yahoo-inc/cve-impacts huggingface dataset:
CVE-2019-17189: totemodata 3.0.0_b936 has XSS via a folder name.
Key phrases: xss
CVE-2019-1719: A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco ISE software version 2.1 is affected.
Key phrases: execute arbitrary script code, conduct a cross-site scripting (XSS, execute arbitrary script code in the context of, cross-site scripting (xss)
CVE-2019-17190: A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\\\\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the elevated process cleans the ACL of the Update.ini file in %PROGRAMDATA%\\\\Avast Software\\\\Browser\\\\Update\\\\ and sets all privileges to group Everyone. Because any low-privileged user can create, delete, or modify the Update.ini file stored in this location, an attacker with low privileges can create a hard link named Update.ini in this folder, and make it point to a file writable by NT AUTHORITY\\\\SYSTEM. Once AvastBrowserUpdate.exe is triggered by the update check functionality, the DACL is set to a misconfigured value on the crafted Update.ini and, consequently, to the target file that was previously not writable by the low-privileged attacker.
Key phrases: local privilege escalation issue
CVE-2019-17191: The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block eavesdropping.
Key phrases: force a call to be answered, audio channel, eavesdropping
CVE-2019-17192: The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs
Key phrases: denial of service, unspecified other impact, malformed packets, unspecified impact
CVE-2019-17195: Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Key phrases: authentication bypass, application crash, information disclosure
CVE-2019-17197: OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc.
Key phrases: sql injection
CVE-2019-17199: www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.jpg\\\\.. substring.
Key phrases: reading arbitrary files, Directory Traversal (for reading arbitrary files), directory traversal
CVE-2019-1720: A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a specifically crafted XML payload. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition until the system is manually rebooted. Software versions prior to X12.5.1 are affected.
Key phrases: denial of service (DoS), cause the CPU to increase to 100%, exhaust CPU resources, reboot
CVE-2019-17201: FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service (Audckq32.exe) using a .NET named pipe. If the underlying service responds that a user is permitted access to the elevation feature, the client then reinitiates communication with the underlying service and requests elevation. This elevation request has no local checks in the service, and depends on client-side validation in the AdminByRequest.exe interface, i.e., it is a vulnerable exposed functionality in the service. By communicating directly with the underlying service, any user can request elevation and obtain Administrator privilege regardless of group policies or permissions.
Key phrases: obtain Administrator privilege, elevate to Administrator privilege at will, vulnerable exposed functionality
CVE-2019-17202: FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a challenge-response manner upon attempting to elevate privileges. The challenge's response uses a simple algorithm that can be easily emulated via data (customer ID and device name) available to all users, and thus any user can elevate to Administrator privilege.
Key phrases: elevate to Administrator privilege at will, elevate privileges
CVE-2019-17203: TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
Key phrases: Stored XSS at the Search page by setting, stored xss
CVE-2019-17204: TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
Key phrases: Stored XSS by setting a crafted Knowledge Base, stored xss
CVE-2019-17205: TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
Key phrases: Stored XSS by placing a payload in the, stored xss
CVE-2019-17206: Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts.
Key phrases: execute arbitrary scripts, uncontrolled deserialization
CVE-2019-17207: A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
Key phrases: inject client-side JavaScript into an admin, xss
CVE-2019-1721: A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later.
Key phrases: denial of service (DoS), cause the CPU to increase to 100%, exhaust CPU resources, denial of service (dos) condition
CVE-2019-17210: A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the function MQTTDeserialize_publish() to get the length and content of the MQTT topic name. In the function readMQTTLenString(), mqttstring->lenstring.len is a part of user input, which can be manipulated. An attacker can simply change it to a larger value to invalidate the if statement so that the statements inside the if statement are skipped, letting the value of mqttstring->lenstring.data default to zero. Later, curn is accessed, which points to mqttstring->lenstring.data. On an Arm Cortex-M chip, the value at address 0x0 is actually the initialization value for the MSP register. It is highly dependent on the actual firmware. Therefore, the behavior of the program is unpredictable from this time on.
Key phrases: denial-of-service issue, denial of service
CVE-2019-17211: An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sn_coap_builder_calc_needed_packet_data_size_2() is used to calculate the required memory for the CoAP message from the sn_coap_hdr_s data structure. Both returned_byte_count and src_coap_msg_ptr->payload_len are of type uint16_t. When added together, the result returned_byte_count can wrap around the maximum uint16_t value. As a result, insufficient buffer space is allocated for the corresponding CoAP message.
Key phrases: integer overflow
CVE-2019-17212: Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced. More specifically, inside a loop, *packet_data_pptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated.
