yahoo-inc/cve-impacts huggingface dataset:
CVE-2019-15809: Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because the Atmel Toolbox 00.03.11.05 contains two versions of ECDSA signature functions, described as fast and secure, but the affected cards chose to use the fast version, which leaks the bit length of the random nonce via timing. This affects Athena IDProtect 010b.0352.0005, Athena IDProtect 010e.1245.0002, Athena IDProtect 0106.0130.0401, Athena IDProtect 010e.1245.0002, Valid S/A IDflex V 010b.0352.0005, SafeNet eToken 4300 010e.1245.0002, TecSec Armored Card 010e.0264.0001, and TecSec Armored Card 108.0264.0001.
Key phrases: measure the duration of hundreds to thousands of, timing side channel
CVE-2019-1581: A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4.
Key phrases: remote code execution, root access, gain root access
CVE-2019-15810: Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.
Key phrases: for reflected XSS via manipulation of a URL, reflected xss
CVE-2019-15811: In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
Key phrases: xss
CVE-2019-15813: Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.
Key phrases: execute arbitrary code, bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users, Multiple file upload restriction bypass, execute arbitrary code via a webshell
CVE-2019-15814: Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.
Key phrases: inject arbitrary web script or HTML, xss
CVE-2019-15815: ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges.
Key phrases: access certain pages that require admin privileges, access control
CVE-2019-15816: The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
Key phrases: option changes
CVE-2019-15817: The easy-property-listings plugin before 3.4 for WordPress has XSS.
Key phrases: xss
CVE-2019-15818: The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
CVE-2019-15819: The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
CVE-2019-1582: Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying the current client interactive session.
Key phrases: cause arbitrary memory corruption, cause arbitrary memory corruption by rekeying the current
CVE-2019-15820: The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
CVE-2019-15821: The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
CVE-2019-15822: The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
Key phrases: directory traversal
CVE-2019-15823: The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
Key phrases: action=confirmaction protection bypass
CVE-2019-15824: The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
Key phrases: adminhash protection bypass
CVE-2019-15825: The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
Key phrases: action=rp&key&login protection bypass
CVE-2019-15826: The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
Key phrases: bypass via wp-login.php in the Referer field, protection bypass
CVE-2019-15827: The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.
Key phrases: xss
CVE-2019-15828: The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
Key phrases: csrf
CVE-2019-15829: The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
Key phrases: xss
CVE-2019-1583: Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistlock user with Operator capabilities to escalate privileges to that of another user. Active interaction with an affected component is required for the payload to execute on the victim.
Key phrases: escalate privileges to that of another user, escalation of privilege, escalation privilege
CVE-2019-15830: The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.
Key phrases: ig_cat_list xss
CVE-2019-15831: The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
Key phrases: csrf
CVE-2019-15832: The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
Key phrases: csrf
CVE-2019-15833: The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
Key phrases: xss
CVE-2019-15834: The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
Key phrases: csrf
CVE-2019-15835: The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.
Key phrases: csrf
CVE-2019-15836: The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
Key phrases: xss
CVE-2019-15837: The webp-express plugin before 0.14.8 for WordPress has stored XSS.
Key phrases: xss
CVE-2019-15838: The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
Key phrases: xss
CVE-2019-15839: The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.
Key phrases: local file inclusion
CVE-2019-1584: A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if the Inspector were sent a malicious command from the Zingbox cloud, or if the Zingbox Inspector were tampered with to connect to an attacker's cloud endpoint.
Key phrases: connect to an attacker's cloud endpoint, remote code execution
CVE-2019-15840: The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.
Key phrases: csrf
CVE-2019-15841: The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.
Key phrases: csrf
CVE-2019-15842: The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
Key phrases: xss
CVE-2019-15843: A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition involving a man-in-the-middle attack may lead to partial data leakage or malicious file writing.
Key phrases: malicious file upload, partial data leakage, malicious file writing, man in the middle, file write
CVE-2019-15845: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
CVE-2019-15846: Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
Key phrases: execute arbitrary code, execute arbitrary code as root via a trailing, trailing backslash
CVE-2019-15847: The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.
CVE-2019-15848: JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.
