rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-12710 Cisco Unified Communications Manager SQL Injection Vulnerability
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an authenticated, remote attacker to impact the confidentiality of an affected system by executing arbitrary SQL queries. The vulnerability exists because the affected software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted requests that contain malicious SQL statements to the affected application. A successful exploit could allow the attacker to determine the presence of certain values in the database, impacting the confidentiality of the system.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Cisco
product: Cisco Unified Communications Manager
Published: 2019-10-02T19:06:51.506Z
CVE-2019-12711 Cisco Unified Communications Manager XML External Expansion Vulnerability
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to an affected system that contain references in XML entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.
Problem types: cwe_id: CWE-611
description: CWE-611
Affected products: vendor: Cisco
product: Cisco Unified Communications Manager
Published: 2019-10-02T19:06:51.989Z
CVE-2019-12712 Cisco Prime Infrastructure Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input in multiple sections of the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Prime Infrastructure
Published: 2019-10-02T19:06:52.421Z
CVE-2019-12713 Cisco Prime Infrastructure Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Prime Infrastructure
Published: 2019-10-02T19:06:52.915Z
CVE-2019-12714 Cisco IC3000 Industrial Compute Gateway Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco IC3000 Industrial Compute Gateway could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the affected software improperly manages system resources. An attacker could exploit this vulnerability by opening a large number of simultaneous sessions on the web-based management interface of an affected device. A successful exploit could allow the attacker to cause a DoS condition of the web-based management interface, preventing normal management operations.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco IC3000 Industrial Compute Gateway
Published: 2019-10-02T19:06:53.407Z
CVE-2019-12715 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Unified Communications Manager
Published: 2019-10-02T19:06:53.890Z
CVE-2019-12716 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Unified Communications Manager
Published: 2019-10-02T19:06:54.369Z
CVE-2019-12717 Cisco NX-OS Software Virtualization Manager Command Injection Vulnerability
A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. The vulnerability is due to insufficient validation of arguments passed to a specific VMAN CLI command on an affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges, which may lead to complete system compromise. An attacker would need valid administrator credentials to exploit this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: Cisco
product: Cisco NX-OS Software 5.0(3)A1(1)
Published: 2019-09-25T20:16:02.660Z
CVE-2019-12718 Cisco Small Business Smart and Managed Switches Cross-Site Scripting Vulnerability
A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and subsequently access a specific web interface page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Small Business 200 Series Smart Switches
Published: 2019-10-16T18:36:30.481Z
CVE-2019-12719 
An issue was discovered in Picture_Manage_mvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an incorrect access control vulnerability that can allow an unauthenticated user to upload files via a modified authority parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T18:23:26.000Z
CVE-2019-12720 
AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the attacker to read privileged data. This also affects the picture_manage_mvc.aspx plant_no parameter, the swapdl_mvc.aspx plant_no parameter, and the account_management.aspx Text_Postal_Code and Text_Dis_Code parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T18:26:14.000Z
CVE-2019-12723 
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T12:48:45.000Z
CVE-2019-12724 
An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST['name'] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T13:56:01.000Z
CVE-2019-12725 
Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T22:17:52.000Z
CVE-2019-12727 
On Ubiquiti airCam 3.1.4 devices, a Denial of Service vulnerability exists in the RTSP Service provided by the ubnt-streamer binary. The issue can be triggered via malformed RTSP requests that lead to an invalid memory read. To exploit the vulnerability, an attacker must craft an RTSP request with a large number of headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-04T12:18:29.000Z
CVE-2019-12728 
Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-04T12:41:49.000Z
CVE-2019-12730 
aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-04T13:14:23.000Z
CVE-2019-12731 
The Windows versions of Snapview Mikogo, versions before 5.10.2 are affected by insecure implementations which allow local attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-12T16:23:45.000Z
CVE-2019-12732 
The Chartkick gem through 3.1.0 for Ruby allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T14:54:18.000Z
CVE-2019-12733 
SiteVision 4 allows Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T16:46:32.000Z
CVE-2019-12734 
SiteVision 4 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T16:47:28.000Z
CVE-2019-12735 
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T13:07:48.000Z
CVE-2019-12736 
JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T18:48:50.000Z
CVE-2019-12737 
UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T18:47:48.000Z
CVE-2019-12739 
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T13:57:32.000Z
CVE-2019-12741 
XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T14:58:44.000Z
CVE-2019-12742 
Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T15:20:35.000Z
CVE-2019-12743 
HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T15:23:27.000Z
CVE-2019-12744 
SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T16:26:15.000Z
CVE-2019-12745 
out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T16:29:24.000Z
CVE-2019-12746 
An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T00:00:00.000Z
CVE-2019-12747 
TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T14:13:24.000Z
CVE-2019-12748 
TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T14:22:00.000Z
CVE-2019-12749 
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T16:11:45.000Z
CVE-2019-12750 
Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c (12.1.7491.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection, Symantec Endpoint Protection Small Business Edition
Published: 2019-07-31T17:42:08.000Z
CVE-2019-12751 
Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Messaging Gateway
Published: 2019-07-11T20:01:31.000Z
CVE-2019-12752 
The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circumvent the existing tamper protection in use on the resident system.
Problem types: description: Tamper Protection Bypass
Affected products: vendor: Symantec
product: SONAR Component
Published: 2019-11-01T15:03:54.000Z
CVE-2019-12753 
An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authenticated administrator user to obtain passwords for external SMTP, FTP, FTPS, LDAP, and Cloud Log Download servers that they might not otherwise be authorized to access. The malicious administrator user can also obtain the passwords of other Reporter web UI users.
Problem types: description: Information disclosure
Affected products: vendor: Symantec Corporation
product: Symantec Reporter
Published: 2019-08-29T22:40:19.000Z
CVE-2019-12754 
Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users or potentially bypass access controls such as the same-origin policy.
Problem types: description: Cross-site scripting
Affected products: vendor: Symantec Corporation
product: My VIP Portal
Published: 2019-08-29T22:27:48.000Z
CVE-2019-12755 
Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.
Problem types: description: Information Disclosure
Affected products: vendor: Symantec Corporation
product: Norton Password Manager
Published: 2019-09-17T15:49:23.000Z
CVE-2019-12756 
Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondary layer of password protection could by bypassed for individuals with local administrator rights.
Problem types: description: Password Protection Bypass
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP)
Published: 2019-11-15T16:58:23.000Z
CVE-2019-12757 
Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to 12.1 RU6 MP10d (12.1.7510.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection (SEP), Symantec Endpoint Protection Small Business Edition (SEP SBE)
Published: 2019-11-15T17:37:31.000Z
CVE-2019-12758 
Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code without a resident proper digital signature.
Problem types: description: Unsigned Code Execution
Affected products: vendor: n/a
product: Symantec Endpoint Protection
Published: 2019-11-15T17:37:43.000Z
CVE-2019-12759 
Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager (SEPM), Symantec Mail Security for MS Exchange (SMSMSE)
Published: 2019-11-15T17:41:24.000Z
CVE-2019-12760 
A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T18:55:03.000Z
CVE-2019-12761 
A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T18:55:27.000Z
CVE-2019-12762 
Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kHz, as demonstrated by a transmitter and antenna hidden just beneath the surface of a coffee-shop table, aka Ghost Touch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T19:45:22.000Z
CVE-2019-12763 
The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external data storage, which is readable by any application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T11:32:53.000Z
CVE-2019-12764 
An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T18:33:22.000Z