yahoo-inc/cve-impacts huggingface dataset:
CVE-2019-14274: MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2019-14275: Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2019-14276: WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.
Key phrases: XXE attacks via a POST request body, xxe
CVE-2019-14277: Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks (i.e., SSRF with resultant remote code execution). NOTE: The vendor disputes this issues as not being a vulnerability because All attacks that use external entities are blocked (no external DTD or file inclusions, no SSRF). The impact on confidentiality, integrity and availability is not proved on any version.
Key phrases: unauthenticated blind xml injection, xxe, local file disclosure, dos, uri invocation, ssrf, remote code execution, confidentiality, integrity and availability, file inclusion, confidentiality and integrity
CVE-2019-14278: In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.
CVE-2019-1428: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1429.
Key phrases: remote code execution, scripting engine memory corruption
CVE-2019-14280: In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.
CVE-2019-14281: The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Key phrases: code-execution backdoor, code execution
CVE-2019-14282: The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Key phrases: code-execution backdoor, code execution
CVE-2019-14283: In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.
Key phrases: integer overflow, out-of-bounds read, out of bounds read
CVE-2019-14284: In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default.
Key phrases: a denial of service by setup_format_params division-
CVE-2019-14286: In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
Key phrases: xss
CVE-2019-14287: In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \\\\#$((0xffffffff))" command.
Key phrases: bypass certain policy, bypass of !root configuration, and USER= logging, incorrect logging
CVE-2019-14288: An issue was discovered in Xpdf 4.01.01. There is an Integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "one byte per line" case.
Key phrases: integer overflow
CVE-2019-14289: An issue was discovered in Xpdf 4.01.01. There is an integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "multiple bytes per line" case.
Key phrases: integer overflow
CVE-2019-1429: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.
Key phrases: remote code execution, scripting engine memory corruption
CVE-2019-14290: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 2.
Key phrases: out of bounds read
CVE-2019-14291: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA==6 case 3.
Key phrases: out of bounds read
CVE-2019-14292: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 1.
Key phrases: out of bounds read
CVE-2019-14293: An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 2.
Key phrases: out of bounds read
CVE-2019-14294: An issue was discovered in Xpdf 4.01.01. There is a use-after-free in the function JPXStream::fillReadBuf at JPXStream.cc, due to an out of bounds read.
Key phrases: use-after-free, out of bounds read, use after free
CVE-2019-14295: An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory.
Key phrases: denial of service (crash), cause a denial of service (crash), integer overflow
CVE-2019-14296: canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.
Key phrases: denial of service (SEGV or buffer overflow, and application crash), cause a denial of service (SEGV or, unspecified other impact, unspecified impact
CVE-2019-14297: Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.
Key phrases: setDashboardWidget in CommonDataHandlerReadOnly.ashx, xss
CVE-2019-14298: Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
Key phrases: addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx, xss
CVE-2019-14299: Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.
Key phrases: obtain the local account credentials, authentication method, brute force
CVE-2019-1430: A remote code execution vulnerability exists when Windows Media Foundation improperly parses specially crafted QuickTime media files.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'Microsoft Windows Media Foundation Remote Code Execution Vulnerability'.
Key phrases: gain the same user rights, remote code execution, microsoft windows media foundation remote code execution
CVE-2019-14300: Several Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Key phrases: cause a denial of service or code execution, buffer overflows
CVE-2019-14301: Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
Key phrases: incorrect access control
CVE-2019-14302: On Ricoh SP C250DN 1.06 devices, a debug port can be used.
Key phrases: debug port
CVE-2019-14303: Ricoh SP C250DN 1.05 devices allow denial of service (issue 1 of 3). Some Ricoh printers were affected by a wrong LPD service implementation that lead to a denial of service vulnerability.
Key phrases: denial of service (issue 1 of 3), a denial of service vulnerability
CVE-2019-14304: Ricoh SP C250DN 1.06 devices allow CSRF.
Key phrases: CSRF, csrf
CVE-2019-14305: Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for Wi-Fi, mDNS, POP3, SMTP, and notification alerts, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Key phrases: cause a denial of service or code execution, buffer overflows
CVE-2019-14306: Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).
Key phrases: incorrect access control
CVE-2019-14307: Several Ricoh printers have multiple buffer overflows parsing HTTP parameter settings for SNMP, which allow an attacker to cause a denial of service or code execution via crafted requests to the web server. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Key phrases: cause a denial of service or code execution, buffer overflows
CVE-2019-14308: Several Ricoh printers have multiple buffer overflows parsing LPD packets, which allow an attacker to cause a denial of service or code execution via crafted requests to the LPD service. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
Key phrases: cause a denial of service or code execution, buffer overflows
CVE-2019-14309: Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer firmware. This would allow to an attacker to access and read information stored on the shared FTP folders.