Key phrases: send an arbitrary HTTP request to a TeamCity, cross-site scripting (xss)
CVE-2019-15849: eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system.
Key phrases: the victim, session fixation, compromise
CVE-2019-1585: A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a misconfiguration of certain sudoers files for the bashroot component on an affected device. An attacker could exploit this vulnerability by authenticating to the affected device with a crafted user ID, which may allow temporary administrative access to escalate privileges. A successful exploit could allow the attacker to escalate privileges on an affected device. This Vulnerability has been fixed in version 4.0(1h)
Key phrases: escalate standard users with root privilege on an, escalate privileges, escalate privileges on an affected device, successful exploit
CVE-2019-15850: eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system.
Key phrases: Remote Code Execution in the ReGa.runScript method, remote code execution, compromise, execute code
CVE-2019-15854: An issue was discovered in Maarch RM before 2.5. A privilege escalation vulnerability allows an authenticated user with lowest privileges to give herself highest administration privileges via a crafted PUT request to an unauthorized resource.
Key phrases: give herself highest administration privileges via a crafted, privilege escalation
CVE-2019-15855: An issue was discovered in Maarch RM before 2.5. A path traversal vulnerability allows an unauthenticated remote attacker to overwrite any files with a crafted POST request if the default installation procedure was followed. This results in a permanent Denial of Service.
Key phrases: overwrite any files with a crafted POST request, path traversal, denial of service
CVE-2019-15858: admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Key phrases: unauthenticated options import, xss payload, remote code execution
CVE-2019-15859: Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /password.jsn URI.
Key phrases: get full access to a device via the, password disclosure
CVE-2019-1586: A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with physical access to obtain sensitive information from an affected device. The vulnerability is due to insecure removal of cleartext encryption keys stored on local partitions in the hard drive of an affected device. An attacker could exploit this vulnerability by retrieving data from the physical disk on the affected partition(s). A successful exploit could allow the attacker to retrieve encryption keys, possibly allowing the attacker to further decrypt other data and sensitive information on the device, which could lead to the disclosure of confidential information.
Key phrases: obtain sensitive information, obtain sensitive information from an affected device, retrieve encryption keys, further decrypt other data and sensitive information on, disclosure of confidential information
CVE-2019-15860: Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.
Key phrases: a SIGSEGV in XRef::constructXRef in XRef.cc, sigsegv
CVE-2019-15862: An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the application was configured to accept files only with a defined set of extensions). This affects CKFinder for ASP, CKFinder for ASP.NET, CKFinder for ColdFusion, and CKFinder for PHP.
Key phrases: upload files without any extension (even if, improper checks of file names
CVE-2019-15863: The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
Key phrases: unintended account creation
CVE-2019-15864: The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
Key phrases: xss
CVE-2019-15865: The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
Key phrases: csrf
CVE-2019-15866: The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.
Key phrases: has arbitrary file upload
CVE-2019-15867: The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.
Key phrases: hardcoded
CVE-2019-15868: The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
Key phrases: csrf
CVE-2019-15869: The JobCareer theme before 2.5.1 for WordPress has stored XSS.
Key phrases: xss
CVE-2019-1587: A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, remote attacker to access sensitive information. The vulnerability occurs because the affected software does not properly validate user-supplied input. An attacker could exploit this vulnerability by issuing certain commands with filtered query results on the device. This action may cause returned messages to display confidential system information. A successful exploit could allow the attacker to read sensitive information on the device.
Key phrases: access sensitive information, read sensitive information on the device, successful exploit
CVE-2019-15870: The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
Key phrases: xss
CVE-2019-15871: The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
CVE-2019-15872: The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
Key phrases: sql injection
CVE-2019-15873: The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.
Key phrases: remote code execution
CVE-2019-15874: In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in memory access after it has been freed leading to a kernel panic or other unpredictable results.
Key phrases: memory access, unpredictable results
CVE-2019-15875: In FreeBSD 12.1-STABLE before r354734, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r354735, and 11.3-RELEASE before 11.3-RELEASE-p6, due to incorrect initialization of a stack data structure, core dump files may contain up to 20 bytes of kernel data previously stored on the stack.
CVE-2019-15876: In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specific ioctl command handlers in the oce network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to send passthrough commands to the device firmware.
