rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-11730 
The libfsntfs_security_descriptor_values_free function in libfsntfs_security_descriptor_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause a denial of service (double-free) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-19T21:00:00.000Z
CVE-2018-11731 
The libfsntfs_mft_entry_read_attributes function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-19T21:00:00.000Z
CVE-2018-11734 
In e107 v2.1.7, output without filtering results in XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T17:19:51.000Z
CVE-2018-11735 
index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T06:00:00.000Z
CVE-2018-11736 
An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T06:00:00.000Z
CVE-2018-11737 
An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfs_fix_idxrec in tsk/fs/ntfs_dent.cpp which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T11:00:00.000Z
CVE-2018-11738 
An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfs_make_data_run in tsk/fs/ntfs.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T11:00:00.000Z
CVE-2018-11739 
An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function raw_read in tsk/img/raw.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T11:00:00.000Z
CVE-2018-11740 
An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function tsk_UTF16toUTF8 in tsk/base/tsk_unicode.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T11:00:00.000Z
CVE-2018-11741 
NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=#####&GOTO(8) URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-26T20:00:00.000Z
CVE-2018-11742 
NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-26T20:00:00.000Z
CVE-2018-11743 
The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_hash_keys uninitialized pointer and application crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T13:00:00.000Z
CVE-2018-11744 
Cloudera Manager through 5.15 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:35:25.000Z
CVE-2018-11746 Puppet Discovery can leak authentication information
In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.
Problem types: description: Insufficiently Protected Credentials
Affected products: vendor: Puppet
product: Puppet Discovery
Published: 2018-07-03T13:00:00.000Z
CVE-2018-11747 
Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress.
Problem types: description: Insecure default
Affected products: vendor: Puppet
product: Puppet Discovery
Published: 2019-03-17T19:16:13.000Z
CVE-2018-11748 
Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue has been resolved as of device_manager 2.7.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-02T19:00:00.000Z
CVE-2018-11749 
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS score.
Problem types: description: Improper Authentication
Affected products: vendor: Puppet
product: Puppet Enterprise
Published: 2018-08-24T13:00:00.000Z
CVE-2018-11750 
Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, host key checking is enabled by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-02T19:00:00.000Z
CVE-2018-11751 
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
Problem types: description: Improper Certificate Validation
Affected products: vendor: n/a
product: Puppet Agent, Puppet
Published: 2019-12-16T21:39:30.000Z
CVE-2018-11752 
Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file on every run. These issues have been resolved in the 0.4.0 release.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-02T19:00:00.000Z
CVE-2018-11756 
In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: PHP Runtime for Apache OpenWhisk
Published: 2018-07-23T17:00:00.000Z
CVE-2018-11757 
In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Docker Skeleton Runtime for Apache OpenWhisk
Published: 2018-07-23T17:00:00.000Z
CVE-2018-11758 
This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a malicious XML file, the attacker will be able to instruct the XML parser built into CayenneModeler to transfer files from a local machine to a remote machine controlled by the attacker. The cause of the issue is XML parser processing XML External Entity (XXE) declarations included in XML. The vulnerability is addressed in Cayenne by disabling XXE processing in all operations that require XML parsing.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Cayenne
Published: 2018-08-22T21:00:00.000Z
CVE-2018-11759 
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat Connectors
Published: 2018-10-31T20:00:00.000Z
CVE-2018-11760 
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
Problem types: description: Gain Privileges
Affected products: vendor: Apache Software Foundation
product: Apache Spark
Published: 2019-02-04T17:00:00.000Z
CVE-2018-11761 
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Problem types: description: Denial of Service via XML Entity Expansion
Affected products: vendor: Apache Software Foundation
product: Apache Tika
Published: 2018-09-19T14:00:00.000Z
CVE-2018-11762 
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Problem types: description: Zip Slip Vulnerability in Apache Tika's tika-app
Affected products: vendor: Apache Software Foundation
product: Apache Tika
Published: 2018-09-19T14:00:00.000Z
CVE-2018-11763 
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
Problem types: description: mod_http2, DoS via continuous SETTINGS frames
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Published: 2018-09-25T21:00:00.000Z
CVE-2018-11764 
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Apache Hadoop
Published: 2020-10-21T18:13:56.000Z
CVE-2018-11765 
In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Hadoop
Published: 2020-09-30T17:02:20.000Z
CVE-2018-11766 
In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.
