yahoo-inc/cve-impacts huggingface dataset:
CVE-2019-15466: The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india/sakura_india:8.1.0/OPM1.171019.019/V10.2.6.0.ODMMIXM:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app (versionCode=1, versionName=QL1715_201812191721) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
Key phrases: unauthorized wireless settings modification via a confused deputy
CVE-2019-15467: The Xiaomi Mi Mix 2S Android device with a build fingerprint of Xiaomi/polaris/polaris:8.0.0/OPR1.170623.032/V9.5.19.0.ODGMIFA:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app (versionCode=1, versionName=A2060_201801032053) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
Key phrases: unauthorized wireless settings modification via a confused deputy
CVE-2019-15468: The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app (versionCode=1, versionName=QL1715_201812071953) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
Key phrases: unauthorized wireless settings modification via a confused deputy
CVE-2019-15469: The Xiaomi Mi Pad 4 Android device with a build fingerprint of Xiaomi/clover/clover:8.1.0/OPM1.171019.019/V9.6.26.0.ODJCNFD:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=27, versionName=8.1.0) that allows other pre-installed apps to perform microphone audio recording via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that export their capabilities to other pre-installed app. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Key phrases: obtain signatureOrSystem permissions, perform microphone audio recording via an accessible app, use its open interface to record telephone calls
CVE-2019-1547: Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
Key phrases: full key recovery
CVE-2019-15470: The Xiaomi Redmi Note 6 Pro Android device with a build fingerprint of xiaomi/tulip/tulip:8.1.0/OPM1.171019.011/V10.2.2.0.OEKMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=27, versionName=8.1.0) that allows other pre-installed apps to perform microphone audio recording via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that export their capabilities to other pre-installed app. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Key phrases: obtain signatureOrSystem permissions, perform microphone audio recording via an accessible app, use its open interface to record telephone calls
CVE-2019-15471: The Xiaomi Mi Mix 2S Android device with a build fingerprint of Xiaomi/polaris/polaris:8.0.0/OPR1.170623.032/V9.5.19.0.ODGMIFA:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=27, versionName=8.1.0) that allows other pre-installed apps to perform microphone audio recording via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that export their capabilities to other pre-installed app. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Key phrases: obtain signatureOrSystem permissions, perform microphone audio recording via an accessible app, use its open interface to record telephone calls
CVE-2019-15472: The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Key phrases: use its open interface to record telephone calls, unauthorized microphone audio recording, confused deputy
CVE-2019-15473: The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/jasmine/jasmine_sprout:9/PKQ1.180904.001/V10.0.2.0.PDIMIFJ:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Key phrases: use its open interface to record telephone calls, unauthorized microphone audio recording, confused deputy
CVE-2019-15474: The Xiaomi Cepheus Android device with a build fingerprint of Xiaomi/cepheus/cepheus:9/PKQ1.181121.001/V10.2.6.0.PFAMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Key phrases: use its open interface to record telephone calls, unauthorized microphone audio recording, confused deputy
CVE-2019-15475: The Xiaomi Mi A3 Android device with a build fingerprint of xiaomi/onc_eea/onc:9/PKQ1.181021.001/V10.2.8.0.PFLEUXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Key phrases: use its open interface to record telephone calls, unauthorized microphone audio recording, confused deputy
CVE-2019-15476: Former before 4.2.1 has XSS via a checkbox value.
Key phrases: xss
CVE-2019-15477: Jooby before 1.6.4 has XSS via the default error handler.
Key phrases: xss
CVE-2019-15478: Status Board 1.1.81 has reflected XSS via logic.ts.
Key phrases: xss
CVE-2019-15479: Status Board 1.1.81 has reflected XSS via dashboard.ts.
Key phrases: xss
CVE-2019-15480: Domoticz 4.10717 has XSS via item.Name.
Key phrases: xss
CVE-2019-15481: Kimai v2 before 1.1 has XSS via a timesheet description.
Key phrases: xss
CVE-2019-15482: selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
Key phrases: xss
CVE-2019-15483: Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.
Key phrases: xss
CVE-2019-15484: Bolt before 3.6.10 has XSS via an image's alt or title field.
Key phrases: xss
CVE-2019-15485: Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.
Key phrases: xss
CVE-2019-15486: django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.
Key phrases: xss
CVE-2019-15487: DfE School Experience before v16333-GA has XSS via a teacher training URL.
Key phrases: xss
CVE-2019-15488: Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
Key phrases: xss
CVE-2019-15489: laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
Key phrases: xss
CVE-2019-1549: OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
CVE-2019-15490: openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
Key phrases: code injection
CVE-2019-15491: openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
Key phrases: csrf
CVE-2019-15492: openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
Key phrases: xss
CVE-2019-15493: openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
Key phrases: deletion of files, rvid
CVE-2019-15494: openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
Key phrases: SSRF, ssrf, rvid
CVE-2019-15496: MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
Key phrases: executing arbitrary code, an attacker tricking the administrator into executing arbitrary, csrf protection, user create csrf, execute arbitrary, execute arbitrary code
CVE-2019-15497: Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP.