Key phrases: send passthrough commands to the device firmware
CVE-2019-15877: In FreeBSD 12.1-STABLE before r356606 and 12.1-RELEASE before 12.1-RELEASE-p3, driver specific ioctl command handlers in the ixl network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to trigger updates to the device's non-volatile memory.
Key phrases: trigger updates to the device's non-
CVE-2019-15878: In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-after-free situation due to improper checking in SCTP when an application tries to update an SCTP-AUTH shared key.
Key phrases: use-after-free situation, use after free
CVE-2019-15879: In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data structure in the kernel to be used after it was freed, allowing an unprivileged process can overwrite arbitrary kernel memory.
Key phrases: overwrite arbitrary kernel memory, an unprivileged process can overwrite arbitrary kernel memory, race condition
CVE-2019-1588: A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to read arbitrary files on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms of user-supplied input sent to an affected device. A successful exploit could allow the attacker unauthorized access to read arbitrary files on an affected device. This vulnerability has been fixed in version 14.0(1h).
Key phrases: read arbitrary files, read arbitrary files on an affected device, unauthorized access
CVE-2019-15880: In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic.
Key phrases: trigger a kernel panic
CVE-2019-15889: The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
Key phrases: xss
CVE-2019-1589: A vulnerability in the Trusted Platform Module (TPM) functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, local attacker with physical access to view sensitive information on an affected device. The vulnerability is due to a lack of proper data-protection mechanisms for disk encryption keys that are used within the partitions on an affected device hard drive. An attacker could exploit this vulnerability by obtaining physical access to the affected device to view certain cleartext keys. A successful exploit could allow the attacker to execute a custom boot process or conduct further attacks on an affected device.
Key phrases: view sensitive information on an affected device, execute a custom boot process or conduct further
CVE-2019-15890: libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
Key phrases: use-after-free, use after free
CVE-2019-15891: An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information that could lead to a conclusion that the application has a built-in bulletproof content sniffing protection.
CVE-2019-15892: An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
Key phrases: trigger an assert by sending crafted HTTP/1 requests, http parsing failure, denial of service
CVE-2019-15893: Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.
Key phrases: Remote Code Execution, remote code execution
CVE-2019-15894: An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. An attacker who uses fault injection to physically disrupt the ESP32 CPU can bypass the Secure Boot digest verification at startup, and boot unverified code from flash. The fault injection attack does not disable the Flash Encryption feature, so if the ESP32 is configured with the recommended combination of Secure Boot and Flash Encryption, then the impact is minimized. If the ESP32 is configured without Flash Encryption then successful fault injection allows arbitrary code execution. To protect devices with Flash Encryption and Secure Boot enabled against this attack, a firmware change must be made to permanently enable Flash Encryption in the field if it is not already permanently enabled.
Key phrases: allows arbitrary code execution, bypass the Secure Boot digest verification, protect devices with Flash Encryption and Secure Boot, fault injection
CVE-2019-15895: search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
Key phrases: unauthenticated options changes
CVE-2019-15896: An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.
Key phrases: unauthenticated options import, stored xss, privilege escalation
CVE-2019-15897: beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typically not exposed to external networks).
Key phrases: Bypass via communication with a BeeGFS metadata server, Authentication Bypass, external networks), authentication bypass
CVE-2019-15898: Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.
Key phrases: Reflected XSS via the username on the Login, reflected xss
CVE-2019-1590: A vulnerability in the Transport Layer Security (TLS) certificate validation functionality of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to perform insecure TLS client authentication on an affected device. The vulnerability is due to insufficient TLS client certificate validations for certificates sent between the various components of an ACI fabric. An attacker who has possession of a certificate that is trusted by the Cisco Manufacturing CA and the corresponding private key could exploit this vulnerability by presenting a valid certificate while attempting to connect to the targeted device. An exploit could allow the attacker to gain full control of all other components within the ACI fabric of an affected device.
Key phrases: gain full control, perform insecure TLS client authentication on an affected, gain full control of all other components within
CVE-2019-15900: An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The result was that, instead of reporting that the supplied username or group name did not exist, it would execute the command as root.