Problem types: description: Privilege Escalation
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Published: 2018-11-27T14:00:00.000Z
CVE-2018-11767 
In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Apache Hadoop
Published: 2019-03-18T13:41:17.000Z
CVE-2018-11768 
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Hadoop
Published: 2019-10-04T13:56:56.000Z
CVE-2018-11769 
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.
Problem types: description: Remote Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache CouchDB
Published: 2018-08-08T15:00:00.000Z
CVE-2018-11770 
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.
Problem types: description: Improper Access Control
Affected products: vendor: Apache Software Foundation
product: Apache Spark
default_status: unaffected
Published: 2018-08-13T00:00:00.000Z
CVE-2018-11771 
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.
Problem types: description: denial of service vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Commons Compress
Published: 2018-08-16T15:00:00.000Z
CVE-2018-11772 
Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.
Problem types: description: SQL Injection
Affected products: vendor: Apache
product: VCL
Published: 2019-07-29T18:32:36.000Z
CVE-2018-11773 
Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument to the php built in function strtotime. This allows for an attack against the underlying implementation of that function. The implementation of strtotime at the time the issue was discovered appeared to be resistant to a malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.
Problem types: description: improper form validation in block allocation management
Affected products: vendor: Apache
product: VCL
Published: 2019-07-29T18:11:55.000Z
CVE-2018-11774 
Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.
Problem types: description: SQL Injection
Affected products: vendor: Apache
product: VCL
Published: 2019-07-29T18:17:50.000Z
CVE-2018-11775 
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
Problem types: description: Missing TLS Hostname Verification
Affected products: vendor: Apache Software Foundation
product: Apache ActiveMQ
Published: 2018-09-10T20:00:00.000Z
CVE-2018-11776 
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Problem types: description: Remote Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache Struts
Published: 2018-08-22T13:00:00.000Z
CVE-2018-11777 
In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.
Problem types: description: Exposure of Resource to Wrong Sphere
Affected products: vendor: Apache Software Foundation
product: Apache Hive
Published: 2018-11-08T14:00:00.000Z
CVE-2018-11778 
UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0
Problem types: description: Overflow
Affected products: vendor: Apache Software Foundation
product: Apache Ranger
Published: 2018-10-05T19:00:00.000Z
CVE-2018-11779 
In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Apache
product: Storm
Published: 2019-07-25T23:23:01.000Z
CVE-2018-11780 
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
Problem types: description: Remote Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache SpamAssassin
Published: 2018-09-17T14:00:00.000Z
CVE-2018-11781 
Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
Problem types: description: Local Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache SpamAssassin
Published: 2018-09-17T14:00:00.000Z
CVE-2018-11782 
In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Apache Subversion
Published: 2019-09-26T15:55:30.000Z
CVE-2018-11783 
sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Published: 2019-03-07T18:00:00.000Z
CVE-2018-11784 
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
Problem types: description: Open Redirect
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
Published: 2018-10-04T13:00:00.000Z
CVE-2018-11785 
Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query, leading to wrong results for a query.
Problem types: description: Unauthorized access
Affected products: vendor: Apache Software Foundation
product: Apache Impala
Published: 2018-10-24T20:00:00.000Z
CVE-2018-11786 
In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.
Problem types: description: Process Execution
Affected products: vendor: Apache Software Foundation
product: Apache Karaf
Published: 2018-09-18T14:00:00.000Z