rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-6587 
CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: CA Technologies
product: CA API Developer Portal
Published: 2018-03-29T13:00:00.000Z
CVE-2018-6588 
CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: CA Technologies
product: CA API Developer Portal
Published: 2018-03-29T13:00:00.000Z
CVE-2018-6589 
CA Spectrum 10.1 prior to 10.01.02.PTF_10.1.239 and 10.2.x prior to 10.2.3 allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: CA Technologies
product: CA Spectrum
Published: 2018-05-01T18:00:00.000Z
CVE-2018-6590 
CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: ca technologies
product: CA API Developer Portal
Published: 2018-08-03T14:00:00.000Z
CVE-2018-6591 
Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended. For example, users might have an expectation that chatroom bookmarks are private, but the various interacting software components do not necessarily make that happen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-19T14:00:00.000Z
CVE-2018-6592 
Unisys Stealth 3.3 Windows endpoints before 3.3.016.1 allow local users to gain access to Stealth-enabled devices by leveraging improper cleanup of memory used for negotiation key storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-19T19:00:00.000Z
CVE-2018-6593 
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by connecting to the filter communication port and then using IOCTL 0x8000204C to \\.\ZemanaAntiMalware to elevate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-03T18:00:00.000Z
CVE-2018-6594 
lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-03T03:00:00.000Z
CVE-2018-6596 
webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-03T21:00:00.000Z
CVE-2018-6597 
The Alcatel A30 device with a build fingerprint of TCL/5046G/MICKEY6US:7.0/NRD90M/J63:user/release-keys contains a hidden privilege escalation capability to achieve command execution as the root user. They have made modifications that allow a user with physical access to the device to obtain a root shell via ADB. Modifying the read-only properties by an app as the system user creates a UNIX domain socket named factory_test that will execute commands as the root user by processes that have privilege to access it (as per the SELinux rules that the vendor controls).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T19:00:00.000Z
CVE-2018-6598 
An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-located on the device can send an intent to factory reset the device programmatically because of com.android.server.MasterClearReceiver. This does not require any user interaction and does not require any permission to perform. A factory reset will remove all user data from the device. This will result in the loss of any data that the user has not backed up or synced externally. This capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves), although this capability is present in an unprotected component of the Android OS. This vulnerability is not present in Google's Android Open Source Project (AOSP) code. Therefore, it was introduced by Orbic or another entity in the supply chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T19:00:00.000Z
CVE-2018-6599 
An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices, allowing attackers to obtain sensitive information (such as text-message content) by reading a copy of the Android log on the SD card. The system-wide Android logs are not directly available to third-party apps since they tend to contain sensitive data. Third-party apps can read from the log but only the log messages that the app itself has written. Certain apps can leak data to the Android log due to not sanitizing log messages, which is in an insecure programming practice. Pre-installed system apps and apps that are signed with the framework key can read from the system-wide Android log. We found a pre-installed app on the Orbic Wonder that when started via an Intent will write the Android log to the SD card, also known as external storage, via com.ckt.mmitest.MmiMainActivity. Any app that requests the READ_EXTERNAL_STORAGE permission can read from the SD card. Therefore, a local app on the device can quickly start a specific component in the pre-installed system app to have the Android log written to the SD card. Therefore, any app co-located on the device with the READ_EXTERNAL_STORAGE permission can obtain the data contained within the Android log and continually monitor it and mine the log for relevant data. In addition, the default messaging app (com.android.mms) writes the body of sent and received text messages to the Android log, as well as the recipient phone number for sent text messages and the sending phone number for received text messages. In addition, any call data contains phone numbers for sent and received calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T19:00:00.000Z
CVE-2018-6603 
Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHPSESSID cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T05:00:00.000Z
CVE-2018-6604 
SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetails request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T21:00:00.000Z
CVE-2018-6605 
SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T21:00:00.000Z
CVE-2018-6606 
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by sending IOCTL 0x80002010 and then using IOCTL 0x8000204C to \\.\ZemanaAntiMalware to elevate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-04T01:00:00.000Z
CVE-2018-6608 
In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T21:00:00.000Z
CVE-2018-6609 
SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit action, or the id parameter in a statuslist (or prioritylist) edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T22:00:00.000Z
CVE-2018-6610 
Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T22:00:00.000Z
CVE-2018-6611 
soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read via a malformed STP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-04T12:00:00.000Z
CVE-2018-6612 
An integer underflow bug in the process_EXIF function of the exif.c file of jhead 3.00 raises a heap-based buffer over-read when processing a malicious JPEG file, which may allow a remote attacker to cause a denial-of-service attack or unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-04T15:00:00.000Z
CVE-2018-6616 
In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-04T22:00:00.000Z
CVE-2018-6617 
Easy Hosting Control Panel (EHCP) v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z
CVE-2018-6618 
Easy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z
CVE-2018-6619 
Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a salt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z
CVE-2018-6621 
The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T04:00:00.000Z
CVE-2018-6622 
An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2.0 specification. An abnormal case is not handled properly by this firmware while S3 sleep and can clear TPM 2.0. It allows local users to overwrite static PCRs of TPM and neutralize the security features of it, such as seal/unseal and remote attestation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-17T18:00:00.000Z
CVE-2018-6623 