Key phrases: execute commands
CVE-2019-15901: An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change the UID, primary GID, and secondary GIDs was replaced (on certain platforms: Linux and possibly NetBSD) with a single setuid(2) call. This resulted in neither changing the group id nor initializing secondary group ids.
CVE-2019-15902: A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the upstream "x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()" commit reintroduced the Spectre vulnerability that it aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped.
Key phrases: spectre
CVE-2019-15903: In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2019-1591: A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escape a restricted shell on an affected device. The vulnerability is due to insufficient sanitization of user-supplied input when issuing a specific CLI command with parameters on an affected device. An attacker could exploit this vulnerability by authenticating to the device CLI and issuing certain commands. A successful exploit could allow the attacker to escape the restricted shell and execute arbitrary commands with root-level privileges on the affected device. This vulnerability only affects Cisco Nexus 9000 Series ACI Mode Switches that are running a release prior to 14.0(3d).
Key phrases: execute arbitrary commands, escape a restricted shell on an affected device, escape the restricted shell and execute arbitrary commands
CVE-2019-15910: An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "discover ZigBee network procedure" to perform a denial of service attack.
Key phrases: denial of service
CVE-2019-15911: An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee communication, attackers can obtain sensitive information, cause the multiple denial of service attacks, take over smart home devices, and tamper with messages.
Key phrases: obtain sensitive information, insecure key transport, denial of service, tamper with messages
CVE-2019-15912: An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can use the ZigBee trust center rejoin procedure to perform mutiple denial of service attacks.
Key phrases: zigbee trust center rejoin procedure, denial of service
CVE-2019-15913: An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Because of insecure key transport in ZigBee communication, causing attackers to gain sensitive information and denial of service attack, take over smart home devices, and tamper with messages.
Key phrases: gain sensitive information, insecure key transport, denial of service, tamper with messages
CVE-2019-15914: An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Attackers can use the ZigBee trust center rejoin procedure to perform mutiple denial of service attacks.
Key phrases: zigbee trust center rejoin procedure, denial of service
CVE-2019-15915: An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, RTCGQ01LM devices. Attackers can utilize the "discover ZigBee network procedure" to perform a denial of service attack.
Key phrases: denial of service
CVE-2019-15916: An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service.
Key phrases: memory leak, denial of service
CVE-2019-15917: An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.
Key phrases: use-after-free, use after free
CVE-2019-15918: An issue was discovered in the Linux kernel before 5.0.10. SMB2_negotiate in fs/cifs/smb2pdu.c has an out-of-bounds read because data structures are incompletely updated after a change from smb30 to smb21.
Key phrases: out-of-bounds read, out of bounds read
CVE-2019-15919: An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
Key phrases: use-after-free, use after free
CVE-2019-1592: A vulnerability in the background operations functionality of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an authenticated, local attacker to gain elevated privileges as root on an affected device. The vulnerability is due to insufficient validation of user-supplied files on an affected device. An attacker could exploit this vulnerability by logging in to the CLI of the affected device and creating a crafted file in a specific directory on the filesystem. A successful exploit could allow the attacker to execute arbitrary operating system commands as root on an affected device.
Key phrases: execute arbitrary operating system, gain elevated privileges, gain elevated privileges as root on an affected, execute arbitrary operating system commands as root on
CVE-2019-15920: An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.
Key phrases: use-after-free, memory leak, use after free
CVE-2019-15921: An issue was discovered in the Linux kernel before 5.0.6. There is a memory leak issue when idr_alloc() fails in genl_register_family() in net/netlink/genetlink.c.
Key phrases: memory leak
CVE-2019-15922: An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a pf data structure if alloc_disk fails in drivers/block/paride/pf.c.
Key phrases: null pointer dereference
CVE-2019-15923: An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a cd data structure if alloc_disk fails in drivers/block/paride/pf.c.
Key phrases: null pointer dereference
CVE-2019-15924: An issue was discovered in the Linux kernel before 5.0.11. fm10k_init_module in drivers/net/ethernet/intel/fm10k/fm10k_main.c has a NULL pointer dereference because there is no -ENOMEM upon an alloc_workqueue failure.
Key phrases: null pointer dereference
CVE-2019-15925: An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_mode_vnet_base_cfg in the file drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.