Key phrases: an attacker to access and read information stored, fixed password, ftp service credential, hardcoded
CVE-2019-14310: Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). Unauthenticated crafted packets to the IPP service will cause a vulnerable device to crash. A memory corruption has been identified in the way of how the embedded device parsed the IPP packets
Key phrases: denial of service (issue 2 of 3), the IPP service will cause a vulnerable device, crash, memory corruption
CVE-2019-14312: Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI.
Key phrases: read internal files on the server via a, local file inclusion
CVE-2019-14313: A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands on the affected system, sql injection
CVE-2019-14314: A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands on the affected system, sql injection
CVE-2019-14315: A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2019-14317: wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bits of the generated nonces.
Key phrases: compute the long term private key from several, lattice
CVE-2019-14318: Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp (prime field curves, small leakage) and algebra.cpp (binary field curves, large leakage) is not constant time and leaks the bit length of the scalar among other information.
Key phrases: measure the duration of hundreds to thousands of, timing side channel
CVE-2019-14319: The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker to extract private sensitive information by sniffing network traffic.
Key phrases: extract private sensitive information by sniffing network traffic, unencrypted transmission
CVE-2019-1432: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1411.
Key phrases: information disclosure, directwrite information disclosure
CVE-2019-14322: In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
CVE-2019-14323: SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.
Key phrases: stack-based buffer overflow, crash, stack based buffer overflow
CVE-2019-14326: An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23) with root privileges in the emulated Android system. This can be exploited by remote attackers to gain full access to the device, or by malicious apps installed inside the emulator to perform privilege escalation from a normal user to root (unlike with standard methods of getting root privileges on Android - e.g., the SuperSu program - the user is not asked for consent). There is no authentication performed - access to a root shell is given upon a successful connection. NOTE: although this was originally published with a slightly different CVE ID number, the correct ID for this Andy vulnerability has always been CVE-2019-14326.
Key phrases: gain full access, privilege escalation, andy, root privilege
CVE-2019-14327: A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Key phrases: change the plugin settings, csrf
CVE-2019-14328: The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Key phrases: csrf
CVE-2019-14329: An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can modify the parameter name to contain JavaScript code.
Key phrases: xss
CVE-2019-1433: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1435, CVE-2019-1437, CVE-2019-1438.
Key phrases: elevation of privilege, windows graphics component elevation of privilege, elevation privilege
CVE-2019-14330: An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
Key phrases: stored xss
CVE-2019-14331: An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
Key phrases: stored xss
CVE-2019-14332: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is use of weak ciphers for SSH such as diffie-hellman-group1-sha1.
Key phrases: weak ciphers
CVE-2019-14333: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi.
Key phrases: pre-authenticated denial of service, long action parameter
CVE-2019-14334: An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private Key extraction through an insecure sslcert-get.cgi HTTP command.
Key phrases: post-authenticated certificate and rsa private key extraction, insecure sslcert-get.cgi http command
CVE-2019-14335: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of the AP via the admin.cgi?action=%s URI.
Key phrases: post-authenticated denial of service, reboot of the ap
CVE-2019-14336: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request.
Key phrases: post-authenticated dump, insecure http request
CVE-2019-14337: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command line interface, as demonstrated by the `/bin/sh -c wget` sequence.
Key phrases: escape
CVE-2019-14338: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface.
Key phrases: post-authentication admin.cgi?action= xss
CVE-2019-14339: The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data data access. This allows an attacker's malicious application to obtain sensitive information including factory passwords for the administrator web interface and WPA2-PSK key.
Key phrases: obtain sensitive information, obtain sensitive information including factory passwords for the
CVE-2019-1434: An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1393, CVE-2019-1394, CVE-2019-1395, CVE-2019-1396, CVE-2019-1408.
Key phrases: elevation of privilege, elevation privilege
CVE-2019-14343: TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.
Key phrases: xss
CVE-2019-14344: TemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI.
Key phrases: xss
CVE-2019-14345: TemaTres 3.0 allows remote unprivileged users to create an administrator account
Key phrases: create an administrator account
CVE-2019-14346: Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password.
Key phrases: change a user password, admin config csrf
CVE-2019-14347: Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add, as demonstrated by a Python PoC script.
Key phrases: create an administrator account via admin/user
CVE-2019-14348: The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.
Key phrases: steal, sql injection
CVE-2019-14349: EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user opens a page of any profile with this.
