yahoo-inc/cve-impacts huggingface dataset:
CVE-2019-7077: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: use after free, arbitrary code execution
CVE-2019-7078: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: use after free, arbitrary code execution
CVE-2019-7079: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2019-7080: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a double free vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: double free, arbitrary code execution
CVE-2019-7081: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7082: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: use after free, arbitrary code execution
CVE-2019-7083: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: use after free, arbitrary code execution
CVE-2019-7084: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: use after free, arbitrary code execution
CVE-2019-7085: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: buffer errors, arbitrary code execution
CVE-2019-7086: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: type confusion, arbitrary code execution
CVE-2019-7087: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: type confusion, arbitrary code execution
CVE-2019-7088: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: use after free, arbitrary code execution
CVE-2019-7089: Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a data leakage (sensitive) vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: data leakage, information disclosure
CVE-2019-7090: Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7091: ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: deserialization of untrusted data, arbitrary code execution
CVE-2019-7092: ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: cross site scripting, information disclosure
CVE-2019-7093: Creative Cloud Desktop Application (installer) versions 4.7.0.400 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
Key phrases: insecure library loading, privilege escalation
CVE-2019-7094: Adobe Photoshop CC 19.1.7 and earlier, and 20.0.2 and earlier have a heap corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: heap corruption, arbitrary code execution
CVE-2019-7095: Adobe Digital Editions versions 4.5.10.185749 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: heap overflow, arbitrary code execution
CVE-2019-7096: Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: use after free, arbitrary code execution
CVE-2019-7097: Adobe Dreamweaver versions 19.0 and earlier have an insecure protocol implementation vulnerability. Successful exploitation could lead to sensitive data disclosure if smb request is subject to a relay attack.
Key phrases: insecure protocol implementation, sensitive data disclosure
CVE-2019-7098: Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: memory corruption, arbitrary code execution
CVE-2019-7099: Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: memory corruption, arbitrary code execution
CVE-2019-7100: Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: memory corruption, arbitrary code execution
CVE-2019-7101: Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: memory corruption, arbitrary code execution
CVE-2019-7102: Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: memory corruption, arbitrary code execution
CVE-2019-7103: Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: memory corruption, arbitrary code execution
CVE-2019-7104: Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: memory corruption, arbitrary code execution
CVE-2019-7105: Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: path traversal, arbitrary code execution
CVE-2019-7106: Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: path traversal, arbitrary code execution
CVE-2019-7107: Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing vulnerability. Successful exploitation could lead to arbitrary code execution. Fixed in versions 13.1.1 and 14.0.2.
Key phrases: unsafe hyperlink processing, arbitrary code execution
CVE-2019-7108: Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7109: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7110: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7111: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2019-7112: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: use after free, arbitrary code execution
CVE-2019-7113: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: heap overflow, arbitrary code execution
CVE-2019-7114: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7115: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7116: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7117: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: type confusion, arbitrary code execution
CVE-2019-7118: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2019-7119: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2019-7120: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2019-7121: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7122: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7123: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7124: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: out-of-bounds write, arbitrary code execution, out of bounds write
CVE-2019-7125: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: heap overflow, arbitrary code execution
CVE-2019-7127: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7128: Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
Key phrases: type confusion, arbitrary code execution
CVE-2019-7129: Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
Key phrases: stored cross-site scripting, sensitive information disclosure
CVE-2019-7130: Adobe Bridge CC versions 9.0.2 have a heap overflow vulnerability. Successful exploitation could lead to remote code execution.
Key phrases: heap overflow, remote code execution
CVE-2019-7131: Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier version, and 2015.006.30461 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
Key phrases: type confusion, arbitrary code execution
CVE-2019-7132: Adobe Bridge CC versions 9.0.2 have an out-of-bounds write vulnerability. Successful exploitation could lead to remote code execution.
Key phrases: out-of-bounds write, remote code execution, out of bounds write
CVE-2019-7133: Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7134: Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7135: Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7136: Adobe Bridge CC versions 9.0.2 have an use after free vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: use after free, information disclosure
CVE-2019-7137: Adobe Bridge CC versions 9.0.2 have a memory corruption vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: memory corruption, information disclosure
CVE-2019-7138: Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7139: An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Key phrases: allow arbitrary read access, the underlying database, sensitive data leakage
CVE-2019-7140: Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7141: Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7142: Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7143: Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7144: Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7145: Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Key phrases: out-of-bounds read, information disclosure, out of bounds read
CVE-2019-7146: In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as demonstrated by eu-readelf.
