rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-14498 
A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted CAF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T17:35:50.000Z
CVE-2019-14510 
An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client is a Domain Controller, the FSAdminxxxxxxxxx account is created as a domain account and automatically added as a member of the domain BUILTIN\Administrators group. Using the well known Pass-the-Hash techniques, an attacker can use the same FSAdminxxxxxxxxx hash from any LAN Cache client and pass this to a Domain Controller, providing administrative rights to the attacker on any Domain Controller. (Local account Pass-the-Hash mitigations do not protect domain accounts.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T11:44:18.000Z
CVE-2019-14511 
Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T12:26:41.000Z
CVE-2019-14512 
LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T14:43:38.000Z
CVE-2019-14513 
Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T20:47:48.000Z
CVE-2019-14514 
An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T21:52:56.000Z
CVE-2019-14516 
The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs or Help.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T13:36:32.000Z
CVE-2019-14517 
pandao Editor.md 1.5.0 allows XSS via the Javas&#99;ript: string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T22:04:02.000Z
CVE-2019-14518 
Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T15:51:30.000Z
CVE-2019-14521 
The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T11:30:56.000Z
CVE-2019-14523 
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T11:18:28.000Z
CVE-2019-14524 
An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than CVE-2019-14465.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T11:18:12.000Z
CVE-2019-14525 
In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T11:22:30.000Z
CVE-2019-14526 
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entirely bypasses the intended security benefits of the use of a CSRF-protection token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T20:50:12.000Z
CVE-2019-14527 
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T20:51:37.000Z
CVE-2019-14528 
GnuCOBOL 2.2 has a heap-based buffer overflow in read_literal in cobc/scanner.l via crafted COBOL source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T13:25:20.000Z
CVE-2019-14529 
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T13:46:30.000Z
CVE-2019-14530 
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T13:32:30.000Z
CVE-2019-14531 
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System Use Sharing Protocol data in fs/iso9660.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T14:07:51.000Z
CVE-2019-14532 
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T14:07:40.000Z
CVE-2019-14533 
The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T18:43:45.000Z
CVE-2019-14534 
In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T18:41:33.000Z
CVE-2019-14535 
A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted WMV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T17:38:30.000Z
CVE-2019-14537 
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-07T16:43:52.000Z
CVE-2019-14540 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-15T21:45:22.000Z
CVE-2019-14541 
GnuCOBOL 2.2 has a stack-based buffer overflow in cb_encode_program_id in cobc/typeck.c via crafted COBOL source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T20:10:53.000Z
CVE-2019-14544 
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T21:17:37.000Z
CVE-2019-14546 
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, which fires when the victim replies or forwards the mail, thus helping him steal victims' cookies (hence compromising their accounts).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T18:54:41.000Z
CVE-2019-14547 
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users, thus helping him steal victims' cookies (hence compromising their accounts).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T18:59:28.000Z
CVE-2019-14548 
An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside the body of the article, thus helping him steal victims' cookies (hence compromising their accounts).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T18:55:21.000Z
CVE-2019-14549 
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T18:48:46.000Z
CVE-2019-14550 
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus helping him steal victims' cookies (hence compromising their accounts).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T18:52:57.000Z
CVE-2019-14551 
Das Q before 2019-08-02 allows web sites to execute arbitrary code on client machines, as demonstrated by a cross-origin /install request with an attacker-controlled releaseUrl, which triggers download and execution of code within a ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-03T01:46:16.000Z
CVE-2019-14553 
Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2020-11-23T15:50:19.000Z
CVE-2019-14556 
Improper initialization in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel BIOS
Published: 2020-10-05T13:49:56.000Z
CVE-2019-14557 
Buffer overflow in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to potentially enable elevation of privilege or denial of service via adjacent access.