Key phrases: buffer overflows
CVE-2019-17213: The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
Key phrases: xss
CVE-2019-17214: The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI.
Key phrases: bypass by appending &cc=1 to a URI, firewall bypass
CVE-2019-17215: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no bruteforce protection (e.g., lockout) established. An attacker might be able to bruteforce the password to authenticate on the device.
Key phrases: bruteforce protection
CVE-2019-17216: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with minimal effort.
Key phrases: cracking
CVE-2019-17217: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service.
Key phrases: csrf protection
CVE-2019-17218: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff communication to the web service.
Key phrases: unencrypted
CVE-2019-17219: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the device does not enforce any authentication. An adjacent attacker is able to use the network interface without proper access control.
CVE-2019-1722: A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. The arbitrary actions include adding an attacker-controlled device and redirecting calls intended for a specific user. For more information about CSRF attacks and potential mitigations, see Understanding Cross-Site Request Forgery Threat Vectors. This vulnerability is fixed in software version X12.5.1 and later.
Key phrases: perform arbitrary actions, conduct a cross-site request forgery (, perform arbitrary actions on an affected system with, findme feature, cross-site request forgery (csrf), cross-site request forgery threat vectors, cross site request forgery
CVE-2019-17220: Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
Key phrases: XSS via a URL on a ![, xss
CVE-2019-17221: PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed.
Key phrases: reading arbitrary files, reading arbitrary files on the filesystem, arbitrary file read
CVE-2019-17222: An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen, leading to a denial of service (inability to change the configuration).
Key phrases: denial of service (inability to change the configuration), xss
CVE-2019-17223: There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.
Key phrases: html injection
CVE-2019-17224: The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of the web root directory. If a file exists but is not part of the product, there is a 404 error. If a file does not exist, there is a 302 redirect to index.html.
Key phrases: path traversal
CVE-2019-17225: Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
Key phrases: XSS via the panel/members/ Username, xss, admin member json update
CVE-2019-17226: CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
Key phrases: XSS via the Site Admin > Module Manager, xss
CVE-2019-17228: includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
Key phrases: unauthenticated options changes
CVE-2019-17229: includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
Key phrases: xss issues
CVE-2019-1723: A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. The vulnerability exists because the affected software has a user account with a default, static password. An attacker could exploit this vulnerability by remotely connecting to the affected system using this account. A successful exploit could allow the attacker to log in to the CSPC using the default account. For Cisco CSPC 2.7.x, Cisco fixed this vulnerability in Release 2.7.4.6. For Cisco CSPC 2.8.x, Cisco fixed this vulnerability in Release 2.8.1.2.
Key phrases: access an affected device by using an account, log in to the CSPC using the default
CVE-2019-17230: includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
Key phrases: unauthenticated options changes
CVE-2019-17231: includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
Key phrases: xss issues
CVE-2019-17232: Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
Key phrases: unauthenticated options import
CVE-2019-17233: Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
Key phrases: HTML content injection, html content injection
CVE-2019-17234: includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
Key phrases: unauthenticated arbitrary file deletion
CVE-2019-17235: includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.
Key phrases: information disclosure
CVE-2019-17236: includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.
Key phrases: stored xss
CVE-2019-17237: includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.
Key phrases: CSRF, csrf
CVE-2019-17239: includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
Key phrases: unauthenticated stored xss issues
CVE-2019-1724: A vulnerability in the session management functionality of the web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. An attacker could use this impersonated session to create a new user account or otherwise control the device with the privileges of the hijacked session. The vulnerability is due to a lack of proper session management controls. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted device. A successful exploit could allow the attacker to take control of an existing user session on the device. Exploitation of the vulnerability requires that an authorized user session is active and that the attacker can craft an HTTP request to impersonate that session.
Key phrases: hijack a valid user session on an affected, take control of an existing user session on, impersonate
CVE-2019-17240: bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.
Key phrases: bypass a brute-force protection, bypass a brute-force protection mechanism by
CVE-2019-17241: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d563.
Key phrases: a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d563, user mode write av
CVE-2019-17242: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000966f.
Key phrases: a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000966f, user mode write av
CVE-2019-17243: IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000003155.
Key phrases: control Code Flow starting at JPEG_LS+0x0000000000003155, faulting address
CVE-2019-17244: IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000001d8a.
Key phrases: control Code Flow starting at JPEG_LS+0x0000000000001d8a, faulting address
CVE-2019-17245: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x0000000000004359.
Key phrases: a User Mode Write AV starting at WSQ!ReadWSQ+0x0000000000004359, user mode write av
CVE-2019-17246: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000258c.
