rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-12100 
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T11:00:00.000Z
CVE-2018-12101 
CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T16:47:15.000Z
CVE-2018-12102 
md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T13:00:00.000Z
CVE-2018-12103 
An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with firmware 1.21B04beta04 and earlier devices (all hardware revisions). Due to the predictability of the /docs/captcha_(number).jpeg URI, being local to the network, but unauthenticated to the administrator's panel, an attacker can disclose the CAPTCHAs used by the access point and can elect to load the CAPTCHA of their choosing, leading to unauthorized login attempts to the access point.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T20:00:00.000Z
CVE-2018-12104 
Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/new_report.kp URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-17T20:00:00.000Z
CVE-2018-12108 
An issue was discovered in Dropbox Lepton 1.2.1. The validateAndCompress function in validation.cc allows remote attackers to cause a denial of service (SIGFPE and application crash) via a malformed file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T13:00:00.000Z
CVE-2018-12109 
An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The TransformPaletteC<FileIO>::process function in transform/palette_C.hpp allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PAM image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T13:00:00.000Z
CVE-2018-12110 
portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T13:00:00.000Z
CVE-2018-12111 
Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the /wt3/mydocs.php URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T13:00:00.000Z
CVE-2018-12112 
md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T14:00:00.000Z
CVE-2018-12113 
Core FTP LE version 2.2 Build 1921 is prone to a buffer overflow vulnerability that may result in a DoS or remote code execution via a PASV response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T20:00:00.000Z
CVE-2018-12114 
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-14T17:00:00.000Z
CVE-2018-12115 
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: The Node.js Project
product: Node.js
Published: 2018-08-21T13:00:00.000Z
CVE-2018-12116 
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Problem types: cwe_id: CWE-115
description: CWE-115: Misinterpretation of Input
Affected products: vendor: The Node.js Project
product: Node.js
Published: 2018-11-28T17:00:00.000Z
CVE-2018-12120 
Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.
Problem types: cwe_id: CWE-419
description: CWE-419: Unprotected Primary Channel
Affected products: vendor: The Node.js Project
product: Node.js
Published: 2018-11-28T17:00:00.000Z
CVE-2018-12121 
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption / Denial of Service
Affected products: vendor: The Node.js Project
product: Node.js
Published: 2018-11-28T17:00:00.000Z
CVE-2018-12122 
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption / Denial of Service
Affected products: vendor: The Node.js Project
product: Node.js
Published: 2018-11-28T17:00:00.000Z
CVE-2018-12123 
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
Problem types: cwe_id: CWE-115
description: CWE-115: Misinterpretation of Input
Affected products: vendor: The Node.js Project
product: Node.js
Published: 2018-11-28T17:00:00.000Z
CVE-2018-12126 
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Central ProcCVE-2018-12126essing Units (CPUs)
Published: 2019-05-30T15:36:05.000Z
CVE-2018-12127 
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Central Processing Units (CPUs)
Published: 2019-05-30T15:38:38.000Z
CVE-2018-12130 
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Central Processing Units (CPUs)
Published: 2019-05-30T15:40:44.000Z
CVE-2018-12131 
Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an authenticated user to potentially escalate privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel NVMe and Intel RSTe
Published: 2018-10-10T14:00:00.000Z
CVE-2018-12147 
Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) CSME Assets Advisory
Published: 2019-06-13T15:36:24.000Z
CVE-2018-12148 
Privilege escalation in file permissions in Intel Driver and Support Assistant before 3.5.0.1 may allow an authenticated user to potentially execute code as administrator via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) Driver & Support Assistant
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12149 
Buffer overflow in input handling in Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to potentially deny service to the application via local access.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Intel(R) Extreme Tuning Utility
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12150 
Escalation of privilege in Installer for Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to potentially execute code or disclose information as administrator via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) Extreme Tuning Utility
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12151 
Buffer overflow in installer for Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to potentially cause a buffer overflow potentially leading to a denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Intel(R) Extreme Tuning Utility
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12152 
Pointer corruption in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.5058 (aka 15.40.x.5058) may allow an unauthenticated remote user to potentially execute arbitrary WebGL code via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel Graphics Driver
Published: 2018-10-10T18:00:00.000Z
CVE-2018-12153 
Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.5058 (aka 15.40.x.5058) may allow an unprivileged user from a virtual machine guest to potentially crash the host system via local access.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Intel Graphics Driver
Published: 2018-10-10T18:00:00.000Z
CVE-2018-12154 
Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.5058 (aka 15.40.x.5058) may allow an unprivileged user to potentially create an infinite loop and crash an application via local access.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Intel Graphics Driver
Published: 2018-10-15T18:00:00.000Z
CVE-2018-12155 
Data leakage in cryptographic libraries for Intel IPP before 2019 update1 release may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Intel Integrated Performance Primitives
Published: 2018-12-05T21:00:00.000Z
CVE-2018-12158 
Insufficient input validation in BIOS update utility in Intel NUC FW kits downloaded before May 24, 2018 may allow a privileged user to potentially trigger a denial of service or information disclosure via local access.
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Intel NUC Firmware Kits
Published: 2018-10-10T18:00:00.000Z
CVE-2018-12159 
Buffer overflow in the command-line interface for Intel(R) PROSet Wireless v20.50 and before may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-18T17:00:00.000Z
CVE-2018-12160 
DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may allow an authenticated user to potentially execute code using default directory permissions via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) Data Migration Software
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12161 
Insufficient session validation in the webserver component of the Intel Rapid Web Server 3 may allow an unauthenticated user to potentially disclose information via network access.