An issue was discovered in Hola 1.79.859. An unprivileged user could modify or overwrite the executable with arbitrary code, which would be executed the next time the service is started. Depending on the user that the service runs as, this could result in privilege escalation. The issue exists because of the SERVICE_ALL_ACCESS access right for the hola_svc and hola_updater services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T21:00:00.000Z
CVE-2018-6624 
OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6625 
In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002010.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6626 
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000035.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6627 
In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6628 
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8000010c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6629 
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000118.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6630 
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8000014c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6631 
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110009.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000170.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6632 
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000110.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6633 
In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000038.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6634 
A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized users to maintain access to an account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T19:28:59.000Z
CVE-2018-6635 
System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T18:00:00.000Z
CVE-2018-6638 
A stack-based buffer overflow (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. This occurs in a function call in which the first argument is a corrupted offset value and the second argument is a stack buffer. This is fixed in 6.9d.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T05:00:00.000Z
CVE-2018-6639 
An out-of-bounds write (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. A size used by memmove is read from the input file. This is fixed in 6.9d.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T05:00:00.000Z
CVE-2018-6640 
A Heap Overflow (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. Crafted input can modify the next pointer of a linked list. This is fixed in 6.9d.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T05:00:00.000Z
CVE-2018-6641 
An Arbitrary Free (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. Crafted input can overwrite a structure, leading to a function call with an invalid parameter, and a subsequent free of important data such as a function pointer or list pointer. This is fixed in 6.9d.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T05:00:00.000Z
CVE-2018-6643 
Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T19:00:00.000Z
CVE-2018-6644 
SBLIM Small Footprint CIM Broker (SFCB) 1.4.9 has a null pointer (DoS) vulnerability via a crafted POST request to the /cimom URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T23:00:00.000Z
CVE-2018-6651 
In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation (accepting an arbitrary substring match) for WebSocket API requests allows remote attackers to bypass intended access restrictions. In Parsec, this means full control over the victim's computer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T22:00:00.000Z
CVE-2018-6653 
comforte SWAP 1049 through 1069 and 20.0.0 through 21.5.3 (as used in SSLOBJ on HPE NonStop SSL T0910, and in the comforte SecurCS, SecurFTP, SecurLib/SSL-AT, and SecurTN products), after executing the RELOAD CERTIFICATES command, does not ensure that clients use a strong TLS cipher suite, which makes it easier for remote attackers to defeat intended cryptographic protection mechanisms by sniffing the network. This is fixed in 21.6.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-01T00:00:00.000Z
CVE-2018-6654 
The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr_-ifr, because the exposure of these tokens is not restricted to any specific web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T01:00:00.000Z
CVE-2018-6655 
PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T21:00:00.000Z
CVE-2018-6656 
Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T14:00:00.000Z
CVE-2018-6659 SB10228 ePO Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an XSS issue via not sanitizing the user input.
Problem types: description: Reflected Cross-Site Scripting vulnerability
Affected products: vendor: McAfee
product: ePolicy Orchestrator (ePO)
Published: 2018-04-02T17:00:00.000Z
CVE-2018-6660 SB10228 ePO Directory Traversal vulnerability
Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.
Problem types: description: Directory Traversal vulnerability
Affected products: vendor: McAfee
product: ePolicy Orchestrator (ePO)
Published: 2018-04-02T13:00:00.000Z
CVE-2018-6661 TS102801 True Key DLL Side-Loading vulnerability
DLL Side-Loading vulnerability in Microsoft Windows Client in McAfee True Key before 4.20.110 allows local users to gain privilege elevation via not verifying a particular DLL file signature.
Problem types: description: DLL Side-Loading vulnerability
Affected products: vendor: McAfee
product: True Key
Published: 2018-04-02T13:00:00.000Z
CVE-2018-6662 SB10232 - McAfee Management of Native Encryption (MNE) - Privilege Escalation vulnerability
Privilege Escalation vulnerability in McAfee Management of Native Encryption (MNE) before 4.1.4 allows local users to gain elevated privileges via a crafted user input.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: McAfee
product: McAfee Management of Native Encryption (MNE)
Published: 2018-06-05T14:00:00.000Z
CVE-2018-6664 SB10233 - Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 - Application Protections Bypass vulnerability
Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility.
Problem types: description: Application Protection Bypass vulnerability
Affected products: vendor: McAfee
product: Data Loss Prevention (DLP) Endpoint
vendor: McAfee
product: Data Loss Prevention (DLP) Endpoint
Published: 2018-05-25T13:00:00.000Z
CVE-2018-6667 McAfee Web Gateway - Authentication Bypass vulnerability
Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbitrary code via Java management extensions (JMX).
Problem types: description: Authentication Bypass vulnerability
Affected products: vendor: McAfee
product: Web Gateway
Published: 2018-06-26T17:00:00.000Z
CVE-2018-6668 Bypass Application Control with simple DLL
A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell.
Problem types: description: whitelist bypass vulnerability 
Affected products: vendor: McAfee
product: Application and Change Control
Published: 2018-12-31T18:00:00.000Z
CVE-2018-6669 Bypass Application Control through an ASP.NET form
A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files through an ASP.NET form.
Problem types: description: whitelist bypass vulnerability
Affected products: vendor: McAfee
product: Application and Change Control
Published: 2018-12-20T14:00:00.000Z