Key phrases: a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000258c, user mode write av
CVE-2019-17247: IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x0000000000007da8.
Key phrases: control a subsequent Write Address starting at JPEG_LS+0x0000000000007da8, faulting address
CVE-2019-17248: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000025b6.
Key phrases: a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000025b6, user mode write av
CVE-2019-17249: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d57b.
Key phrases: a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d57b, user mode write av
CVE-2019-1725: A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated, local attacker to overwrite an arbitrary file on disk. It is also possible the attacker could inject CLI command parameters that should not be allowed for a specific subset of local management CLI commands. The vulnerability is due to lack of proper input validation of user input for local management CLI commands. An attacker could exploit this vulnerability by authenticating to the device and issuing a crafted form of a limited subset of local management CLI commands. An exploit could allow the attacker to overwrite an arbitrary files on disk or inject CLI command parameters that should have been disabled. This vulnerability is fixed in software version 4.0(2a) and later.
Key phrases: overwrite an arbitrary file on disk, overwrite an arbitrary files on disk or inject, overwrite arbitrary files
CVE-2019-17250: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000042f5.
Key phrases: a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000042f5, user mode write av
CVE-2019-17251: IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d43.
Key phrases: a User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d43, user mode write av
CVE-2019-17252: IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!Read_BadPNG+0x0000000000000115.
Key phrases: a User Mode Write AV starting at FORMATS!Read_BadPNG+0x0000000000000115, user mode write av
CVE-2019-17253: IrfanView 4.53 allows a User Mode Write AV starting at JPEG_LS+0x000000000000a6b8.
Key phrases: a User Mode Write AV starting at JPEG_LS+0x000000000000a6b8, user mode write av
CVE-2019-17254: IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at FORMATS!Read_BadPNG+0x0000000000000101.
Key phrases: control a subsequent Write Address starting at FORMATS!Read_BadPNG+0x0000000000000101, faulting address
CVE-2019-17255: IrfanView 4.53 allows a User Mode Write AV starting at EXR!ReadEXR+0x0000000000010836.
Key phrases: a User Mode Write AV starting at EXR!ReadEXR+0x0000000000010836, user mode write av
CVE-2019-17256: IrfanView 4.53 allows a User Mode Write AV starting at DPX!ReadDPX_W+0x0000000000001203.
Key phrases: a User Mode Write AV starting at DPX!ReadDPX_W+0x0000000000001203, user mode write av
CVE-2019-17257: IrfanView 4.53 allows a Exception Handler Chain to be Corrupted starting at EXR!ReadEXR+0x000000000002af80.
Key phrases: be Corrupted starting at EXR!ReadEXR+0x000000000002af80, exception handler chain
CVE-2019-17258: IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x000000000000839c.
Key phrases: control a subsequent Write Address starting at JPEG_LS+0x000000000000839c, faulting address
CVE-2019-17259: KMPlayer 4.2.2.31 allows a User Mode Write AV starting at utils!src_new+0x000000000014d6ee.
Key phrases: a User Mode Write AV starting at utils!src_new+0x000000000014d6ee, user mode write av
CVE-2019-1726: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an affected device, such as the NX-API. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument to the affected command. A successful exploit could allow the attacker to bypass intended restrictions and access internal services of the device. An attacker would need valid device credentials to exploit this vulnerability.
Key phrases: bypass intended restrictions, access internal services that should be restricted on, bypass intended restrictions and access internal services of
CVE-2019-17260: MPC-HC through 1.7.13 allows a Read Access Violation on a Block Data Move starting at mpc_hc!memcpy+0x000000000000004e.
Key phrases: a Read Access Violation on a Block Data, read access violation
CVE-2019-17261: XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001e51.
Key phrases: a User Mode Write AV starting at Xwsq+0x0000000000001e51, user mode write av
CVE-2019-17262: XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001fc0.
Key phrases: a User Mode Write AV starting at Xwsq+0x0000000000001fc0, user mode write av
CVE-2019-17263: In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue
Key phrases: heap-based buffer over-read, buffer over read
CVE-2019-17264: In libyal liblnk before 20191006, liblnk_location_information_read_data in liblnk_location_information.c has a heap-based buffer over-read because an incorrect variable name is used for a certain offset. NOTE: the vendor has disputed this as described in the GitHub issue
Key phrases: heap-based buffer over-read, buffer over read
CVE-2019-17266: libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2019-17267: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Key phrases: polymorphic typing issue
CVE-2019-17268: The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.
Key phrases: code-execution backdoor, code execution
CVE-2019-17269: Intellian Remote Access 3.18 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via shell metacharacters in, arbitrary os command
CVE-2019-1727: A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary commands to elevate the attacker's privilege level. To exploit this vulnerability, the attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges. These requirements could limit the possibility of a successful exploit.