Key phrases: stored xss
CVE-2019-1435: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1433, CVE-2019-1437, CVE-2019-1438.
Key phrases: elevation of privilege, windows graphics component elevation of privilege, elevation privilege
CVE-2019-14350: EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation.
Key phrases: stored xss
CVE-2019-14351: EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters.
Key phrases: user password hash enumeration
CVE-2019-14352: In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists, as demonstrated by jw/web/userview/crm_community/crm_userview_sales/_/account_new with the Account ID or Account Name field. NOTE: the vendor disputes the relevance of this finding because CSV is not the intended export format for spreadsheet applications
Key phrases: csv injection, formula injection
CVE-2019-14353: On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: this CVE applies exclusively to the Trezor One, and does not refer to any issues with OLED displays on other devices.
Key phrases: leverage this behavior to recover confidential secrets such, side channel
CVE-2019-14354: On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.
Key phrases: leverage this behavior to recover confidential secrets such, side channel
CVE-2019-14355: On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover secret data shown on the display. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is "insignificant risk.
Key phrases: leverage this behavior to recover secret data shown, side channel, hardware implant
CVE-2019-14356: On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: At Coinkite, weve already mitigated it, even though we feel strongly that it is not a legitimate issue. In our opinion, it is both unproven (might not even work) and also completely impracticaleven if it could be made to work perfectly
Key phrases: leverage this behavior to recover confidential secrets such, side channel
CVE-2019-14357: On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that an attack is not "realistically implementable.
Key phrases: leverage this behavior to recover confidential secrets such, side channel, hardware implant
CVE-2019-14358: On Archos Safe-T devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.
Key phrases: leverage this behavior to recover confidential secrets such, side channel
CVE-2019-14359: On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover a data value. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is no security impact: the only potentially leaked information is the number of characters in the PIN
Key phrases: leverage this behavior to recover a data value, side channel, hardware implant, leak information
CVE-2019-1436: An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1440.
Key phrases: information disclosure
CVE-2019-14360: On Hyundai Pay Kasse HK-1000 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.
Key phrases: leverage this behavior to recover confidential secrets such, side channel
CVE-2019-14362: Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value.
Key phrases: replace a file on the server via the, directory traversal
CVE-2019-14363: A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.18_1.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet.
Key phrases: execute arbitrary code, remotely execute arbitrary code via a crafted UPnP, stack-based buffer overflow, stack based buffer overflow
CVE-2019-14364: An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
Key phrases: inject malicious JavaScript code through a publicly available, xss
CVE-2019-14365: The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
Key phrases: obtain a lot of information, slack access token
CVE-2019-14366: WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
Key phrases: obtain a lot of information, slack access token
CVE-2019-14367: Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
Key phrases: obtain a lot of information, slack access token
CVE-2019-14368: Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetadata() in rafimage.cpp.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2019-14369: Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file.
Key phrases: denial of service (heap-based buffer over-read), cause a denial of service (heap-, buffer over read
CVE-2019-1437: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1433, CVE-2019-1435, CVE-2019-1438.
Key phrases: elevation of privilege, windows graphics component elevation of privilege, elevation privilege
CVE-2019-14370: In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service.
Key phrases: out-of-bounds read, denial of service, out of bounds read
CVE-2019-14371: An issue was discovered in Libav 12.3. There is an infinite loop in the function mov_probe in the file libavformat/mov.c, related to offset and tag.
Key phrases: infinite loop
CVE-2019-14372: In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.
Key phrases: infinite loop
CVE-2019-14373: An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a heap-based buffer over-read in libpng via a crafted flif file.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2019-14378: ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2019-14379: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Key phrases: remote code execution
CVE-2019-1438: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1433, CVE-2019-1435, CVE-2019-1437.
Key phrases: elevation of privilege, windows graphics component elevation of privilege, elevation privilege
CVE-2019-14380: libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
Key phrases: an out-of-bounds read in, crash, out of bounds read
CVE-2019-14381: libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.
Key phrases: a NULL pointer dereference when doing a portamento, null pointer dereference, crash
CVE-2019-14382: DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
Key phrases: an assertion failure during file parsing with debug
CVE-2019-14383: J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
Key phrases: an assertion failure during file parsing with debug
CVE-2019-14386: cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
Key phrases: xss
CVE-2019-14387: cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
Key phrases: self xss
CVE-2019-14388: cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).
Key phrases: unauthenticated file creation because Exim log parsing is
CVE-2019-14389: cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).
Key phrases: discover the MySQL root password (SEC-510)
CVE-2019-1439: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.
