rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-17160 
In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models provided by bhyve can permit a guest operating system to overwrite memory in the bhyve host possibly permitting arbitrary code execution. A guest OS using a firmware image can cause the bhyve process to crash, or possibly execute arbitrary code on the host as root.
Problem types: description: Insufficient bounds checking
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2018-12-04T21:00:00.000Z
CVE-2018-17161 
In FreeBSD before 11.2-STABLE(r348229), 11.2-RELEASE-p7, 12.0-STABLE(r342228), and 12.0-RELEASE-p1, insufficient validation of network-provided data in bootpd may make it possible for a malicious attacker to craft a bootp packet which could cause a stack buffer overflow. It is possible that the buffer overflow could lead to a Denial of Service or remote code execution.
Problem types: description: Improper Input Validation
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2019-01-03T17:00:00.000Z
CVE-2018-17167 
PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial Number" field in the clustering configuration, (2) "name" field in the Edit Group configuration, (3) "Rule Name" field in the Access Control configuration, (4) "Service Name" in the Service Configuration, or (5) First Name or Last Name field in the Edit Account configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T20:28:52.000Z
CVE-2018-17168 
PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by following a link, can be tricked into making unwanted changes to a printer (Disable, Approve, etc).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-18T16:36:51.000Z
CVE-2018-17169 
An XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T13:34:01.000Z
CVE-2018-17170 
Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-28T17:46:07.000Z
CVE-2018-17172 
The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 before 100.003.028.05200 allows unauthenticated command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T03:00:00.000Z
CVE-2018-17173 
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-17174 
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger denial of service (even arbitrary code execution in a certain context) in a product using this library via malformed data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-17175 
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T17:00:00.000Z
CVE-2018-17176 
A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the authentication (always transmitted in cleartext) can be replayed to /bin/webserver on port 8081. There are no nonces, and timestamps are not checked at all.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T18:00:00.000Z
CVE-2018-17177 
An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs (event logs and core dumps) to a USB stick. These logs are RC4-encrypted with a 9-character password of *^JEd4W!I that is obfuscated by hiding it within a custom /bin/rc4_crypt binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T18:00:00.000Z
CVE-2018-17178 
An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver on port 8081) if they already have an active session. Commands like forward, back, arc-left, arc-right, pivot-left, and pivot-right are executed even though the web socket replies with { "message" : "invalid authorization header" }. Without an active session, commands are still interpreted, but (except for eco-on and eco-off) have no effect, since without active driving, a driving direction does not change anything.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T18:00:00.000Z
CVE-2018-17179 
An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T15:57:39.000Z
CVE-2018-17180 
An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T15:58:56.000Z
CVE-2018-17181 
An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T16:00:15.000Z
CVE-2018-17182 
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T09:00:00.000Z
CVE-2018-17183 
Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T15:00:00.000Z
CVE-2018-17184 
A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Syncope
Published: 2018-11-06T19:00:00.000Z
CVE-2018-17186 
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
Problem types: description: Remote code execution
Affected products: vendor: Apache Software Foundation
product: Apache Syncope
Published: 2018-11-06T21:00:00.000Z
CVE-2018-17187 
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J utilising the optional transport TLS wrapper layer that wish to enable hostname verification must be upgraded to version 0.30.0 or later and utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the default for client mode usage unless configured otherwise.
Problem types: description: Hostname verification support not implemented, exception thrown if configured.
Affected products: vendor: Apache Software Foundation
product: Apache Qpid Proton-J
Published: 2018-11-13T15:00:00.000Z
CVE-2018-17188 
Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full system entry for unauthenticated users. Rather than waiting for new vulnerabilities to be discovered, and fixing them as they come up, the CouchDB development team decided to make changes to avoid this entire class of vulnerabilities.