Key phrases: issue arbitrary commands, escape the Python parser and issue arbitrary commands, successful exploit, execute arbitrary
CVE-2019-17270: Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
CVE-2019-17271: vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
Key phrases: SQL Injection via the ajax/api/, sql injection
CVE-2019-17272: All versions of ONTAP Select Deploy administration utility are susceptible to a vulnerability which when successfully exploited could allow an administrative user to escalate their privileges.
Key phrases: escalate their privileges, escalate privilege
CVE-2019-17273: E-Series SANtricity OS Controller Software version 11.60.0 is susceptible to a vulnerability which allows an attacker to cause a Denial of Service (DoS) in IPv6 environments.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2019-17274: NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
Key phrases: unauthorized arbitrary command execution via local access, default account, arbitrary commands
CVE-2019-17275: OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
Key phrases: arbitrary code execution
CVE-2019-17276: OnCommand System Manager versions 9.3 prior to 9.3P18 and 9.4 prior to 9.4P2 are susceptible to a cross site scripting vulnerability that could allow an authenticated attacker to inject arbitrary scripts into the SNMP Community Names label field.
Key phrases: inject arbitrary scripts, inject arbitrary scripts into the SNMP Community Names, cross site scripting, cross-site scripting
CVE-2019-1728: A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to run arbitrary commands at system boot time with the privileges of root. The vulnerability is due to a lack of proper validation of system files when the persistent configuration information is read from the file system. An attacker could exploit this vulnerability by authenticating to the device and overwriting the persistent configuration storage with malicious executable files. An exploit could allow the attacker to run arbitrary commands at system startup and those commands will run as the root user. The attacker must have valid administrative credentials for the device.
Key phrases: run arbitrary commands, run arbitrary commands at system boot time with, run arbitrary commands at system startup and those, secure configuration validation functionality
CVE-2019-1729: A vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software could allow an authenticated, local attacker to overwrite any file on the file system including system files. These file overwrites by the attacker are accomplished at the root privilege level. The vulnerability occurs because there is no verification of user-input parameters and or digital-signature verification for image files when using a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device and issuing a command at the CLI. Because an exploit could allow the attacker to overwrite any file on the disk, including system files, a denial of service (DoS) condition could occur. The attacker must have valid administrator credentials for the affected device to exploit this vulnerability.
Key phrases: denial of service (DoS), overwrite any file on the file system including, overwrite any file on the disk, root privilege
CVE-2019-17292: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user.
Key phrases: SQL injection in the pmse_Inbox module by an, sql injection
CVE-2019-17293: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user.
Key phrases: SQL injection in the pmse_Project module by a, sql injection
CVE-2019-17294: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user.
Key phrases: SQL injection in the export function by a, sql injection
CVE-2019-17295: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user.
Key phrases: SQL injection in the history function by a, sql injection
CVE-2019-17296: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user.
Key phrases: SQL injection in the Contacts module by a, sql injection
CVE-2019-17297: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user.
Key phrases: SQL injection in the Quotes module by a, sql injection
CVE-2019-17298: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user.
Key phrases: SQL injection in the Administration module by a, sql injection
CVE-2019-17299: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.
Key phrases: PHP code injection in the Administration module by, php code injection
CVE-2019-1730: A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the restricted Guest Shell and execute commands at the privilege level of a network-admin user outside of the Guest Shell. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to the incorrect implementation of a CLI command that allows a Bash command to be incorrectly invoked on the Guest Shell CLI. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Guest Shell prompt. A successful exploit could allow the attacker to issue commands that should be restricted by a Guest Shell account.
Key phrases: bypass the limited command set of the restricted Guest Shell, be incorrectly invoked on the Guest Shell CLI, issue commands that should be restricted by a, execute commands
CVE-2019-17300: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user.
Key phrases: PHP code injection in the Administration module by, php code injection
CVE-2019-17301: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user.
Key phrases: PHP code injection in the ModuleBuilder module by, php code injection
CVE-2019-17302: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.
Key phrases: PHP code injection in the ModuleBuilder module by, php code injection
CVE-2019-17303: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.
Key phrases: PHP code injection in the MergeRecords module by, php code injection
CVE-2019-17304: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.
Key phrases: PHP code injection in the MergeRecords module by, php code injection
CVE-2019-17305: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.
Key phrases: PHP code injection in the MergeRecords module by, php code injection
CVE-2019-17306: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.
Key phrases: PHP code injection in the Configurator module by, php code injection
CVE-2019-17307: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.
