rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-11632 
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. (These permissions are only used in custom User Roles and do not affect built in User Roles.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T13:07:14.000Z
CVE-2019-11633 
HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fake WordPress templates. This allows attackers to discover and avoid this honeypot system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T13:33:42.000Z
CVE-2019-11634 
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T16:46:42.000Z
CVE-2019-11636 
Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and "prevent any real transaction from occurring" via a "Sapling Wood-Chipper" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T16:21:33.000Z
CVE-2019-11637 
An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_rset_get_props at rec-rset.c in librec.a, leading to a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T17:03:45.000Z
CVE-2019-11638 
An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c in librec.a, leading to a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T17:03:56.000Z
CVE-2019-11639 
An issue was discovered in GNU recutils 1.8. There is a stack-based buffer overflow in the function rec_type_check_enum at rec-types.c in librec.a.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T17:04:04.000Z
CVE-2019-11640 
An issue was discovered in GNU recutils 1.8. There is a heap-based buffer overflow in the function rec_fex_parse_str_simple at rec-fex.c in librec.a.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T17:04:15.000Z
CVE-2019-11641 
Anomali Agave (formerly Drupot) through 1.0.0 fails to avoid fingerprinting by including predictable data and minimal variation in size within HTML templates, giving attackers the ability to detect and avoid this system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T17:58:19.000Z
CVE-2019-11642 
A log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework before 5.1.10. Authenticated remote adversaries can poison log files by entering malicious payloads in either headers or form elements. These payloads are then executed via a client side debugging console. This is predicated on the debugging console and Java Bean being made available to the deployed application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-08T15:31:05.000Z
CVE-2019-11643 
Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10. Remote adversaries can inject malicious JavaScript into textboxes decorated with type string, which is subsequently stored to the applicable data store. This can be exploited remotely by both authenticated and unauthenticated users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-08T15:26:13.000Z
CVE-2019-11644 
In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process then attempts to load several DLLs from its current directory. Non-admin users are able to write to this folder, so an attacker can create a malicious C:\Windows\Temp\OLEACC.dll file. When an admin runs the installer, rm.exe will execute the attacker's DLL in an elevated security context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T20:05:35.000Z
CVE-2019-11646 
Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61. This vulnerability could allow Remote unauthorized command execution and unauthorized disclosure of information.
Problem types: description: Remote unauthorized command execution and unauthorized disclosure of information
Affected products: vendor: n/a
product: Micro Focus Service Manager
Published: 2019-06-03T16:47:36.000Z
CVE-2019-11647 
A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Micro Focus
product: Micro Focus NetIQ Self Service Password Reset.
Published: 2019-06-24T15:27:01.000Z
CVE-2019-11648 
An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability could be exploited to expose sensitive information.
Problem types: description: Information leakage
Affected products: vendor: Micro Focus
product: Micro Focus NetIQ Self Service Password Reset.
Published: 2019-06-24T15:40:28.000Z
CVE-2019-11649 KM03461174 Micro Focus Fortify Software Security Center Server, CVE-2019-11649
Cross-Site Scripting vulnerability in Micro Focus Fortify Software Security Center Server, versions 17.2, 18.1, 18.2, has been identified in Micro Focus Software Security Center. The vulnerability could be exploited to execute JavaScript code in user’s browser. The vulnerability could be exploited to execute JavaScript code in user’s browser.
Problem types: description: Remote code execution
Affected products: vendor: Micro Focus
product: Micro Focus Fortify Software Security Center Server
Published: 2019-06-19T16:06:50.731Z
CVE-2019-11650 
A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0.
Problem types: description: MITM
Affected products: vendor: Micro Focus
product: NetIQ Advanced Authentication Framework
Published: 2019-07-10T18:02:45.000Z
CVE-2019-11651 
Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests.
Problem types: description: Reflected XSS
Affected products: vendor: n/a
product: Micro Focus Enterprise Developer and Enterprise Server
Published: 2019-10-02T20:11:26.000Z
CVE-2019-11652 
A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to Micro Focus Self Service Password Reset (SSPR) SSPR versions 4.4.0.3, 4.3.0.6, or 4.2.0.6 as appropriate.
Problem types: description: Authorization Bypass
Affected products: vendor: Micro Focus
product: Self Service Password Reset (SSPR)
Published: 2019-08-14T15:47:44.000Z
CVE-2019-11653 
Remote Access Control Bypass in Micro Focus Content Manager. versions 9.1, 9.2, 9.3. The vulnerability could be exploited to manipulate data stored during another user’s CheckIn request.
Problem types: description: Remote Access Control Bypass
Affected products: vendor: Micro Focus
product: Content Manager
Published: 2019-08-07T16:28:52.000Z
CVE-2019-11654 A path traversal vulnerability has been identified in Verastream Host Integrator
Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.
Problem types: description: A path traversal vulnerability has been identified in Verastream Host Integrator (VHI). The vulnerability allows remote unauthenticated attackers to read arbitrary files.
Affected products: vendor: Micro Focus
product: Verastream Host Integrator
Published: 2019-08-23T17:20:11.000Z
CVE-2019-11655 
Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with Dangerous type.
Problem types: description: Unrestricted file upload.
Affected products: vendor: n/a
product: ArcSight Logger.
Published: 2019-10-04T19:10:15.000Z
CVE-2019-11656 
Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Problem types: description: Stored XSS.
Affected products: vendor: n/a
product: ArcSight Logger.