Problem types: description: Escalation of Privilege, Denial of Service
Affected products: vendor: n/a
product: Intel BIOS
Published: 2020-10-05T13:45:04.000Z
CVE-2019-14558 
Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to potentially enable denial of service via adjacent access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel BIOS
Published: 2020-10-05T13:47:37.000Z
CVE-2019-14559 
Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2020-11-23T15:50:32.000Z
CVE-2019-14562 
Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2020-11-23T15:50:41.000Z
CVE-2019-14563 
Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2020-11-23T16:11:10.000Z
CVE-2019-14565 
Insufficient initialization in Intel(R) SGX SDK Windows versions 2.4.100.51291 and earlier, and Linux versions 2.6.100.51363 and earlier, may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: Intel
product: 2019.2 IPU – Intel(R) SGX
Published: 2019-11-14T16:47:32.000Z
CVE-2019-14566 
Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: Intel
product: 2019.2 IPU – Intel(R) SGX
Published: 2019-11-14T16:46:00.000Z
CVE-2019-14568 
Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) RST
Published: 2019-12-16T19:12:14.000Z
CVE-2019-14569 
Pointer corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: Intel®
product: NUC Advisory
Published: 2019-10-11T17:57:39.000Z
CVE-2019-14570 
Memory corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: Intel®
product: NUC Advisory
Published: 2019-10-11T17:58:06.000Z
CVE-2019-14574 
Out of bounds read in a subsystem for Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: 2019.2 IPU – Intel(R) Graphics Driver for Windows* and Linux
Published: 2019-11-14T19:04:52.000Z
CVE-2019-14575 
Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2020-11-23T16:11:19.000Z
CVE-2019-14584 
Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Tianocore EDK2
Published: 2021-06-03T19:56:01.000Z
CVE-2019-14586 
Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access.
Problem types: description: escalation of privilege, information disclosure, denial of service
Affected products: vendor: n/a
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2020-11-23T16:11:27.000Z
CVE-2019-14587 
Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2020-11-23T16:15:08.000Z
CVE-2019-14590 
Improper access control in the API for the Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: 2019.2 IPU – Intel(R) Graphics Driver for Windows* and Linux
Published: 2019-11-14T19:05:12.000Z
CVE-2019-14591 
Improper input validation in the API for Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: 2019.2 IPU – Intel(R) Graphics Driver for Windows* and Linux
Published: 2019-11-14T19:05:29.000Z
CVE-2019-14596 
Improper access control in the installer for Intel(R) Chipset Device Software INF Utility before version 10.1.18 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: Intel
product: Intel(R) Chipset Device Software INF Utility
Published: 2020-01-17T17:34:47.000Z
CVE-2019-14598 
Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) CSME
Published: 2020-02-13T18:21:27.000Z
CVE-2019-14599 
Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Control Center-I
Published: 2019-12-16T19:08:04.000Z
CVE-2019-14600 
Uncontrolled search path element in the installer for Intel(R) SNMP Subagent Stand-Alone for Windows* may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel
product: Intel(R) SNMP Subagent Stand-Alone for Windows*
Published: 2020-01-17T17:33:56.000Z
CVE-2019-14601 
Improper permissions in the installer for Intel(R) RWC 3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: Intel
product: Intel(R) RWC 3 for Windows
Published: 2020-01-17T17:35:58.000Z
CVE-2019-14602 
Improper permissions in the installer for the Nuvoton* CIR Driver versions 1.02.1002 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Nuvoton* CIR Driver for Windows* 8 for Intel(R) NUC
Published: 2019-11-14T16:40:20.000Z
CVE-2019-14603 
Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel® Quartus® Prime Pro Edition
Published: 2019-12-16T19:09:07.000Z
CVE-2019-14604 
Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel® Quartus® Prime Pro Edition
Published: 2019-12-16T19:08:19.000Z
CVE-2019-14605 
Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to potentially enable escalation of privilege via local attack.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) SCS Platform Discovery Utility
Published: 2019-12-16T19:09:56.000Z
CVE-2019-14607 
Improper conditions check in multiple Intel® Processors may allow an authenticated user to potentially enable partial escalation of privilege, denial of service and/or information disclosure via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel® Processors
Published: 2019-12-16T19:10:09.000Z
CVE-2019-14608 
Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) NUC(R)
Published: 2019-12-16T19:10:34.000Z
CVE-2019-14609 
Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) NUC(R)
Published: 2019-12-16T19:11:36.000Z
CVE-2019-14610 
Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) NUC(R)
Published: 2019-12-16T19:11:14.000Z