Key phrases: out of bounds access
CVE-2019-15926: An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in the file drivers/net/wireless/ath/ath6kl/wmi.c.
Key phrases: out of bounds access
CVE-2019-15927: An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_procunit in the file sound/usb/mixer.c.
Key phrases: out-of-bounds access, out of bounds access
CVE-2019-15929: In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
Key phrases: brute force attempt
CVE-2019-1593: A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level by executing commands authorized to other user roles. The attacker must authenticate with valid user credentials. The vulnerability is due to the incorrect implementation of a Bash shell command that allows role-based access control (RBAC) to be bypassed. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Bash prompt. A successful exploit could allow the attacker to escalate their privilege level by executing commands that should be restricted to other roles. For example, a dev-ops user could escalate their privilege level to admin with a successful exploit of this vulnerability.
Key phrases: escalate their privilege level by executing commands authorized, be bypassed, escalate their privilege level by executing commands that, escalate privilege, execute commands
CVE-2019-15930: Intesync Solismed 3.3sp allows Clickjacking.
Key phrases: Clickjacking, clickjacking
CVE-2019-15931: Intesync Solismed 3.3sp allows Directory Traversal, a different vulnerability than CVE-2019-16246.
Key phrases: Directory Traversal, directory traversal
CVE-2019-15932: Intesync Solismed 3.3sp has Incorrect Access Control.
Key phrases: incorrect access control
CVE-2019-15933: Intesync Solismed 3.3sp has SQL Injection.
Key phrases: sql injection
CVE-2019-15934: Intesync Solismed 3.3sp has CSRF.
Key phrases: csrf
CVE-2019-15935: Intesync Solismed 3.3sp has XSS.
Key phrases: xss
CVE-2019-15936: Intesync Solismed 3.3sp allows Insecure File Upload.
Key phrases: Insecure File Upload, insecure file upload
CVE-2019-15937: Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy.
Key phrases: remote buffer overflow
CVE-2019-15938: Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy.
Key phrases: remote buffer overflow
CVE-2019-15939: An issue was discovered in OpenCV 4.1.0. There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp.
CVE-2019-1594: A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete input validation of Extensible Authentication Protocol over LAN (EAPOL) frames. An attacker could exploit this vulnerability by sending a crafted EAPOL frame to an interface on the targeted device. A successful exploit could allow the attacker to cause the Layer 2 (L2) forwarding process to restart multiple times, leading to a system-level restart of the device and a DoS condition. Note: This vulnerability affects only NX-OS devices configured with 802.1X functionality. Cisco Nexus 1000V Switch for VMware vSphere devices are affected in versions prior to 5.2(1)SV3(1.4b). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.3(5)N1(1) and 7.1(5)N1(1b). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(3). Nexus 9000 Series Fabric Switches in ACI Mode are affected in versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4).
Key phrases: denial of service (DoS), cause a denial of service (DoS), cause the Layer 2 (L2) forwarding, denial of service (dos) condition
CVE-2019-15940: Victure PC530 devices allow unauthenticated TELNET access as root.
Key phrases: unauthenticated TELNET access as root, unauthenticated telnet access
CVE-2019-15941: OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
Key phrases: bypass access control, bypass access control rules via a crafted OpenID
CVE-2019-15942: FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffer.
Key phrases: conditional jump or move depends on uninitialised value
CVE-2019-15943: vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a memset call.
Key phrases: achieve code execution or denial of service by
CVE-2019-15944: In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection message.
Key phrases: unsafe html
CVE-2019-15945: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
Key phrases: out-of-bounds access, out of bounds access
CVE-2019-15946: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
Key phrases: out-of-bounds access, out of bounds access
CVE-2019-15947: In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. Upon a crash, it may dump a core file. If a user were to mishandle a core file, an attacker can reconstruct the user's wallet.dat file, including their private keys, via a grep "6231 0500" command.
Key phrases: unencrypted, crash
CVE-2019-15948: Texas Instruments CC256x and WL18xx dual-mode Bluetooth controller devices, when LE scan mode is used, allow remote attackers to trigger a buffer overflow via a malformed Bluetooth Low Energy advertising packet, to cause a denial of service or potentially execute arbitrary code. This affects CC256xC-BT-SP 1.2, CC256xB-BT-SP 1.8, and WL18xx-BT-SP 4.4.
