rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-18505 
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.
Problem types: description: Privilege escalation through IPC channel messages
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2019-02-05T21:00:00.000Z
CVE-2018-18506 
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65.
Problem types: description: Proxy Auto-Configuration file can define localhost access to be proxied
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-02-05T21:00:00.000Z
CVE-2018-18508 
In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.
Problem types: description: Denial of Service through malformed signatures
Affected products: vendor: Mozilla
product: NSS
Published: 2020-10-22T20:14:42.000Z
CVE-2018-18509 
A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1.
Problem types: description: S/MIME signature spoofing
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2019-04-26T16:13:22.000Z
CVE-2018-18510 
The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purposes. This issue allows for a non-persistent denial of service (DOS) attack by a malicious site which links to these pages. This vulnerability affects Firefox < 64.
Problem types: description: Web content can link to internal about:crashcontent and about:crashparent pages
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-26T16:13:22.000Z
CVE-2018-18511 
Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox < 65.0.1.
Problem types: description: Cross-origin theft of images with ImageBitmapRenderingContext
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-26T16:13:22.000Z
CVE-2018-18512 
A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed, although the sound is still being played asynchronously, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5.
Problem types: description: Use-after-free during sound notifications
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2019-04-26T16:13:22.000Z
CVE-2018-18513 
A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service (DOS) attack because Thunderbird reopens the last seen message on restart, triggering the crash again. This vulnerability affects Thunderbird < 60.5.
Problem types: description: DOS and crash with crafted S/MIME message or XPI package
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2019-04-26T16:13:22.000Z
CVE-2018-18517 
Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T21:00:00.000Z
CVE-2018-18519 
BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe" file because of insecure permissions for the BUILTIN\Users group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-19T08:00:00.000Z
CVE-2018-18520 
An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T17:00:00.000Z
CVE-2018-18521 
Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T17:00:00.000Z
CVE-2018-18524 
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution command on the victim's computer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:02:05.000Z
CVE-2018-18527 
OwnTicket 2018-05-23 allows SQL Injection via the showTicketId or editTicketStatusId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T19:00:00.000Z
CVE-2018-18529 
ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T20:00:00.000Z
CVE-2018-18530 
ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T20:00:00.000Z
CVE-2018-18531 
text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (rather than SecureRandom) function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force approach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T20:00:00.000Z
CVE-2018-18535 
The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers (MSRs). This could be leveraged to execute arbitrary ring-0 code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-26T20:00:00.000Z
CVE-2018-18536 
The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-26T20:00:00.000Z
CVE-2018-18537 
The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-26T20:00:00.000Z
CVE-2018-18540 
TeaKKi 2.7 allows XSS via a crafted onerror attribute for a picture's URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-20T21:00:00.000Z
CVE-2018-18541 
In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-20T22:00:00.000Z
CVE-2018-18544 
There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-21T01:00:00.000Z
CVE-2018-18545 
Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-21T01:00:00.000Z
CVE-2018-18546 
ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-21T01:00:00.000Z
CVE-2018-18547 
Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dir_a parameter, or the filename to the list/directory/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T21:00:00.000Z
CVE-2018-18548 
ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T21:00:00.000Z
CVE-2018-18550 
ServersCheck Monitoring Software before 14.3.4 allows SQL Injection by an authenticated user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-21T23:00:00.000Z
CVE-2018-18551 
ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type parameter, sensors.html device parameter, report.html location parameter, group_delete.html group parameter, report_save.html query parameter, sensors.html location parameter, or group_delete.html group parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T22:00:00.000Z
CVE-2018-18552 
ServersCheck Monitoring Software through 14.3.3 allows local users to cause a denial of service (menu functionality loss) by creating an LNK file that points to a second LNK file, if this second LNK file is associated with a Start menu. Ultimately, this behavior comes from a Directory Traversal bug (via the sensor_details.html id parameter) that allows creating empty files in arbitrary directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T22:00:00.000Z
CVE-2018-18553 
Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-22T01:00:00.000Z
CVE-2018-18555 
A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-18556 
A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-18557 
LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-22T16:00:00.000Z
CVE-2018-18558 
An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacker to bypass secure boot checks and execute arbitrary code, by crafting an application binary that overwrites a bootloader code segment in process_segment in components/bootloader_support/src/esp_image_format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:49:59.000Z
CVE-2018-18559 
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-22T16:00:00.000Z
CVE-2018-18561 
An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18562 
An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18563 
An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial Number below KQ0400000 or KS0400000) and cobas h 232 before 04.00.04 (Serial Number above KQ0400000 or KS0400000). Improper access control to a service command allows attackers in the adjacent network to execute arbitrary code on the system through a crafted Poct1-A message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18564 
An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). Improper access control allows attackers in the adjacent network to change the instrument configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18565 
An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-18566 
The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Business.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T22:00:00.000Z
CVE-2018-18567 
AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T22:00:00.000Z
CVE-2018-18568 
Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T22:00:00.000Z
CVE-2018-18569 
The Dundas BI server before 5.0.1.1010 is vulnerable to a Server-Side Request Forgery attack, allowing an attacker to forge arbitrary requests (with certain restrictions) that will be executed on behalf of the attacker, via the viewUrl parameter of the "export the dashboard as an image" feature. This could be leveraged to provide a proxy to attack other servers (internal or external) or to perform network scans of external or internal networks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T21:00:00.000Z
CVE-2018-18570 
Planon before Live Build 41 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T22:33:47.000Z
CVE-2018-18571 
An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. An attacker can impersonate and take actions on behalf of any Mobile Application Management (MAM) enrolled device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T14:53:57.000Z
CVE-2018-18572 
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T14:33:07.000Z
CVE-2018-18573 
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T14:34:51.000Z
CVE-2018-18576 
The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:18:03.000Z
CVE-2018-18578 
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-22T21:00:00.000Z
CVE-2018-18579 
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-22T21:00:00.000Z
CVE-2018-18581 
An issue has been found in LuPng through 2017-03-10. It is a heap-based buffer over-read in internalPrintf in miniz/lupng.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-22T22:00:00.000Z
CVE-2018-18582 
An issue has been found in LuPng through 2017-03-10. It is a heap-based buffer overflow in insertByte in miniz/lupng.c during a write operation for data obtained from a palette.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-22T22:00:00.000Z
CVE-2018-18583 
An issue has been found in LuPng through 2017-03-10. It is a heap-based buffer overflow in insertByte in miniz/lupng.c during a write operation for data obtained from a swap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-22T22:00:00.000Z
CVE-2018-18584 
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T00:00:00.000Z
CVE-2018-18585 
chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T00:00:00.000Z
CVE-2018-18586 
chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T02:00:00.000Z
CVE-2018-18587 
BigProf AppGini 5.70 stores the passwords in the database using the MD5 hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T12:00:00.000Z