Key phrases: buffer over-read, denial-of-service, buffer over read, denial of service
CVE-2019-7147: A buffer over-read exists in the function crc64ib in crc64.c in nasmlib in Netwide Assembler (NASM) 2.14rc16. A crafted asm input can cause segmentation faults, leading to denial-of-service.
Key phrases: buffer over-read, segmentation faults, denial-of-service, buffer over read, denial of service
CVE-2019-7148: An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens."
Key phrases: memory allocation, denial-of-service, denial of service
CVE-2019-7149: A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.
Key phrases: heap-based buffer over-read, denial-of-service, buffer over read, segmentation fault, denial of service
CVE-2019-7150: An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.
Key phrases: denial-of-service, segmentation fault, crash, denial of service
CVE-2019-7151: A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
Key phrases: null pointer dereference, segmentation faults, denial-of-service, denial of service
CVE-2019-7152: A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
Key phrases: heap-based buffer over-read, segmentation faults, denial-of-service, buffer over read, denial of service
CVE-2019-7153: A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
Key phrases: null pointer dereference, segmentation faults, denial-of-service, denial of service
CVE-2019-7154: The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.
Key phrases: heap-based buffer overflow, denial-of-service, heap based buffer overflow, segmentation fault, denial of service
CVE-2019-7155: An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group, if their privileges within the project are different from the group.
CVE-2019-7156: In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero.
Key phrases: division by zero
CVE-2019-7158: OX App Suite 7.10.0 and earlier has Incorrect Access Control.
Key phrases: incorrect access control
CVE-2019-7159: OX App Suite 7.10.1 and earlier allows Information Exposure.
Key phrases: Information Exposure, information exposure
CVE-2019-7160: idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php.
Key phrases: files.admincp.php, directory traversal
CVE-2019-7161: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.
CVE-2019-7162: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.
Key phrases: retrieve internal information from the system and modify, exposed service, product installation
CVE-2019-7163: The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthenticated user to have access to the web interface without knowing the administrator's password.
Key phrases: bypass that allows an unauthenticated user to have access, authentication bypass, have access to the web interface without knowing
CVE-2019-7164: SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Key phrases: SQL Injection via the order_by parameter, sql injection
CVE-2019-7165: A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2019-7167: Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a consistency check, and consequently transform the proof of one statement into an ostensibly valid proof of a different statement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into accepting the correctness of a transaction.
Key phrases: bypass elements, bypass a consistency check, produced certain bypass, counterfeiting, availability
CVE-2019-7168: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.
Key phrases: execute HTML or JavaScript code in a vulnerable, stored-self xss
CVE-2019-7169: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3.
Key phrases: execute HTML or JavaScript code in a vulnerable, stored-self xss
CVE-2019-7170: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies.
Key phrases: execute HTML or JavaScript code in a vulnerable, stored-self xss
CVE-2019-7171: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8.
Key phrases: execute HTML or JavaScript code in a vulnerable, stored-self xss
CVE-2019-7172: A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users/admins/my_edit.php.
Key phrases: execute HTML or JavaScript code in a vulnerable, stored-self xss
CVE-2019-7173: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.
Key phrases: execute HTML or JavaScript code in a vulnerable, stored-self xss
CVE-2019-7174: Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.
Key phrases: execute renamefile.php (aka Rename File)
CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.
Key phrases: memory leaks
CVE-2019-7176: An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.
Key phrases: incorrect access control
CVE-2019-7177: Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin.
Key phrases: Code Injection onto nodes via an admin, code injection
CVE-2019-7178: Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup.
Key phrases: privilege escalation by restoring a system backup
CVE-2019-7181: Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program.
Key phrases: crash the program, buffer overflow
CVE-2019-7183: This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions.
Key phrases: access system files, link resolution
CVE-2019-7184: This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrators management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions.
Key phrases: inject and execute scripts on the administrators management, cross-site scripting (xss)
CVE-2019-7185: This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrators management console. To fix this vulnerability, QNAP recommend updating Music Station to their latest versions.
