rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-10313 
WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set_iframe=1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T02:00:00.000Z
CVE-2018-10314 
Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover -> Audit Scripts -> List Scripts -> Download section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-10T03:00:00.000Z
CVE-2018-10316 
Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a globallineno integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T02:00:00.000Z
CVE-2018-10318 
Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T02:00:00.000Z
CVE-2018-10319 
Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T02:00:00.000Z
CVE-2018-10320 
Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T02:00:00.000Z
CVE-2018-10321 
Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T06:00:00.000Z
CVE-2018-10322 
The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T06:00:00.000Z
CVE-2018-10323 
The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T06:00:00.000Z
CVE-2018-10326 
PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-17T19:00:00.000Z
CVE-2018-10327 
PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user by reading the cps_config.xml file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-17T19:00:00.000Z
CVE-2018-10328 
Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T06:00:00.000Z
CVE-2018-10329 
app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-24T06:00:00.000Z
CVE-2018-10350 
A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw within the handling of parameters provided to wcs\_bwlists\_handler.php.  Authentication is required in order to exploit this vulnerability.
Problem types: description: SQL Injection RCE
Affected products: vendor: Trend Micro
product: Trend Micro Smart Protection Server (Standalone)
Published: 2018-05-25T15:00:00.000Z
CVE-2018-10351 
A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRegistration2 class. Authentication is required to exploit this vulnerability.
Problem types: description: SQL Injection
Affected products: vendor: Trend Micro
product: Trend Micro Email Encryption Gateway
Published: 2018-05-23T16:00:00.000Z
CVE-2018-10352 
A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formConfiguration class. Authentication is required to exploit this vulnerability.
Problem types: description: SQL Injection
Affected products: vendor: Trend Micro
product: Trend Micro Email Encryption Gateway
Published: 2018-05-23T16:00:00.000Z
CVE-2018-10353 
A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose sensitive information on vulnerable installations due to a flaw in the formChangePass class. Authentication is required to exploit this vulnerability.
Problem types: description: SQL Injection
Affected products: vendor: Trend Micro
product: Trend Micro Email Encryption Gateway
Published: 2018-05-23T16:00:00.000Z
CVE-2018-10354 
A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the LauncherServer. Authentication is required to exploit this vulnerability.
Problem types: description: Command Injection RCE
Affected products: vendor: Trend Micro
product: Trend Micro Email Encryption Gateway
Published: 2018-05-23T16:00:00.000Z
CVE-2018-10355 
An authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to recover user passwords on vulnerable installations due to a flaw in the DBCrypto class. An attacker must first obtain access to the user database on the target system in order to exploit this vulnerability.
Problem types: description: Authentication Weakness
Affected products: vendor: Trend Micro
product: Trend Micro Email Encryption Gateway
Published: 2018-05-23T16:00:00.000Z
CVE-2018-10356 
A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability.
Problem types: description: SQL Injection
Affected products: vendor: Trend Micro
product: Trend Micro Email Encryption Gateway
Published: 2018-05-23T16:00:00.000Z
CVE-2018-10357 
A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the FileDrop servlet. Authentication is required to exploit this vulnerability.
Problem types: description: Directory Traversal
Affected products: vendor: Trend Micro
product: Trend Micro Endpoint Application Control
Published: 2018-05-23T16:00:00.000Z
CVE-2018-10358 
A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within the processing of IOCTL 0x2200B4 in the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Pool Corruption Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2018-06-08T14:00:00.000Z
CVE-2018-10359 
A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within the processing of IOCTL 0x220078 in the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Pool Corruption Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan
Published: 2018-06-08T14:00:00.000Z
CVE-2018-10360 
The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T10:00:00.000Z
CVE-2018-10361 
An issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary files in the KTextEditor's kauth_ktexteditor_helper service (as utilized in the Kate text editor) can allow other unprivileged users on the local system to gain root privileges. The attack occurs when one user (who has an unprivileged account but is also able to authenticate as root) writes a text file using Kate into a directory owned by a another unprivileged user. The latter unprivileged user conducts a symlink attack to achieve privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T05:00:00.000Z
CVE-2018-10362 
An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-provided login password, it is possible to login with a simpler password if the password has the form of a power in scientific notation (like '2e2' for '200' or '0e1234' for '0'). This is possible because, in the loose comparison case, PHP interprets the string as a number in scientific notation, and thus converts it to a number. After that, the comparison with '==' casts the user input (e.g., the string '200' or '0') to a number, too. Hence the attacker can login with just a '0' or a simple number he has to brute force. Strong comparison with '===' prevents the cast into numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T05:00:00.000Z
CVE-2018-10363 
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-13T18:00:00.000Z
CVE-2018-10364 
BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T21:00:00.000Z
CVE-2018-10365 
An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the option to convert the thread to a link. The thread link input box is not properly sanitized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T16:00:00.000Z
CVE-2018-10366 
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-10367 
An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-10368 
An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an announcement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-10369 
A Cross-site scripting (XSS) vulnerability was discovered on Intelbras Win 240 V1.1.0 devices. An attacker can change the Admin Password without a Login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-15T17:00:00.000Z
CVE-2018-10371 
An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a page title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T13:00:00.000Z
CVE-2018-10372 
process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-10373 
concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-10374 
EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-10375 
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-10376 
An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted _fee and _value parameters, as exploited in the wild in April 2018, aka the "proxyOverflow" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-10377 
PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-17T16:00:00.000Z
CVE-2018-10379 
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T21:00:00.000Z
CVE-2018-10380 
kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-08T08:00:00.000Z
CVE-2018-10381 
TunnelBear 3.2.0.6 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "TunnelBearMaintenance" service. This service establishes a NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "OpenVPNConnect" method accepts a server list argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T00:00:00.000Z
CVE-2018-10382 
MODX Revolution 2.6.3 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T17:00:00.000Z
CVE-2018-10383 
Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T19:48:02.000Z
CVE-2018-10387 
Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2008-2161.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T22:45:39.000Z
CVE-2018-10388 
Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T22:45:43.000Z
CVE-2018-10389 
Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T22:45:46.000Z
CVE-2018-10391 
An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T05:00:00.000Z
CVE-2018-10392 
mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T05:00:00.000Z
CVE-2018-10393 
bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T05:00:00.000Z
CVE-2018-10403 
An issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-13T22:00:00.000Z
CVE-2018-10404 
An issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and procInfo. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-13T22:00:00.000Z
CVE-2018-10405 
An issue was discovered in Google Santa and molcodesignchecker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-13T22:00:00.000Z
CVE-2018-10406 
An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-13T22:00:00.000Z
CVE-2018-10407 
An issue was discovered in Carbon Black Cb Response. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-13T22:00:00.000Z
CVE-2018-10408 
An issue was discovered in VirusTotal. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-13T22:00:00.000Z
CVE-2018-10422 
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T05:00:00.000Z
CVE-2018-10423 
mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T05:00:00.000Z
CVE-2018-10424 
mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T05:00:00.000Z
CVE-2018-10425 
An issue was discovered in Shanghai 2345 Security Guard 3.7.0. 2345MPCSafe.exe, 2345SafeTray.exe, and 2345Speedup.exe allow local users to bypass intended process protections, and consequently terminate processes, because SetParent is not properly considered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T07:00:00.000Z
CVE-2018-10428 
ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-23T20:00:00.000Z
CVE-2018-10429 
Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T17:00:00.000Z
CVE-2018-10430 
An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting->site setting" of admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T17:00:00.000Z
CVE-2018-10431 
D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T17:00:00.000Z
CVE-2018-10432 
Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:24:20.000Z