rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-19289 
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T06:00:00.000Z
CVE-2018-19290 
In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack against the PHP daemon with a crafted command, resulting in a denial of service or possibly unspecified other impact, as demonstrated by the "!calc 5 x 5" command. In versions before 3.0, modules/HELPBOT_MODULE/calc.php has the vulnerable code; in 3.0 and above, modules/HELPBOT_MODULE/HelpbotController.class.php has the vulnerable code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-30T18:00:00.000Z
CVE-2018-19291 
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T06:00:00.000Z
CVE-2018-19295 
Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T15:00:00.000Z
CVE-2018-19296 
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T09:00:00.000Z
CVE-2018-19300 
On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (A1) before firmware version 1.06b03, DWR-512 (B1) before firmware version 2.02b01, DWR-711 (A1) through firmware version 1.11, DWR-712 (B1) before firmware version 2.04b01, DWR-921 (A1) before firmware version 1.02b01, and DWR-921 (B1) before firmware version 2.03b01, there exists an EXCU_SHELL file in the web directory. By sending a GET request with specially crafted headers to the /EXCU_SHELL URI, an attacker could execute arbitrary shell commands in the root context on the affected device. Other devices might be affected as well.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-11T15:22:44.000Z
CVE-2018-19301 
tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T23:00:00.000Z
CVE-2018-19311 
Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T19:00:00.000Z
CVE-2018-19312 
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T19:00:00.000Z
CVE-2018-19318 
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T19:00:00.000Z
CVE-2018-19319 
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T19:00:00.000Z
CVE-2018-19320 
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-21T23:00:00.000Z
CVE-2018-19321 
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-21T23:00:00.000Z
CVE-2018-19322 
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-21T23:00:00.000Z
CVE-2018-19323 
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-21T23:00:00.000Z
CVE-2018-19324 
kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T13:00:00.000Z
CVE-2018-19326 
Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T14:00:00.000Z
CVE-2018-19327 
An issue was discovered in JTBC(PHP) 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T15:00:00.000Z
CVE-2018-19328 
LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T15:00:00.000Z
CVE-2018-19329 
GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T15:00:00.000Z
CVE-2018-19331 
An issue was discovered in S-CMS v1.5. There is a SQL injection vulnerability in search.php via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T15:00:00.000Z
CVE-2018-19332 
An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T15:00:00.000Z
CVE-2018-19333 
pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in processes running as root (but not escape the sandbox) via vectors involving IPC_RMID shmctl calls, because reference counting is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T17:00:00.000Z
CVE-2018-19334 
Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T09:00:00.000Z
CVE-2018-19335 
Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T09:00:00.000Z
CVE-2018-19340 
Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCountry, Freight, or details parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T17:00:00.000Z
CVE-2018-19341 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader!std::basic_ostream >::operator<<+0x0000000000087906" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T21:00:00.000Z
CVE-2018-19342 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at U3DBrowser+0x000000000000347a" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T21:00:00.000Z
CVE-2018-19343 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faulting Address controls Code Flow starting at U3DBrowser!PlugInMain+0x00000000000f43ff" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T21:00:00.000Z
CVE-2018-19344 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address may be used as a return value starting at U3DBrowser!PlugInMain+0x0000000000031a75" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T21:00:00.000Z
CVE-2018-19345 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at U3DBrowser!PlugInMain+0x0000000000053f8b" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T21:00:00.000Z
CVE-2018-19346 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x00000000000d11ea" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T21:00:00.000Z
CVE-2018-19347 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x00000000000d11bb" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T21:00:00.000Z
CVE-2018-19348 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x000000000012dff5" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T21:00:00.000Z
CVE-2018-19349 
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T22:00:00.000Z
CVE-2018-19350 
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T22:00:00.000Z
CVE-2018-19351 
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-18T17:00:00.000Z
CVE-2018-19352 
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-18T17:00:00.000Z
CVE-2018-19353 
The ansilove_ansi function in loaders/ansi.c in libansilove 1.0.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-18T17:00:00.000Z
CVE-2018-19355 
modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via modules/orderfiles/upload.php with auptype equal to product (for upload destinations under modules/productfiles), order (for upload destinations under modules/files), or cart (for upload destinations under modules/cartfiles).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-19T00:00:00.000Z
CVE-2018-19357 
XMPlay 3.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted http:// URL in a .m3u file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-24T06:00:00.000Z
CVE-2018-19358 
GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used. NOTE: the vendor disputes this because, according to the security model, untrusted applications must not be allowed to access the user's session bus socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-18T19:00:00.000Z
CVE-2018-19359 
GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T20:58:09.000Z
CVE-2018-19360 
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-19361 
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-19362 
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-19364 
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T19:00:00.000Z
CVE-2018-19365 
The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T19:58:13.000Z
CVE-2018-19367 
Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T09:00:00.000Z
CVE-2018-19370 
A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-28T22:00:00.000Z
CVE-2018-19371 
The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-19374 
Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T17:30:40.000Z
CVE-2018-19376 
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clear URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T21:00:00.000Z
CVE-2018-19386 
SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T19:30:16.000Z
CVE-2018-19388 
FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read, access violation, and application crash) via TIFF data because of a ConvertToPDF_x86!ReleaseFXURLToHtml issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T21:00:00.000Z
CVE-2018-19389 
FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and application crash) via BMP data because of a ConvertToPDF_x86!ConnectedPDF::ConnectedPDFSDK::FCP_SendEmailNotification issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T21:00:00.000Z
CVE-2018-19390 
FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and application crash) via TIFF data because of a ConvertToPDF_x86!ConnectedPDF::ConnectedPDFSDK::FCP_SendEmailNotification issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T21:00:00.000Z
CVE-2018-19391 
Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T16:00:00.000Z
CVE-2018-19392 
Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password (including the default "admin" account), without prior knowledge of their password. All that is required is knowledge of the username and attack vector (/index.lua?pageID=Administration usernameAdmChange, passwordAdmChange1, and passwordAdmChange2 fields).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T16:00:00.000Z
CVE-2018-19393 
Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could be leveraged to achieve a Denial of Service (DoS) condition, where the device would require a factory reset to return to normal operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T16:00:00.000Z
CVE-2018-19394 
Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field (e.g., Satellite name), and then restoring the malicious configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T16:00:00.000Z
CVE-2018-19395 
ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM("WScript.Shell").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T21:00:00.000Z
CVE-2018-19396 
ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T21:00:00.000Z
CVE-2018-19404 
In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url= followed by that URL. This is related to the onlineinstall and import functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-21T00:00:00.000Z
CVE-2018-19406 
kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-21T00:00:00.000Z