rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1999001 
A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T19:00:00.000Z
CVE-2018-1999002 
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T19:00:00.000Z
CVE-2018-1999003 
A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T19:00:00.000Z
CVE-2018-1999004 
A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T19:00:00.000Z
CVE-2018-1999005 
A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T19:00:00.000Z
CVE-2018-1999006 
A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the date of the most recent installation/upgrade.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T19:00:00.000Z
CVE-2018-1999007 
A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T19:00:00.000Z
CVE-2018-1999008 
October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999009 
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999010 
FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in cced03dd667a5df6df8fd40d8de0bff477ee02e8 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999011 
FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provided as input to FFmpeg. This vulnerability appears to have been fixed in 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999012 
FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially crafted PVA file has to be provided as input. This vulnerability appears to have been fixed in 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999013 
FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999014 
FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This attack appear to be exploitable via specially crafted MXF file which has to be provided as input. This vulnerability appears to have been fixed in bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999015 
FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memory reading. This attack appear to be exploitable via specially crafted ASF file that has to provided as input. This vulnerability appears to have been fixed in 5aba5b89d0b1d73164d3b81764828bb8b20ff32a and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999016 
Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating the web client via XSS code injection. This attack appear to be exploitable via the victim openning a specially crafted URL. This vulnerability appears to have been fixed in version 8.2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999017 
Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath($url) that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appears to be exploitable via the attacker gaining access to an administrative account, enters a URL into Upgrade Engine, and reloads the page or presses "Check Now". This vulnerability appears to have been fixed in 8.2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999018 
Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow($nodeObject) that can result in An attacker gaining admin access and can then execute arbitrary commands on the underlying OS. This attack appear to be exploitable via The attacker edits the Antivirus Command in the antivirus plugin, and executes the payload by uploading any file within Pydio.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999019 
Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999020 
Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java line 35 that can result in arbitrary file deletion (overwrite). This attack appear to be exploitable via a specially crafted zip file should be uploaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999021 
Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary web script or HTML via the profile page editor. This attack appear to be exploitable via The victim must navigate to the attacker's profile page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T15:00:00.000Z
CVE-2018-1999022 
PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T16:00:00.000Z
CVE-2018-1999023 
The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T16:00:00.000Z
CVE-2018-1999024 
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T16:00:00.000Z
CVE-2018-1999025 
A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins connects to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999026 
A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999027 
An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999028 
An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999029 
A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999030 
An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999031 
An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999032 
A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999033 
An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permission or file system access to the Jenkins master to obtain the password stored in this plugin's configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999034 
A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999035 
A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999036 
An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999037 
A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999038 
A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999039 
A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that allows attackers to have Jenkins submit login requests to an attacker-specified Confluence server URL with attacker specified credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999040 
An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999041 
An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T13:00:00.000Z
CVE-2018-1999042 
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T18:00:00.000Z
CVE-2018-1999043 
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T18:00:00.000Z
CVE-2018-1999044 
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T18:00:00.000Z
CVE-2018-1999045 
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T18:00:00.000Z
CVE-2018-1999046 
A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T18:00:00.000Z
CVE-2018-1999047 
A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T18:00:00.000Z
CVE-2018-19000 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data.
Problem types: cwe_id: CWE-288
description: AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
Affected products: vendor: ICS-CERT
product: LCDS Laquis SCADA
Published: 2019-02-05T18:00:00.000Z
CVE-2018-19001 
Philips HealthSuite Health Android App, all versions. The software uses simple encryption that is not strong enough for the level of protection required.
Problem types: cwe_id: CWE-326
description: INADEQUATE ENCRYPTION STRENGTH CWE-326
Affected products: vendor: n/a
product: Philips HealthSuite Health Android App
Published: 2018-12-07T14:00:00.000Z
CVE-2018-19002 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, which may allow remote code execution, data exfiltration, or cause a system crash.
Problem types: cwe_id: CWE-94
description: IMPROPER CONTROL OF GENERATION OF CODE ('CODE INJECTION') CWE-94
Affected products: vendor: LCDS
product: LCDS Laquis SCADA
Published: 2019-02-05T18:00:00.000Z
CVE-2018-19003 
GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04.09.00C, and LS2100e All versions prior to v04.09.00C The affected versions of the application have a path traversal vulnerability that fails to restrict the ability of an attacker to gain access to restricted information.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: n/a
product: GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e
Published: 2018-12-14T15:00:00.000Z
CVE-2018-19004 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data exfiltration.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: ICS-CERT
product: LCDS Laquis SCADA
Published: 2019-02-01T18:00:00.000Z
CVE-2018-19005 
Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing specially crafted POC files lacking user input validation. This may allow an attacker to read confidential information and remotely execute arbitrary code.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: Cscape
Published: 2018-12-20T21:00:00.000Z
CVE-2018-19006 
OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: OSIsoft
product: PI Vision
Published: 2019-04-08T14:30:39.000Z