Key phrases: access devices remotely via SSH, default credentials, default credentials,
CVE-2019-15498: cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh.
Key phrases: execute arbitrary OS, execute arbitrary OS commands via --output argument injection, arbitrary os commands
CVE-2019-15499: CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.
Key phrases: XSS via an IFRAME element with allow-, -top-navigation in the sandbox attribute, xss
CVE-2019-15501: Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.
Key phrases: reflected cross site scripting (xss)
CVE-2019-15502: The TeamSpeak client before 3.3.2 allows remote servers to trigger a crash via the 0xe2 0x81 0xa8 0xe2 0x81 0xa7 byte sequence, aka Unicode characters U+2068 (FIRST STRONG ISOLATE) and U+2067 (RIGHT-TO-LEFT ISOLATE).
Key phrases: trigger a crash via the 0xe2 0x81 0xa8, remote servers, byte sequence
CVE-2019-15503: cgi-cpn/xcoding/prontus_videocut.cgi in AltaVoz Prontus (aka ProntusCMS) through 12.0.3.0 has "Improper Neutralization of Special Elements used in an OS Command," allowing attackers to execute OS commands via an HTTP GET parameter.
Key phrases: execute OS commands via an HTTP GET parameter, improper neutralization of special elements used in an os command
CVE-2019-15504: drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).
Key phrases: double free
CVE-2019-15505: drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).
Key phrases: out-of-bounds read, out of bounds read
CVE-2019-15506: An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected.
Key phrases: critical information disclosure
CVE-2019-15507: In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. The fix was back-ported to LTS 2019.6.7 as well as LTS 2019.3.8.
Key phrases: cleartext
CVE-2019-15508: In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.
Key phrases: cleartext
CVE-2019-1551: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).
Key phrases: overflow bug
CVE-2019-15510: ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role.
Key phrases: HTML injection on the user administration page via, html injection
CVE-2019-15511: An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is installed. All GOG Galaxy versions before 1.2.60 and all corresponding versions of GOG Galaxy 2.0 Beta are affected.
Key phrases: gain SYSTEM privileges, local privilege escalation
CVE-2019-15513: An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang.
Key phrases: hang
CVE-2019-15514: The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers.
CVE-2019-15515: Discourse 2.3.2 sends the CSRF token in the query string.
Key phrases: csrf token
CVE-2019-15516: Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.
Key phrases: webadmin directory traversal via ....// because the
CVE-2019-15517: jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.
Key phrases: %2e%2e%2f directory traversal
CVE-2019-15518: Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.
Key phrases: directory traversal in swPort_http_static_handler
CVE-2019-15519: Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.
Key phrases: the application's main directory) via a, directory traversal
CVE-2019-1552: OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be '/usr/local'. However, mingw programs are Windows programs, and as such, find themselves looking at sub-directories of 'C:/usr/local', which may be world writable, which enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows targets, including Visual C builds. However, some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
Key phrases: world writable
CVE-2019-15520: comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.
Key phrases: locations outside of the project directory, directory traversal
CVE-2019-15521: Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object.
Key phrases: PHP object injection via a cookie containing an, php object injection
CVE-2019-15522: An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.
CVE-2019-15523: An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.
CVE-2019-15524: CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI.
Key phrases: allows arbitrary file upload, admin/filemanager in the File Management Module, remote code execution
CVE-2019-15525: There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.
Key phrases: missing ssl certificate validation
CVE-2019-15526: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings, a related issue to CVE-2019-13482.
Key phrases: command injection, shell metacharacters
CVE-2019-15527: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MaxIdTime field to SetWanSettings.
Key phrases: command injection, shell metacharacters
CVE-2019-15528: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Interface field to SetStaticRouteSettings.
Key phrases: command injection, shell metacharacters
CVE-2019-15529: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Username field to Login.
Key phrases: command injection, shell metacharacters
CVE-2019-15530: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the LoginPassword field to Login.
Key phrases: command injection, shell metacharacters
CVE-2019-15531: GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2019-15532: CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
Key phrases: XSS in core/operations/TextEncodingBruteForce.mjs, xss
CVE-2019-15533: XENFCoreSharp before 2019-07-16 allows SQL injection in web/verify.php.
Key phrases: SQL injection in web/verify.php, sql injection
CVE-2019-15534: Raml-Module-Builder 26.4.0 allows SQL Injection in PostgresClient.update.
Key phrases: SQL Injection in PostgresClient.update, sql injection
CVE-2019-15535: Tasking Manager before 3.4.0 allows SQL Injection via custom SQL.
