVE-2019-16728 
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-24T04:02:09.000Z
CVE-2019-16729 
pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain PAM setups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-24T04:07:28.000Z
CVE-2019-16730 
processCommandUpgrade() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-13T20:36:18.000Z
CVE-2019-16731 
The udpServerSys service in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to initiate firmware upgrades and alter device settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-13T20:25:15.000Z
CVE-2019-16732 
Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-13T20:08:07.000Z
CVE-2019-16733 
processCommandSetUid() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-13T20:32:53.000Z
CVE-2019-16734 
Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-13T20:20:34.000Z