Problem types: description: Remote Privilege Escalations
Affected products: vendor: Apache Software Foundation
product: Apache CouchDB
Published: 2019-01-02T14:00:00.000Z
CVE-2018-17189 
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
Problem types: description: mod_http2, DoS via slow request bodies
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Published: 2019-01-30T22:00:00.000Z
CVE-2018-17190 
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Apache Software Foundation
product: Apache Spark
Published: 2018-11-19T14:00:00.000Z
CVE-2018-17191 
Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects, that can be used to circumvent the execution limits. If a different script engine was used, no execution limits were in place. Both vectors allow remote code execution.
Problem types: description: Containment Error
Affected products: vendor: Apache Software Foundation
product: Apache NetBeans
Published: 2018-12-31T14:00:00.000Z
CVE-2018-17192 
The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Problem types: description: Clickjacking
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
Published: 2018-12-19T14:00:00.000Z
CVE-2018-17193 
The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Problem types: description: XSS
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
Published: 2018-12-19T14:00:00.000Z
CVE-2018-17194 
When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Problem types: description: Denial of service
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
Published: 2018-12-19T14:00:00.000Z
CVE-2018-17195 
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level. Mitigation: The fix to apply Cross-Origin Resource Sharing (CORS) policy request filtering was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Problem types: description: Cross Site Request Forgery
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
Published: 2018-12-19T14:00:00.000Z
CVE-2018-17196 
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.
Problem types: description: Information Disclosure
Affected products: vendor: Apache
product: Kafka
Published: 2019-07-11T20:37:56.000Z
CVE-2018-17197 
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
Problem types: description: Denial of Service
Affected products: vendor: Apache Software Foundation
product: Apache Tika
Published: 2018-12-24T14:00:00.000Z
CVE-2018-17198 
Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: <!-- <servlet-mapping> <servlet-name>XmlRpcServlet</servlet-name> <url-pattern>/roller-services/xmlrpc</url-pattern> </servlet-mapping> -->
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Roller
Published: 2019-05-28T17:08:11.000Z
CVE-2018-17199 
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.
Problem types: description: Infufficient Session Expiration
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Published: 2019-01-30T22:00:00.000Z
CVE-2018-17200 
The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019
Problem types: description: remote code execution
Affected products: vendor: Apache
product: OFBiz
Published: 2019-09-11T20:22:44.000Z
CVE-2018-17201 
Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Commons Imaging
Published: 2019-05-06T17:07:11.000Z
CVE-2018-17202 
Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Commons Imaging
Published: 2019-05-06T17:14:00.000Z
CVE-2018-17204 
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVS_NOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T16:00:00.000Z
CVE-2018-17205 
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not exist), OvS tries to revert back all previous flows that were successfully applied from the same bundle. This is possible since OvS maintains list of old flows that were replaced by flows from the bundle. While reinserting old flows, OvS has an assertion failure due to a check on rule state != RULE_INITIALIZED. This would work for new flows, but for an old flow the rule state is RULE_REMOVED. The assertion failure causes an OvS crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T16:00:00.000Z
CVE-2018-17206 
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T16:00:00.000Z
CVE-2018-17207 
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T16:00:00.000Z
CVE-2018-17208 
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface). This occurs because shell metacharacters in the query string are mishandled by ShellExecute, as demonstrated by the zbtest.cgi?cmd=level&level= substring. This can also be exploited via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T17:00:00.000Z
CVE-2018-17210 
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass the session checks (that would otherwise logout a low-privileged user) by calling the core print job components directly via crafted HTTP GET and POST requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T23:19:50.000Z
CVE-2018-17211 
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T17:30:43.000Z
CVE-2018-17213 
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtaining a valid session cookie with guest/pseudo-guest level privileges. This cookie can then be further used to perform other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T17:37:41.000Z
CVE-2018-17215 
An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker (for example, user credentials).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T21:00:00.000Z
CVE-2018-17216 
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T01:00:00.000Z
CVE-2018-17217 
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T01:00:00.000Z
CVE-2018-17218 
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T01:00:00.000Z
CVE-2018-17228 
nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-19T21:00:00.000Z