rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-19080 
An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T18:00:00.000Z
CVE-2018-19081 
An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to execute arbitrary OS commands via the IPv4Address field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T18:00:00.000Z
CVE-2018-19082 
An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to conduct stack-based buffer overflow attacks via the IPv4Address field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T18:00:00.000Z
CVE-2018-19083 
WeCenter 3.2.0 through 3.2.2 has XSS in the views/default/question/index.tpl.html htmlspecialchars_decode function via the /?/publish/ajax/publish_question/ question_content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T18:00:00.000Z
CVE-2018-19084 
RegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0x8006E05C with a size larger than 8 bytes. This can lead to denial of service or code execution with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-10T03:00:00.000Z
CVE-2018-19085 
RegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0x8006E048 with a size larger than 8 bytes. This can lead to denial of service or code execution with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-10T03:00:00.000Z
CVE-2018-19086 
RegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0x8006E040 with a size larger than 8 bytes. This can lead to denial of service or code execution with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-10T03:00:00.000Z
CVE-2018-19087 
RegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0x8006E044 with a size larger than 8 bytes. This can lead to denial of service or code execution with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-10T03:00:00.000Z
CVE-2018-19089 
tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\user_list.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T19:00:00.000Z
CVE-2018-19090 
tianti 2.3 has stored XSS in the article management module via an article title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T19:00:00.000Z
CVE-2018-19091 
tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T19:00:00.000Z
CVE-2018-19092 
An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T19:00:00.000Z
CVE-2018-19093 
An issue has been found in libIEC61850 v1.3. It is a SEGV in ControlObjectClient_setCommandTerminationHandler in client/client_control.c. NOTE: the software maintainer disputes this because it requires incorrect usage of the client_example_control program
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T19:00:00.000Z
CVE-2018-19104 
In BageCMS 3.1.3, upload/index.php has a CSRF vulnerability that can be used to upload arbitrary files and get server privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T08:00:00.000Z
CVE-2018-19105 
LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T08:00:00.000Z
CVE-2018-19106 
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-20T01:00:00.000Z
CVE-2018-19107 
In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer over-read) caused by an integer overflow via a crafted PSD image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T00:00:00.000Z
CVE-2018-19108 
In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T00:00:00.000Z
CVE-2018-19109 
tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T08:00:00.000Z
CVE-2018-19110 
The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T08:00:00.000Z
CVE-2018-19111 
The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the Unity 3D Stats web site, as demonstrated by device make, model, and OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T08:00:00.000Z
CVE-2018-19113 
The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\Users:(I)(F)" permissions for the "%PROGRAMFILES(X86)%\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe" file, which allows local users to gain privileges via a Trojan horse PronestorHealthMonitor.exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-01T20:09:53.000Z
CVE-2018-19114 
An issue was discovered in MinDoc through v1.0.2. It allows attackers to gain privileges by uploading an image file with contents that represent an admin session, and then sending a Cookie: header with a mindoc_id value containing the relative pathname of this uploaded file. For example, the mindoc_id (aka session ID) could be of the form aa/../../uploads/blog/201811/attach_#.jpg where '#' is a hex value displayed in the upload field of a manage/blogs/edit/ screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T18:00:00.000Z
CVE-2018-19115 
keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-08T20:00:00.000Z
CVE-2018-19118 
Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T19:00:00.000Z
CVE-2018-19120 
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-29T21:00:00.000Z
CVE-2018-19121 
An issue has been found in libIEC61850 v1.3. It is a SEGV in Ethernet_receivePacket in ethernet_bsd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19122 
An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in Ethernet_sendPacket in ethernet_bsd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19124 
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19125 
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19126 
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19127 
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T12:00:00.000Z
CVE-2018-19128 
In Libav 12.3, there is a heap-based buffer over-read in decode_frame in libavcodec/lcldec.c that allows an attacker to cause denial-of-service via a crafted avi file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19129 
In Libav 12.3, a NULL pointer dereference (RIP points to zero) issue in ff_mpa_synth_filter_float in libavcodec/mpegaudiodsp_template.c can cause a segmentation fault (application crash) via a crafted mov file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19130 
In Libav 12.3, there is an invalid memory access in vc1_decode_frame in libavcodec/vc1dec.c that allows attackers to cause a denial-of-service via a crafted aac file. NOTE: This may be a duplicate of CVE-2017-17127
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19131 
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19132 
Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19133 
In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T11:00:00.000Z
CVE-2018-19134 
In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-19135 
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the "/assets/files" directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T04:00:00.000Z
CVE-2018-19136 
DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T19:00:00.000Z
CVE-2018-19137 
DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T19:00:00.000Z
CVE-2018-19138 
WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T21:00:00.000Z
CVE-2018-19139 
An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T21:00:00.000Z
CVE-2018-19141 
Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T05:00:00.000Z
CVE-2018-19142 
Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T05:00:00.000Z
CVE-2018-19143 
Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T05:00:00.000Z
CVE-2018-19145 
An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-09T23:00:00.000Z
CVE-2018-19146 
Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:53:48.000Z
CVE-2018-19148 
Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Host header) permit full enumeration of all certificates on the server. This generally permits an attacker to easily and accurately discover the existence of and relationships among hostnames that weren't meant to be public, though this information could likely have been discovered via other methods with additional effort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-10T19:00:00.000Z
CVE-2018-19149 
Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-10T19:00:00.000Z
CVE-2018-19150 
Memory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of a "Data from Faulting Address controls Code Flow" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-10T19:00:00.000Z
CVE-2018-19151 
qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-29T19:51:54.000Z
CVE-2018-19152 
emercoin through 0.7 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:04:01.000Z
CVE-2018-19153 
particl through 0.17 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:05:10.000Z
CVE-2018-19154 
HTMLCOIN through 2.12 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:05:48.000Z
CVE-2018-19155 
navcoin through 4.3.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:06:21.000Z
CVE-2018-19156 
PIVX through 3.1.03 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:07:16.000Z
CVE-2018-19157 
Phore through 1.3.3.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:08:06.000Z
CVE-2018-19158 
ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T21:22:48.000Z
CVE-2018-19159 
lux through 5.2.2 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:09:09.000Z
CVE-2018-19160 
Diamond through 3.0.1.2 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:09:51.000Z
CVE-2018-19161 
alqo through 4.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:10:35.000Z
CVE-2018-19162 
Divi through 4.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:11:21.000Z
CVE-2018-19163 
stratisX through 2.0.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:12:07.000Z
CVE-2018-19164 
reddcoin through 2.1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:12:49.000Z
CVE-2018-19165 
neblio through 1.5.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:13:54.000Z
CVE-2018-19166 
peercoin through 0.6.4 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:14:36.000Z
CVE-2018-19167 
CloakCoin through 2.2.2.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. The attacker sends invalid headers/blocks, which are stored on the victim's disk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T20:15:19.000Z
CVE-2018-19168 
Shell Metacharacter Injection in www/modules/save.php in FruityWifi (aka PatatasFritas/PatataWifi) through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted mod_name parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T00:00:00.000Z