Key phrases: inject and execute scripts on the administrators management, cross-site scripting (xss)
CVE-2019-7192: This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
Key phrases: gain unauthorized access, gain unauthorized access to the system, improper access control
CVE-2019-7193: This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Key phrases: inject arbitrary code, inject arbitrary code to the system, improper input validation
CVE-2019-7194: This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Key phrases: access or modify system files, external control of file name or path
CVE-2019-7195: This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Key phrases: access or modify system files, external control of file name or path
CVE-2019-7197: A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.
Key phrases: inject and execute scripts on the administrator console, stored cross-site scripting (xss)
CVE-2019-7198: This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later
Key phrases: execute arbitrary commands, execute arbitrary commands in a compromised application, command injection
CVE-2019-7201: An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with elevated system privileges. QNAP have already fixed this issue in QNAP NetBak Replicator 4.5.12.1108.
Key phrases: execute arbitrary code, execute arbitrary code with elevated system privileges, unquoted service path
CVE-2019-7211: SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewing a malicious file attachment.
Key phrases: xss
CVE-2019-7212: SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users emails and file attachments. It was also possible to interact with mailing lists.
Key phrases: hardcoded secret keys
CVE-2019-7213: SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside the web directories.
Key phrases: delete arbitrary files, command execution on the server for instance by, directory traversal
CVE-2019-7214: SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.
Key phrases: deserialization of untrusted data, run commands
CVE-2019-7215: Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.
CVE-2019-7216: An issue was discovered in FileChucker 4.99e-free-e02. filechucker.cgi has a filter bypass that allows a malicious user to upload any type of file by using % characters within the extension, e.g., file.%ph%p becomes file.php.
Key phrases: bypass that allows a malicious user to upload, filter bypass, upload any type of file by using %
CVE-2019-7217: Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required.
Key phrases: enumerate application username based on different server responses, user enumeration
CVE-2019-7218: Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app (like google authenticator) is able to bypass the first authentication phase (username/password mechanism) and log-in using username/otp combination only (phase 2 of 2FA).
Key phrases: bypass the first authentication, one-factor authentication, bypass authentication
CVE-2019-7219: Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead.
Key phrases: unauthenticated reflected cross-site scripting (xss)
CVE-2019-7220: X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.
Key phrases: xss
CVE-2019-7221: The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
Key phrases: use-after-free
CVE-2019-7222: The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.
Key phrases: information leak
CVE-2019-7223: InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/## URI. NOTE: this is different from CVE-2018-12255.
Key phrases: xss
CVE-2019-7225: The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are the idal123 password for the IdalMaster account, and the exor password for the exor account. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI components.
Key phrases: flash a new interface and Tags (MODBUS, undocumented credentials
CVE-2019-7226: The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. Specifically, /cgi/loginDefaultUser creates a session in an authenticated state and returns the session ID along with what may be the username and cleartext password of the user. An attacker can then supply an IDALToken value in a cookie, which will allow them to perform privileged operations such as restarting the service with /cgi/restart. A GET request to /cgi/loginDefaultUser may result in "1 #S_OK IDALToken=532c8632b86694f0232a68a0897a145c admin admin" or a similar response.
Key phrases: bypass authentication, gain access, bypass authentication and gain access to privileged functions, perform privileged operations such as restarting the service, cleartext password
CVE-2019-7227: In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the FTP server functionality to download and upload files. An unauthenticated attacker can take advantage of the hardcoded or default credential pair exor/exor to become an authenticated attacker.
Key phrases: default credential pair exor exor, hardcoded, default credentials,
CVE-2019-7228: The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s%25p%25x%25n will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the stack.
Key phrases: crash
CVE-2019-7229: The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of encryption or authenticity checks against the new firmware HMI software binary files.
CVE-2019-7230: The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the username %s%p%x%d will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the stack.
Key phrases: crash
CVE-2019-7231: The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled, but terminates the process. An authenticated attacker can send a FTP command string of 472 bytes or more to overflow a buffer, causing an exception that terminates the server.
Key phrases: buffer overflow
CVE-2019-7232: The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.
Key phrases: buffer overflow, buffer overwrite
CVE-2019-7233: In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference.
Key phrases: null pointer dereference
CVE-2019-7234: An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloaded via an admincp.php?app=apps&do=pack request.
Key phrases: begin the process of creating a ZIP archive, directory traversal
CVE-2019-7235: An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request.