Key phrases: information disclosure, windows gdi information disclosure
CVE-2019-14390: cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
Key phrases: xss
CVE-2019-14391: cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
CVE-2019-14392: cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).
Key phrases: remote code execution by a demo account because
CVE-2019-14393: cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
Key phrases: local code execution in the context of a, insecure cpphp execution
CVE-2019-14394: cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).
Key phrases: unsafe file operations in the context of the
CVE-2019-14395: cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
Key phrases: world-readable permissions
CVE-2019-14396: API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
Key phrases: spoofed insertions of log data (SEC-495), spoofing
CVE-2019-14397: cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
Key phrases: modify arbitrary files, modify arbitrary files via the extractfile API1 call
CVE-2019-14398: cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).
Key phrases: execute arbitrary code, execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498)
CVE-2019-14399: The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).
Key phrases: unsafe file operations in the context of the
CVE-2019-1440: An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1436.
Key phrases: information disclosure
CVE-2019-14400: cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
Key phrases: escalate to root access because of userdata cache, userdata cache misparsing
CVE-2019-14401: cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).
Key phrases: code execution via an addforward API1 call (
CVE-2019-14402: cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).
CVE-2019-14403: cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).
Key phrases: open mail relay
CVE-2019-14404: cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).
Key phrases: certain file-read operations in the context, file read
CVE-2019-14405: cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
Key phrases: execute code via securitypolicy.cg (SEC-487)
CVE-2019-14406: cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
Key phrases: xss
CVE-2019-14407: cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).
CVE-2019-14408: cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).
Key phrases: link with an OpenID provider (SEC-460)
CVE-2019-14409: cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
Key phrases: allows arbitrary file, arbitrary file-read operations via Passenger adminbin, arbitrary file read
CVE-2019-1441: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'.
Key phrases: remote code execution
CVE-2019-14410: Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
Key phrases: format-string injection in the Email store_filter
CVE-2019-14411: cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
Key phrases: to write files
CVE-2019-14412: Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).
Key phrases: format-string injection in the DCV check_domains_via_dns
CVE-2019-14413: cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).
Key phrases: certain file-write operations as shared users, file write
CVE-2019-14414: In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).
Key phrases: userdata cache temporary file
CVE-2019-14415: An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that an attacker has access to.
Key phrases: inject malicious script into another user's browser, cross-site scripting (xss)
CVE-2019-14416: An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to resiliency plans and custom script functionality.
Key phrases: execute commands with root privilege within the VRP, arbitrary command execution, arbitrary commands
CVE-2019-14417: An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to DNS functionality.
Key phrases: execute commands with root privilege within the VRP, arbitrary command execution, arbitrary commands
CVE-2019-14418: An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existing files to take control of the VRP virtual machine.
Key phrases: overwrite any file in the VRP virtual machine, directory traversal
CVE-2019-1442: A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.
Key phrases: security feature bypass, microsoft office security feature bypass, feature bypass,
CVE-2019-14422: An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel workbooks, which could be used to open remote workbooks without protection from macro security settings to execute arbitrary code. A tsvncmd:command:diff?path:[file1]?path2:[file2] URI will execute a customised diff on [file1] and [file2] based on the file extension. For xls files, it will execute the script diff-xls.js using wscript, which will open the two files for analysis without any macro security warning. An attacker can exploit this by putting a macro virus in a network drive, and force the victim to open the workbooks and execute the macro inside.
Key phrases: execute arbitrary code, open remote workbooks without protection from macro security, macro virus
CVE-2019-14423: A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request.
Key phrases: execute system commands as root remotely via a, remote code execution (rce)
CVE-2019-14424: A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request.
Key phrases: read sensitive files via a simple HTTP Request, local file inclusion (lfi)
CVE-2019-14427: XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code.
Key phrases: xss
CVE-2019-1443: An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The security update addresses the vulnerability by correcting how SharePoint checks file content., aka 'Microsoft SharePoint Information Disclosure Vulnerability'.
Key phrases: obtain SMB hashes.The security update addresses, information disclosure
CVE-2019-14430: plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.
Key phrases: SQL Injection, sql injection
CVE-2019-14431: In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Code Execution in parseSSLHandshake in sslDecode.c. During processing of a crafted packet, the server mishandles the fragment length value provided in the DTLS message.
Key phrases: heap-based buffer overflow, remote code execution, heap based buffer overflow
CVE-2019-14432: Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either malicious JavaScript in a browser or hosts on the same network, during periods in which a user is recording a video with the application. The same attack vector can be used to crash the application at any time.
Key phrases: crash the application at any time, incorrect authentication, remote code execution, attack vector
CVE-2019-14433: An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.