rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-5174 
In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and will not show any UI. Files that are unknown and potentially dangerous will be allowed to run because SmartScreen will not prompt the user for a decision, and if the user is offline all files will be allowed to be opened because Windows won't prompt the user to ask what to do. Firefox incorrectly sets this flag when downloading files, leading to less secure behavior from SmartScreen. Note: this issue only affects Windows 10 users running the April 2018 update or later. It does not affect other Windows users or other operating systems. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.
Problem types: description: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5175 
A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the "require.js" library that is part of Firefox's Developer Tools, and then use a known technique using that library to bypass the CSP restrictions on executing injected scripts. This vulnerability affects Firefox < 60.
Problem types: description: Universal CSP bypass on sites using strict-dynamic in their policies
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5176 
The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60.
Problem types: description: JSON Viewer script injection
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5177 
A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. This vulnerability affects Firefox < 60.
Problem types: description: Buffer overflow in XSLT during number formatting
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5178 
A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8.
Problem types: description: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension
Affected products: vendor: Mozilla
product: Thunderbird ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5179 
A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60.
Problem types: description: Covert Channel
Affected products: vendor: n/a
product: Firefox
Published: 2019-04-26T13:55:13.000Z
CVE-2018-5180 
A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. This vulnerability affects Firefox < 60.
Problem types: description: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5181 
If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with the "noopener" keyword. This vulnerability affects Firefox < 60.
Problem types: description: Local file can be displayed in noopener tab through drag and drop of hyperlink
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5182 
If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60.
Problem types: description: Local file can be displayed from hyperlink dragged and dropped on addressbar
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5183 
Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes during graphic operations. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8.
Problem types: description: Backport critical security fixes in Skia
Affected products: vendor: Mozilla
product: Thunderbird ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5184 
Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
Problem types: description: Full plaintext recovery in S/MIME via chosen-ciphertext attack
Affected products: vendor: Mozilla
product: Thunderbird ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5185 
Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
Problem types: description: Leaking plaintext through HTML forms
Affected products: vendor: Mozilla
product: Thunderbird ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2018-5186 
Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 61.
Problem types: description: Memory safety bugs fixed in Firefox 61
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-10-18T13:00:00.000Z
CVE-2018-5187 
Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.
Problem types: description: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Thunderbird 60
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-10-18T13:00:00.000Z
CVE-2018-5188 
Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Problem types: description: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-10-18T13:00:00.000Z
CVE-2018-5189 
Race condition in Jungo Windriver 12.5.1 allows local users to cause a denial of service (buffer overflow) or gain system privileges by flipping pool buffer size, aka a "double fetch" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2018-5190 
PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_head.php, pc_login.php, and pc_login_page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-17T13:00:00.000Z
CVE-2018-5195 
Hancom NEO versions 9.6.1.5183 and earlier have a buffer Overflow vulnerability that leads remote attackers to execute arbitrary commands when performing the hyperlink Attributes in document.
Problem types: description: buffer Overflow
Affected products: vendor: Hancom
product: Hancom office Hword NEO
Published: 2018-01-17T17:00:00.000Z
CVE-2018-5196 Alzip Stack Overflow Vulnerability
Alzip 10.76.0.0 and earlier is vulnerable to a stack overflow caused by improper bounds checking. By persuading a victim to open a specially-crafted LZH archive file, a attacker could execute arbitrary code execution.
Problem types: description: Stack based overflow
Affected products: vendor: Estsoft
product: Alzip
Published: 2018-12-21T15:00:00.000Z
CVE-2018-5197 
A vulnerability in the ExtCommon.dll user extension module version 9.2, 9.2.1, 9.2.2 of Xplatform ActiveX could allow attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command parameters. An crafted malicious parameters could cause arbitrary command to execute.
Problem types: description: Command Injection
Affected products: vendor: TOBESOFT
product: XPLATFORM ActiveX
Published: 2019-01-02T14:00:00.000Z
CVE-2018-5198 WIZVERA Veraport Race Condition Vulnerability
In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results in remote code execution.
Problem types: description: Race Condition
Affected products: vendor: WIZVERA
product: Veraport
Published: 2018-12-20T14:00:00.000Z
CVE-2018-5199 WIZVERA Remote Code Execution Vulnerability
In Veraport G3 ALL on MacOS, due to insufficient domain validation, It is possible to overwrite installation file to malicious file. A remote unauthenticated attacker may use this vulnerability to execute arbitrary file.
Problem types: description: Remote Code Execution
Affected products: vendor: WIZVERA
product: Veraport
Published: 2018-12-20T14:00:00.000Z
CVE-2018-5200 KMPlayer Heap Overflow Vulnerability
KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more frame data is copied to heap memory than the size specified in the frame header. This results in a memory corruption and remote code execution.
Problem types: description: Heap based overflow
Affected products: vendor: Pandora.tv
product: KMPlayer
Published: 2018-12-20T14:00:00.000Z
CVE-2018-5201 
Hancom Office 2018 10.0.0.8214 and earlier, Hancom Office NEO 9.6.1.10472 and earlier, Hancom Office 2014 9.1.1.4540 and earlier, Hancom Office 2010 8.5.8.1724 and earlier versions have a heap overflow vulnerability when handling Compound File in document. This result in a program crash or denial of service conditions.