Key phrases: execute arbitrary code, trigger a buffer overflow via a malformed Bluetooth, denial of service
CVE-2019-15949: Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.
Key phrases: the server as the nagios user, remote command execution
CVE-2019-1595: A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an incorrect allocation of an internal interface index. An adjacent attacker with the ability to submit a crafted FCoE packet that crosses affected interfaces could trigger this vulnerability. A successful exploit could allow the attacker to cause a packet loop and high throughput on the affected interfaces, resulting in a DoS condition. This vulnerability has been fixed in version 7.3(5)N1(1).
Key phrases: denial of service (DoS), cause a denial of service (DoS), cause a packet loop and high throughput on, denial of service (dos) condition, dos condition
CVE-2019-15950: The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data.
Key phrases: XSS via crafted vCard data, xss
CVE-2019-15952: An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to include .html files that are outside the permitted directory. Also, if a page contains a template directive, then the directive will be server side processed. Thus, if a user can control the content of a .html file, then they can inject a payload with a malicious template directive to gain Remote Command Execution. The exploit will work only with the .html extension.
Key phrases: gain Remote Command Execution, path traversal, remote command execution
CVE-2019-15953: An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.
Key phrases: privilege escalation
CVE-2019-15954: An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>
Key phrases: gain achieve Remote Command Execution, remote command execution (rce)
CVE-2019-15955: An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with O(n)=2n instead of O(n)=n^x complexity, and steal the admin password.
Key phrases: obtain the random values inside it. If, brute force
CVE-2019-15956: A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific URL in the web management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could have a twofold impact: the attacker could either change the administrator password, gaining privileged access, or reset the network configuration details, causing a denial of service (DoS) condition. In both scenarios, manual intervention is required to restore normal operations.
Key phrases: denial of service (DoS), perform an unauthorized system reset on an affected, twofold impact, denial of service (dos) condition, improper authorization
CVE-2019-15957: A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system. When processed, the commands will be executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by providing malicious input to a specific field in the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as the root user.
Key phrases: inject arbitrary commands, inject arbitrary commands into the underlying operating system, execute arbitrary commands on the underlying Linux operating, root privilege
CVE-2019-15958: A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input validation during the initial High Availability (HA) configuration and registration process of an affected device. An attacker could exploit this vulnerability by uploading a malicious file during the HA registration period. A successful exploit could allow the attacker to execute arbitrary code with root-level privileges on the underlying operating system. Note: This vulnerability can only be exploited during the HA registration period. See the Details section for more information.
Key phrases: execute arbitrary code, execute arbitrary code with root privileges on the, execute arbitrary code with root-level privileges, insufficient input validation
CVE-2019-15959: A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this vulnerability by accessing the physical interface of a device and inserting a USB storage device. A successful exploit could allow the attacker to execute scripts on the device in an elevated security context.
Key phrases: execute arbitrary commands, execute arbitrary commands on the device, execute scripts on the device in an elevated
CVE-2019-1596: A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level to root. The attacker must authenticate with valid user credentials. The vulnerability is due to incorrect permissions of a system executable. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Bash prompt. A successful exploit could allow the attacker to escalate their privilege level to root. Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).
Key phrases: escalate their privilege level to root, escalate privilege
CVE-2019-15960: A vulnerability in the Webex Network Recording Admin page of Cisco Webex Meetings could allow an authenticated, remote attacker to elevate privileges in the context of the affected page. To exploit this vulnerability, the attacker must be logged in as a low-level administrator. The vulnerability is due to insufficient access control validation. An attacker could exploit this vulnerability by submitting a crafted URL request to gain privileged access in the context of the affected page. A successful exploit could allow the attacker to elevate privileges in the Webex Recording Admin page, which could allow them to view or delete recordings that they would not normally be able to access.
Key phrases: gain privileged, elevate privileges in the context of the affected, elevate privileges in the Webex Recording Admin page, view or delete recordings that they would not, insufficient access control
CVE-2019-15961: A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.
Key phrases: cause a denial of service condition on an, cause the ClamAV scanning process to scan the