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Intel RAID Web Server 3
Published: 2018-10-10T18:00:00.000Z
CVE-2018-12162 
Directory permissions in the Intel OpenVINO Toolkit for Windows before version 2018.1.265 may allow an authenticated user to potentially execute code using default directory permissions via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) OpenVINO(TM) Toolkit for Windows
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12163 
A DLL injection vulnerability in the Intel IoT Developers Kit 4.0 installer may allow an authenticated user to potentially escalate privileges using file modification via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel IoT Developers Kit
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12166 
Insufficient write protection in firmware for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Intel(R) Optane(TM) SSD DC P4800X
Published: 2019-01-10T20:00:00.000Z
CVE-2018-12167 
Firmware update routine in bootloader for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Intel(R) Optane(TM) SSD DC P4800X
Published: 2019-01-10T20:00:00.000Z
CVE-2018-12168 
Privilege escalation in file permissions in Intel Computing Improvement Program before version 2.2.0.03942 may allow an authenticated user to potentially execute code as administrator via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) Computing Improvement Program
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12169 
Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation Intel Core Processor and 8th Generation Intel Core Processor contains a logic error which may allow physical attacker to potentially bypass firmware authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T20:00:00.000Z
CVE-2018-12171 
Privilege escalation in Intel Baseboard Management Controller (BMC) firmware before version 1.43.91f76955 may allow an unprivileged user to potentially execute arbitrary code or perform denial of service over the network.
Problem types: description: Escalation of Privilege, Denial of Service
Affected products: vendor: Intel Corporation
product: Intel(R) Baseboard Management Controller (BMC) firmware
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12172 
Improper password hashing in firmware in Intel Server Board (S7200AP,S7200APR) and Intel Compute Module (HNS7200AP, HNS7200AP) may allow a privileged user to potentially disclose firmware passwords via local access.
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Intel Server Board
Published: 2018-10-10T18:00:00.000Z
CVE-2018-12173 
Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial of service via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: Intel Corporation
product: Intel Server Boards Firmware
Published: 2018-10-10T18:00:00.000Z
CVE-2018-12174 
Heap overflow in Intel Trace Analyzer 2018 in Intel Parallel Studio XE 2018 Update 3 may allow an authenticated user to potentially escalate privileges via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel Parallel Studio XE 2018
Published: 2018-11-14T14:00:00.000Z
CVE-2018-12175 
Default install directory permissions in Intel Distribution for Python (IDP) version 2018 may allow an unprivileged user to escalate privileges via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) Distribution for Python 2018
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12176 
Improper input validation in firmware for Intel NUC Kits may allow a privileged user to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial of service via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: Intel Corporation
product: Intel(R) NUC Kits and Intel(R) Compute Cards
Published: 2018-09-12T19:00:00.000Z
CVE-2018-12177 
Improper directory permissions in the ZeroConfig service in Intel(R) PROSet/Wireless WiFi Software before version 20.90.0.7 may allow an authorized user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) PROSet/Wireless WiFi Software
Published: 2019-01-10T20:00:00.000Z
CVE-2018-12178 
Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network.
Problem types: description: Escalation of Privilege and/or Denial of Service
Affected products: vendor: Extensible Firmware Interface Development Kit (EDK II)
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2019-03-27T19:19:31.000Z
CVE-2018-12179 
Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
Problem types: description: Escalation of Privilege, Information Disclosure and/or Denial of Service
Affected products: vendor: Extensible Firmware Interface Development Kit (EDK II)
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2019-03-27T19:21:22.000Z
CVE-2018-12180 
Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access.
Problem types: description: Escalation of Privilege, Information Disclosure and/or Denial of Service
Affected products: vendor: Extensible Firmware Interface Development Kit (EDK II)
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2019-03-27T19:22:10.000Z
CVE-2018-12181 
Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.
Problem types: description: Escalation of Privilege and/or Denial of Service
Affected products: vendor: Extensible Firmware Interface Development Kit (EDK II)
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2019-03-27T19:23:00.000Z
CVE-2018-12182 
Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
Problem types: description: Escalation of Privilege, Information Disclosure and/or Denial of Service
Affected products: vendor: Extensible Firmware Interface Development Kit (EDK II)
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2019-03-27T19:18:40.000Z
CVE-2018-12183 
Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
Problem types: description: Escalation of Privilege, Information Disclosure and/or Denial of Service
Affected products: vendor: Extensible Firmware Interface Development Kit (EDK II)
product: Extensible Firmware Interface Development Kit (EDK II)
Published: 2019-03-27T19:17:46.000Z
CVE-2018-12185 
Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially execute arbitrary code via physical access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) CSME, Server Platform Services, Trusted Execution Engine and Intel(R) Active Management Technology
Published: 2019-03-14T20:00:00.000Z
CVE-2018-12187 
Insufficient input validation in Intel(R) Active Management Technology (Intel(R) AMT) before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially cause a denial of service via network access.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Intel(R) CSME, Server Platform Services, Trusted Execution Engine and Intel(R) Active Management Technology
Published: 2019-03-14T20:00:00.000Z