rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-13406 
An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-06T14:00:00.000Z
CVE-2018-13407 
A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-06T17:00:00.000Z
CVE-2018-13408 
An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-06T17:00:00.000Z
CVE-2018-13409 
An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-06T17:00:00.000Z
CVE-2018-13410 
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-06T19:00:00.000Z
CVE-2018-13411 
An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T16:00:00.000Z
CVE-2018-13412 
An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T16:00:00.000Z
CVE-2018-13415 
In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-13T17:00:00.000Z
CVE-2018-13416 
In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running UMS, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-03T17:00:00.000Z
CVE-2018-13417 
In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Vuze, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-13T17:00:00.000Z
CVE-2018-13418 
System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13419 
An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c, as demonstrated by sndfile-convert. NOTE: The maintainer and third parties were unable to reproduce and closed the issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-07T17:00:00.000Z
CVE-2018-13420 
Google gperftools 2.7 has a memory leak in malloc_extension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-07T17:00:00.000Z
CVE-2018-13421 
Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-07T17:00:00.000Z
CVE-2018-13422 
TCExam before 14.1.2 has XSS via an ff_ or xl_ field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-07T17:00:00.000Z
CVE-2018-13423 
admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-07T17:00:00.000Z
CVE-2018-13433 
Boostnote v0.11.7 allows XSS during highlighting of Markdown text, as demonstrated by an onerror attribute of an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T12:00:00.000Z
CVE-2018-13434 
An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is not used. In other words, an attacker could authenticate with an arbitrary fingerprint.  NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-16T20:00:00.000Z
CVE-2018-13435 
An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication.  NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-16T20:00:00.000Z
CVE-2018-13439 
WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T15:00:00.000Z
CVE-2018-13440 
The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T16:00:00.000Z
CVE-2018-13441 
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-12T18:00:00.000Z
CVE-2018-13442 
SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-16T17:56:43.000Z
CVE-2018-13443 
EOS.IO jit-wasm 4.1 has a heap-based buffer overflow via a crafted wast file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-24T14:05:24.000Z
CVE-2018-13444 
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/admin_manager.php?action=save&id=2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T16:00:00.000Z
CVE-2018-13445 
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/admin_manager.php?action=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T16:00:00.000Z
CVE-2018-13446 
An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode.  NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-16T20:00:00.000Z
CVE-2018-13447 
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T16:00:00.000Z
CVE-2018-13448 
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T16:00:00.000Z
CVE-2018-13449 
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T16:00:00.000Z
CVE-2018-13450 
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-08T16:00:00.000Z
CVE-2018-13457 
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-12T18:00:00.000Z
CVE-2018-13458 
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-12T18:00:00.000Z
CVE-2018-13462 
The mintToken function of a smart contract implementation for MoonToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13463 
The mintToken function of a smart contract implementation for T-Swap-Token (T-S-T), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13464 
The mintToken function of a smart contract implementation for t_swap, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13465 
The mintToken function of a smart contract implementation for PaulyCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13466 
The mintToken function of a smart contract implementation for Crystals, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13467 
The mintToken function of a smart contract implementation for EpiphanyCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13468 
The mintToken function of a smart contract implementation for Cavecoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13469 
The mintToken function of a smart contract implementation for IcoContract, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13470 
The mintToken function of a smart contract implementation for BuyerToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13471 
The mintToken function of a smart contract implementation for BeyondCashToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13472 
The mint function of a smart contract implementation for CloutToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13473 
The mintToken function of a smart contract implementation for ohni_2 (OHNI), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13474 
The mintToken function of a smart contract implementation for FansChainToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13475 
The mintToken function of a smart contract implementation for VSCToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13476 
The mintToken function of a smart contract implementation for PhilCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13477 
The mintToken function of a smart contract implementation for CTESale, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13478 
The mintToken function of a smart contract implementation for DMPToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13479 
The mintToken function of a smart contract implementation for SlidebitsToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13480 
The mintToken function of a smart contract implementation for QRG, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13481 
The mintToken function of a smart contract implementation for TRIUM, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13482 
The mintToken function of a smart contract implementation for ETHERCASH (ETC), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13483 
The mintToken function of a smart contract implementation for mkethToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13484 
The mintToken function of a smart contract implementation for CBRToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13485 
The mintToken function of a smart contract implementation for BitcoinAgileToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13486 
The mintToken function of a smart contract implementation for HELP, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13487 
The mintToken function of a smart contract implementation for PlatoToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13488 
The mintToken function of a smart contract implementation for Crypto Alley Shares (CAST), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13489 
The mintToken function of a smart contract implementation for OllisCoin, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13490 
The mintToken function of a smart contract implementation for FILM, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13491 
The mintToken function of a smart contract implementation for Carrot, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13492 
The mintToken function of a smart contract implementation for naga, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13493 
The mintToken function of a smart contract implementation for DaddyToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13494 
The mintToken function of a smart contract implementation for SusanTokenERC20, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13495 
The mintToken function of a smart contract implementation for KMCToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13496 
The mintToken function of a smart contract implementation for RajTestICO, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z
CVE-2018-13497 
The mintToken function of a smart contract implementation for COBToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T06:00:00.000Z