Problem types: description: Heap overflow
Affected products: vendor: HANCOM
product: Hancom Office
Published: 2018-12-21T16:00:00.000Z
CVE-2018-5202 
SKCertService 2.5.5 and earlier contains a vulnerability that could allow remote attacker to execute arbitrary code. This vulnerability exists due to the way .dll files are loaded by SKCertService. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge.
Problem types: description: Remote code execution
Affected products: vendor: SIGNKOREA
product: SKCertService
Published: 2018-12-21T16:00:00.000Z
CVE-2018-5203 
DEXTUploadX5 version Between 1.0.0.0 and 2.2.0.0 contains a vulnerability that could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. this can be leveraged for code execution.
Problem types: description: file download and execution
Affected products: vendor: Devpia
product: DEXTUploadX5
Published: 2018-12-28T16:00:00.000Z
CVE-2018-5204 
ML Report version Between 2.00.000.0000 and 2.18.628.5980 contains a vulnerability that could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. this can be leveraged for code execution.
Problem types: description: file download and execution
Affected products: vendor: Infraware
product: ML Report
Published: 2018-12-28T16:00:00.000Z
CVE-2018-5205 
When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-06T16:00:00.000Z
CVE-2018-5206 
When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-06T16:00:00.000Z
CVE-2018-5207 
When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-06T16:00:00.000Z
CVE-2018-5208 
In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-06T16:00:00.000Z
CVE-2018-5210 
On Samsung mobile devices with N(7.x) software and Exynos chipsets, attackers can conduct a Trustlet stack overflow attack for arbitrary TEE code execution, in conjunction with a brute-force attack to discover unlock information (PIN, password, or pattern). The Samsung ID is SVE-2017-10733.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T06:00:00.000Z
CVE-2018-5211 
PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T16:00:00.000Z
CVE-2018-5212 
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T18:00:00.000Z
CVE-2018-5213 
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T18:00:00.000Z
CVE-2018-5214 
The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T18:00:00.000Z
CVE-2018-5215 
Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T19:00:00.000Z
CVE-2018-5216 
Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T19:00:00.000Z
CVE-2018-5217 
In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x95002578.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T19:00:00.000Z
CVE-2018-5218 
In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x950025b0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T19:00:00.000Z
CVE-2018-5219 
In K7 Antivirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83002168.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T19:00:00.000Z
CVE-2018-5220 
In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x95002610.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T19:00:00.000Z
CVE-2018-5221 
Multiple buffer overflows in BarCodeWiz BarCode before 6.7 ActiveX control (BarcodeWiz.DLL) allow remote attackers to execute arbitrary code via a long argument to the (1) BottomText or (2) TopText property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T16:00:00.000Z
CVE-2018-5223 
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
Problem types: description: Argument Injection
Affected products: vendor: Atlassian
product: Fisheye and Crucible
Published: 2018-03-29T13:00:00.000Z
CVE-2018-5224 
Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan in Bamboo that has a non-linked Mercurial repository, or create a plan in Bamboo either globally or in a project using Bamboo Specs can can execute code of their choice on systems that run a vulnerable version of Bamboo on the Windows operating system. All versions of Bamboo starting with 2.7.0 before 6.3.3 (the fixed version for 6.3.x) and from version 6.4.0 before 6.4.1 (the fixed version for 6.4.x) running on the Windows operating system are affected by this vulnerability.
Problem types: description: Argument Injection
Affected products: vendor: Atlassian
product: Bamboo
Published: 2018-03-29T13:00:00.000Z
CVE-2018-5225 
In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.
Problem types: description: n/a
Affected products: vendor: Atlassian
product: Bitbucket Server
Published: 2018-03-22T13:00:00.000Z
CVE-2018-5226 
There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. All versions of Sourcetree for Windows before 2.5.5.0 are affected by this vulnerability.
Problem types: description: OS Command Injection
Affected products: vendor: Atlassian
product: SourceTree Windows
Published: 2018-04-25T21:00:00.000Z
CVE-2018-5227 
Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the display url of a configured application link.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Atlassian Application Links
Published: 2018-04-10T13:00:00.000Z
CVE-2018-5228 
The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Fisheye and Crucible
Published: 2018-04-24T12:00:00.000Z
CVE-2018-5229 
The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of user submitted add-on names.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Universal Plugin Manager
Published: 2018-07-16T13:00:00.000Z
CVE-2018-5230 
The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira
Published: 2018-05-14T13:00:00.000Z
CVE-2018-5231 
The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to perform a denial of service attack via sending requests to it.
Problem types: description: Denial of Service
Affected products: vendor: Atlassian
product: Jira
Published: 2018-05-16T13:00:00.000Z
CVE-2018-5232 
The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuetype parameter.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira
Published: 2018-07-18T14:00:00.000Z
CVE-2018-5233 
Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T21:00:00.000Z
CVE-2018-5234 
The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in which the goal is execution of arbitrary commands on the host system via vulnerable software.
Problem types: description: CMD Injection
Affected products: vendor: Symantec Corporation
product: Norton Core
Published: 2018-04-30T18:00:00.000Z