Key phrases: designate an arbitrary directory because of an apps.admincp.php, directory traversal
CVE-2019-7236: An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal.
Key phrases: admincp.php?app=editor&do=fileManager dir=../ Directory Traversal, directory traversal
CVE-2019-7237: An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=browse ..\\\\ Directory Traversal.
Key phrases: admincp.php?app=files&do=browse ..\\\\ Directory Traversal, directory traversal
CVE-2019-7238: Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
Key phrases: incorrect access control
CVE-2019-7240: An issue was discovered in WinRing0x64.sys in Moo0 System Monitor 1.83. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x9C402088 and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
Key phrases: Allowing arbitrary MSR, Ring-0 code execution and escalation of privileges, escalation privilege
CVE-2019-7244: An issue was discovered in kerneld.sys in AIDA64 before 5.99. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x80112084 and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
Key phrases: Allowing arbitrary MSR, Ring-0 code execution and escalation of privileges, escalation privilege
CVE-2019-7245: An issue was discovered in GPU-Z.sys in TechPowerUp GPU-Z before 2.23.0. The vulnerable driver exposes a wrmsr instruction via an IOCTL and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
Key phrases: Allowing arbitrary MSR, Ring-0 code execution and escalation of privileges, escalation privilege
CVE-2019-7246: An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. The vulnerable driver exposes a wrmsr instruction and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
Key phrases: Allowing arbitrary MSR, Ring-0 code execution and escalation of privileges, escalation privilege
CVE-2019-7247: An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
Key phrases: Allowing arbitrary MSR, Ring-0 code execution and escalation of privileges, escalation privilege
CVE-2019-7249: In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system (who didn't have root access) to tamper with another's installs.
Key phrases: tamper with another's installs, time-to-check-time-to-use bugs, root access
CVE-2019-7250: An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code (via SCRIPT elements, event handlers, etc.). Since this code is stored by the plugin, the attacker may be able to target anyone who opens the configuration panel of the plugin.
Key phrases: inject arbitrary JavaScript code, use both label text and references text to, stored xss
CVE-2019-7251: An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.
Key phrases: crash Asterisk via a specially crafted SDP protocol, integer signedness issue, sdp protocol violation
CVE-2019-7252: Linear eMerge E3-Series devices have Default Credentials.
Key phrases: default credentials
CVE-2019-7253: Linear eMerge E3-Series devices allow Directory Traversal.
Key phrases: Directory Traversal, directory traversal
CVE-2019-7254: Linear eMerge E3-Series devices allow File Inclusion.
Key phrases: File Inclusion, file inclusion
CVE-2019-7255: Linear eMerge E3-Series devices allow XSS.
Key phrases: XSS, xss
CVE-2019-7256: Linear eMerge E3-Series devices allow Command Injections.
Key phrases: Command Injections, command injections
CVE-2019-7257: Linear eMerge E3-Series devices allow Unrestricted File Upload.
Key phrases: Unrestricted File Upload, unrestricted file upload
CVE-2019-7258: Linear eMerge E3-Series devices allow Privilege Escalation.
Key phrases: Privilege Escalation, privilege escalation
CVE-2019-7259: Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.
Key phrases: Bypass with Information Disclosure, Authorization Bypass, Authorization Bypass with Information Disclosure, authorization bypass, information disclosure
CVE-2019-7260: Linear eMerge E3-Series devices have Cleartext Credentials in a Database.
Key phrases: cleartext credentials
CVE-2019-7261: Linear eMerge E3-Series devices have Hard-coded Credentials.
Key phrases: hard-coded credentials, hard coded credentials
CVE-2019-7262: Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
Key phrases: Cross-Site Request Forgery (CSRF), cross-site request forgery (csrf)
CVE-2019-7263: Linear eMerge E3-Series devices have a Version Control Failure.
Key phrases: version control failure
CVE-2019-7264: Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.
Key phrases: a Stack-based Buffer Overflow on the, stack-based buffer overflow
CVE-2019-7265: Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).
Key phrases: Remote Code Execution (root access over SSH, remote code execution
CVE-2019-7266: Linear eMerge 50P/5000P devices allow Authentication Bypass.
Key phrases: Authentication Bypass, authentication bypass
CVE-2019-7267: Linear eMerge 50P/5000P devices allow Cookie Path Traversal.
Key phrases: Cookie Path Traversal, cookie path traversal