Key phrases: SQL Injection via custom SQL, sql injection
CVE-2019-15536: The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.
Key phrases: SQL Injection via delete_records, sql injection
CVE-2019-15537: The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.
Key phrases: SQL Injection in lib/Auth/Process, sql injection
CVE-2019-15538: An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Key phrases: local dos attack vector, remote dos
CVE-2019-15539: The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.
Key phrases: execution of arbitrary code (if CSP settings, cross-site scripting (xss)
CVE-2019-15540: filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
Key phrases: heap-based buffer overflow, root access, heap based buffer overflow
CVE-2019-15541: rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.
Key phrases: denial of service (loop of conn_event and ready), cause a denial of service (loop of
CVE-2019-15542: An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
Key phrases: uncontrolled recursion
CVE-2019-15543: An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases.
Key phrases: memory corruption
CVE-2019-15544: An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
CVE-2019-15545: An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.
Key phrases: spoofing
CVE-2019-15546: An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities.
Key phrases: printw, mvprintw, format string
CVE-2019-15547: An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are mishandled.
Key phrases: format string issues
CVE-2019-15548: An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.
Key phrases: mvwinstr buffer overflows
CVE-2019-15549: An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field.
Key phrases: memory exhaustion
CVE-2019-15550: An issue was discovered in the simd-json crate before 0.1.15 for Rust. There is an out-of-bounds read and an incorrect crossing of a page boundary.
Key phrases: out-of-bounds read, incorrect crossing of a page boundary, out of bounds read
CVE-2019-15551: An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.
Key phrases: double free
CVE-2019-15552: An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
Key phrases: use-after-free, arbitrary code execution, use after free
CVE-2019-15553: An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
Key phrases: uninitialized memory
CVE-2019-15554: An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.
Key phrases: memory corruption
CVE-2019-15555: FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php.
Key phrases: dietTrack.php, sql injection
CVE-2019-15556: Pvanloon1983 social_network before 2019-07-03 allows SQL injection in includes/form_handlers/register_handler.php.
Key phrases: SQL injection in includes/form_handlers/register_handler.php, sql injection
CVE-2019-15557: XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key.
Key phrases: SQL injection via a tenant key, sql injection
CVE-2019-15558: XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResolver.java.
Key phrases: Constants.java, sql injection
CVE-2019-15559: DianoxDragon Hawn before 2019-07-10 allows SQL injection.
Key phrases: SQL injection, sql injection
CVE-2019-15560: The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.
Key phrases: SQL injection in database/index.js, sql injection
CVE-2019-15561: FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.
Key phrases: flashlingo.js and db.js, sql injection
CVE-2019-15562: GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm
Key phrases: SQL injection via incomplete parentheses, sql injection
CVE-2019-15563: Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.
Key phrases: SQL injection in FeatureExtractionService.java, sql injection
CVE-2019-15564: The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.
Key phrases: SQL injection in models/partner_compassion.py, sql injection
CVE-2019-15565: The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.
Key phrases: SQL injection in icommktconnector.php, sql injection
CVE-2019-15566: The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.
Key phrases: SQL injection in HistorySearchProvider.java, sql injection
CVE-2019-15567: OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature.
Key phrases: SQL injection in the sorting feature, sql injection
CVE-2019-15568: idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels.
Key phrases: SQL injection via tax_levels, sql injection
CVE-2019-15569: HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java.
Key phrases: SearchQueryFactoryOperation.java and SortDirection.java, sql injection
CVE-2019-15570: BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters.
Key phrases: SQL injection during a save operation for a, sql injection
CVE-2019-15571: The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.
Key phrases: SQL injection in clonos.php, sql injection
CVE-2019-15572: Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php.
Key phrases: ServiceCategoryID SQL injection in shop.php, sql injection
CVE-2019-15573: Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php.
Key phrases: SQL injection in tankyou.php, sql injection
CVE-2019-15574: Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php.
Key phrases: serviceID SQL injection in accountmanagement.php, serviceid sql injection
CVE-2019-15575: A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope.
Key phrases: command injection
CVE-2019-15576: An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.
Key phrases: information disclosure
CVE-2019-15577: An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.
Key phrases: information disclosure
CVE-2019-15578: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.
Key phrases: information disclosure
CVE-2019-15579: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones.
Key phrases: information disclosure
CVE-2019-15580: An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.
Key phrases: information exposure
CVE-2019-15581: An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.
Key phrases: idor
CVE-2019-15582: An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment.
Key phrases: idor
CVE-2019-15583: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.
Key phrases: information disclosure
CVE-2019-15584: A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.
Key phrases: bypass input validation, attacker bypass, denial of service
CVE-2019-15585: Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account.