Key phrases: PHP code injection in the Tracker module by, php code injection
CVE-2019-17308: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.
Key phrases: PHP code injection in the Emails module by, php code injection
CVE-2019-17309: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.
Key phrases: PHP code injection in the EmailMan module by, php code injection
CVE-2019-1731: A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user's private SSH key to all authenticated users on the targeted device. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to incomplete error handling if a specific error type occurs during the SSH key export. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the CLI. A successful exploit could allow the attacker to expose a user's private SSH key. In addition, a similar type of error in the SSH key import could cause the passphrase-protected private SSH key to be imported unintentionally.
Key phrases: expose a user's private SSH key to
CVE-2019-17310: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.
Key phrases: PHP code injection in the Campaigns module by, php code injection
CVE-2019-17311: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.
Key phrases: directory traversal in the attachment function by a
CVE-2019-17312: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.
Key phrases: directory traversal in the file function by a
CVE-2019-17313: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.
Key phrases: directory traversal in the Studio module by a
CVE-2019-17314: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.
Key phrases: directory traversal in the Configurator module by an
CVE-2019-17315: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.
Key phrases: PHP object injection in the Administration module by, php object injection
CVE-2019-17316: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.
Key phrases: PHP object injection in the Import module by, php object injection
CVE-2019-17317: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.
Key phrases: PHP object injection in the UpgradeWizard module by, php object injection
CVE-2019-17318: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user.
Key phrases: SQL injection in the pmse_Inbox module by a, sql injection
CVE-2019-17319: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user.
Key phrases: SQL injection in the Emails module by a, sql injection
CVE-2019-1732: A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device.
Key phrases: perform arbitrary command injection, leverage a time-of-check, time-of-check, time-of-use (toctou) race condition, arbitrary commands
CVE-2019-17320: NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying file name from an attacker controlled FTP server. That leads attacker to execute arbitrary code by sending a crafted filename.
Key phrases: execute arbitrary code, buffer overflow
CVE-2019-17321: ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated with session, could leak username via session file path of HTTP response data. No authentication is required.
Key phrases: information disclosure issue
CVE-2019-17322: ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Key phrases: allows arbitrary file creation, the file path to be written, file write
CVE-2019-17323: ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer with modified XML document. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Key phrases: allows arbitrary file creation, exploit this vulnerability in that the target must
CVE-2019-17324: ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This could lead to create malicious HTML file, because they can inject a content with crafted template. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Key phrases: create malicious HTML file, directory traversal
CVE-2019-17325: ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Key phrases: upload arbitrary local file via the ActiveX method, sensitive information, disclosure
CVE-2019-17326: ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted parameter. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Key phrases: arbitrary file deletion by issuing a HTTP GET
CVE-2019-17327: JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file.
Key phrases: execute arbitrary code, directory traversal
CVE-2019-1733: A vulnerability in the NX API (NX-API) Sandbox interface for Cisco NX-OS Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the NX-API Sandbox interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the NX-API Sandbox interface. An attacker could exploit this vulnerability by persuading a user of the NX-API Sandbox interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected NX-API Sandbox interface.
Key phrases: execute arbitrary script code, conduct a cross-site scripting (XSS, execute arbitrary script code in the context of, cross-site scripting (xss)
CVE-2019-17330: The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow authenticated users to perform stored cross-site scripting (XSS) attacks, and unauthenticated users to perform reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions up to and including 5.8.1.fixR, versions 5.9.3, 5.9.4, 5.9.5, and 5.9.6.
Key phrases: perform stored cross-site scripting (XSS, stored cross-site scripting (xss), reflected cross-site scripting
CVE-2019-17331: The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, version 4.1.0.
Key phrases: perform stored cross-site scripting (XSS, stored cross-site scripting (xss)
CVE-2019-17332: The Digital Asset Manager Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, versions 4.1.0, 4.2.0, 4.2.1, and 4.2.2.
Key phrases: perform stored cross-site scripting (XSS, stored cross-site scripting (xss)
CVE-2019-17333: The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below, versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7.
Key phrases: perform stored cross-site scripting (XSS, stored cross-site scripting (xss)
CVE-2019-17334: The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contains a vulnerability that theoretically allows an attacker with permission to write DXP files to the Spotfire library to remotely execute code of their choice on the user account of other users who access the affected system. This attack is a risk only when the attacker has write access to a network file system shared with the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0, TIBCO Spotfire Deployment Kit: versions 7.11.1 and below, TIBCO Spotfire Desktop: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, and TIBCO Spotfire Desktop Language Packs: versions 7.11.1 and below.
Key phrases: write DXP files to the Spotfire library to, execute code