Published: 2019-10-04T19:16:52.000Z
CVE-2019-11657 
Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. The vulnerability could be exploited to perform CSRF attack.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: Micro Focus International
product: ArcSight Logger
Published: 2019-12-17T22:05:07.000Z
CVE-2019-11658 
Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid system users to gain access to a limited subset of records they would not normally be able to access when the system is in an undisclosed abnormal state.
Problem types: description: Information exposure
Affected products: vendor: Micro Focus
product: Content Manager
Published: 2019-08-29T22:23:51.000Z
CVE-2019-11660 
Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges.
Problem types: description: Privileges manipulation.
Affected products: vendor: n/a
product: Data Protector
Published: 2019-09-13T17:21:26.000Z
CVE-2019-11661 
Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized access and modification of data.
Problem types: description: Allow changes to some table by non-SysAdmin
Affected products: vendor: Micro Focus
product: Service Manager
Published: 2019-09-18T21:50:05.000Z
CVE-2019-11662 
Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited in some special cases to allow information exposure through an error message.
Problem types: description: Class and method names in error message.
Affected products: vendor: Micro Focus
product: Service Manager
Published: 2019-09-18T21:55:49.000Z
CVE-2019-11663 
Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.
Problem types: description: Clear text credentials
Affected products: vendor: Micro Focus
product: Service Manager
Published: 2019-09-18T21:29:59.000Z
CVE-2019-11664 
Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.
Problem types: description: Clear text password in browser
Affected products: vendor: Micro Focus
product: Service Manager
Published: 2019-09-18T21:35:55.000Z
CVE-2019-11665 
Data exposure in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.
Problem types: description: Data exposure
Affected products: vendor: Micro Focus
product: Service Manager
Published: 2019-09-17T19:01:27.000Z
CVE-2019-11666 
Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow insecure deserialization of untrusted data.
Problem types: description: Insecure deserialization of untrusted data.
Affected products: vendor: Micro Focus
product: Service Manager
Published: 2019-09-17T18:52:03.000Z
CVE-2019-11667 
Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow unauthorized access to private data.
Problem types: description: Unauthorized access to contact information
Affected products: vendor: Micro Focus
product: Service Manager
Published: 2019-09-17T17:13:56.000Z
CVE-2019-11668 
HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62.
Problem types: description: HTTP cookie
Affected products: vendor: n/a
product: Service Manager,  Service Manager – Chat Service.  Server Manager – Chat Service.
Published: 2019-09-10T20:25:45.000Z
CVE-2019-11669 
Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized modification of data.
Problem types: description: Modifiable read only check box in FF
Affected products: vendor: Micro Focus
product: Service Manager
Published: 2019-09-10T20:32:26.000Z
CVE-2019-11674 
Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack.
Problem types: description: Invalid certificate validation.
Affected products: vendor: n/a
product: Self Service Password Reset (SSPR) versions prior to 4.4.0.4
Published: 2019-10-22T14:42:32.000Z
CVE-2019-11675 
The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T05:43:16.000Z
CVE-2019-11676 
The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T13:05:49.000Z
CVE-2019-11677 
The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T13:06:10.000Z
CVE-2019-11678 
The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T13:06:22.000Z
CVE-2019-11680 
KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T17:36:53.000Z
CVE-2019-11682 
A buffer overflow in the SMTP response service in MailCarrier 2.51 allows the attacker to execute arbitrary code remotely via a long HELP command, a related issue to CVE-2019-11395.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T15:03:03.000Z
CVE-2019-11683 
udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload, because of mishandling of padded packets, aka the "GRO packet of death" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T16:56:38.000Z
CVE-2019-11684 Improper Access Control in Bosch Video Recording Manager
Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
version: 3.1
Published: 2021-02-26T15:05:45.533Z
CVE-2019-11686 
Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptographically sensitive parameters (such as data encryption keys) to remain on the drive media after their intended erasure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T12:35:45.000Z
CVE-2019-11687 
An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementations. The 128-byte preamble of a DICOM file that complies with this specification can contain arbitrary executable headers for multiple operating systems, including Portable Executable (PE) files for Windows and Executable and Linkable Format (ELF) files for Linux-based systems. This space is left unspecified so that dual-purpose files can be created. For example, dual-purpose TIFF/DICOM files are used in digital whole slide imaging applications in medicine. This design flaw enables system-wide compromise as malicious DICOM files are routinely shared between medical devices and hospital systems and transported via removable media for patient care coordination. To exploit this vulnerability, someone must execute the maliciously crafted file. These files can be executable even with the .dcm file extension. Anti-malware configurations at healthcare facilities often ignore medical imagery. DICOM files exist on systems that process protected health information, and successful exploitation could result in violations of regulatory compliance requirements such as HIPAA and FDA postmarket obligations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T21:07:15.000Z
CVE-2019-11688 
An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asustornasapi.asustor.com. In other words, there is Missing SSL Certificate Validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-18T14:58:47.000Z
CVE-2019-11689 
An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server responses and pass unsanitized text to the system shell, resulting in code execution as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-18T14:59:34.000Z
CVE-2019-11690 
gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIG_RANDOM_UUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-03T12:07:21.000Z
CVE-2019-11691 
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Use-after-free in XMLHttpRequest
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:23:12.000Z
CVE-2019-11692 
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Use-after-free removing listeners in the event listener manager
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:23:02.000Z
CVE-2019-11693 
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Buffer overflow in WebGL bufferdata on Linux
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:22:53.000Z
CVE-2019-11694 
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Uninitialized memory memory leakage in Windows sandbox
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:22:42.000Z
CVE-2019-11695 
A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. This vulnerability affects Firefox < 67.
Problem types: description: Custom cursor can render over user interface outside of web content
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-07-23T13:22:31.000Z