Key phrases: improper authentication, validation issue, takeover
CVE-2019-15586: A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
Key phrases: xss
CVE-2019-15587: In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Key phrases: unsanitized javascript
CVE-2019-15588: There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.
Key phrases: bypass CVE-2019-5475) that could allow, an attacker a Remote Code Execution (RCE, os command injection, remote code execution (rce)
CVE-2019-15589: An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before.
Key phrases: use GIT clone and pull if he had, access control, improper access control
CVE-2019-1559: If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
Key phrases: padding oracle
CVE-2019-15590: An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration
Key phrases: access control issue
CVE-2019-15591: An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
Key phrases: obtain container and dependency scanning reports through the merge request widget, access control, improper access control
CVE-2019-15592: GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
Key phrases: see the merge request ID associated to an
CVE-2019-15593: GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.
Key phrases: affect the availability of the service through a, denial of service
CVE-2019-15594: GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
Key phrases: obtain details of restricted pipelines via the merge request endpoint
CVE-2019-15595: A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands.
Key phrases: run arbitrary commands, privilege escalation
CVE-2019-15596: A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.
Key phrases: perform a path traversal when a symlink is
CVE-2019-15597: A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.
Key phrases: remote code execution by unsanitized input, code injection
CVE-2019-15598: A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
Key phrases: control the input into the command, code injection, remote code execution
CVE-2019-15599: A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
Key phrases: control the input into the command, code injection, remote code execution
CVE-2019-15600: A Path traversal exists in http_server which allows an attacker to read arbitrary system files.
Key phrases: read arbitrary system files, path traversal
CVE-2019-15602: The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
Key phrases: cross-site scripting (xss)
CVE-2019-15603: The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.
Key phrases: cross-site scripting (xss)
CVE-2019-15604: Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
Key phrases: improper certificate validation
CVE-2019-15605: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
Key phrases: http request smuggling, malicious payload delivery, transfer-encoding
CVE-2019-15606: Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Key phrases: bypass of authorization based on header value comparisons, 13 causes bypass, trailing white space, bypass authorization
CVE-2019-15607: A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.
Key phrases: steal session cookies, xss, deface
CVE-2019-15608: The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
Key phrases: toctou, integrity
CVE-2019-15609: The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.
Key phrases: command injection
CVE-2019-15610: Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.
Key phrases: improper authorization, retaining access
CVE-2019-15611: Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.
CVE-2019-15612: A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.
CVE-2019-15613: A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
CVE-2019-15614: Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.
Key phrases: xss
CVE-2019-15615: A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past.
Key phrases: bypass of the lock protection
CVE-2019-15616: Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
Key phrases: a DNS pollution when running long, dangling remote share attempts, dns pollution
CVE-2019-15617: A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.
Key phrases: missing check
CVE-2019-15618: Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
Key phrases: reflected xss
CVE-2019-15619: Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
Key phrases: xss
CVE-2019-15620: Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.
Key phrases: improper access control
CVE-2019-15621: Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.
Key phrases: improper permissions preservation
CVE-2019-15622: Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.
CVE-2019-15623: Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.
Key phrases: exposure of private information
CVE-2019-15624: Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.
Key phrases: create users with IDs of system folders, improper input validation
CVE-2019-15625: A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
Key phrases: the victim's memory processes to extract sensitive, memory usage, sensitive information
CVE-2019-15626: The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.
Key phrases: clear text, confidentiality impact, confidentiality impacts, integrity, integrity and availability
CVE-2019-15627: Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. Local OS access is required. Please note that only Windows agents are affected.
Key phrases: arbitrary file delete, availability impact, local os access
CVE-2019-15628: Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service as an execution and/or persistence mechanism which could execute a malicious program each time the service is started.
Key phrases: use a specific service as an execution and/or, dll hijacking
CVE-2019-15629: Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to allow the application to share information to third-party applications on the device.
Key phrases: share information to third-party applications on, flag_misuse
CVE-2019-1563: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
Key phrases: bleichenbacher padding oracle
CVE-2019-15630: Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.
Key phrases: read files accessible to the Mule process, directory traversal
CVE-2019-15631: Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code.
Key phrases: execute arbitrary code, remote code execution
CVE-2019-15635: An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.
CVE-2019-15637: Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.
Key phrases: xxe, information disclosure, dos
CVE-2019-15638: COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.
Key phrases: uncontrolled search path element
CVE-2019-15639: main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.
Key phrases: send a specific RTP packet during a call, crash
CVE-2019-15640: Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.
CVE-2019-15641: xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
Key phrases: authenticated XXE attacks, xxe
CVE-2019-15642: rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."
Key phrases: run any command or modify any file on, remote code execution, run commands
CVE-2019-15643: The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
Key phrases: xss
CVE-2019-15644: The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
Key phrases: xss
CVE-2019-15645: The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
Key phrases: csrf
CVE-2019-15646: The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
Key phrases: sql injection