rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-7825 
A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ
Published: 2019-05-22T19:32:25.000Z
CVE-2018-7826 
A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ
Published: 2019-05-22T19:33:00.000Z
CVE-2018-7827 
A Cross-Site Scripting (XSS) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which a remote attacker can execute arbitrary HTML and script code in a user’s browser session.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ
Published: 2019-05-22T19:33:25.000Z
CVE-2018-7828 
A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user clicks a specially crafted malicious link while logged into the camera.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ
Published: 2019-05-22T19:34:25.000Z
CVE-2018-7829 
An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which allows an attacker to execute arbitrary system commands.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ
Published: 2019-05-22T19:35:13.000Z
CVE-2018-7830 
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for ~1 minute by sending a specially crafted HTTP request.
Problem types: description: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Affected products: vendor: Schneider Electric SE
product: Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Published: 2018-11-30T19:00:00.000Z
CVE-2018-7831 
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a password change on the web server.
Problem types: description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Schneider Electric SE
product: Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Published: 2018-11-30T19:00:00.000Z
CVE-2018-7832 
An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution arbitrary executable when GP-Pro EX is launched.
Problem types: description: Improper Input Validation
Affected products: vendor: Schneider Electric SE
product: Pro-Face GP-Pro EX v4.08 and previous versions
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7833 
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can send a specially crafted XML data via a POST request to cause the web server to become unavailable
Problem types: description: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Schneider Electric SE
product: Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Published: 2018-12-17T22:00:00.000Z
CVE-2018-7834 
A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded script to a user that would then be executed within the context of that user.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-Site Scripting
Affected products: vendor: n/a
product: ConneXium Gateway, TSXETG100 - all versions
Published: 2019-05-22T19:49:15.000Z
CVE-2018-7835 
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user.
Problem types: description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Schneider Electric SE
product: IIoT Monitor 3.1.38
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7836 
An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files.
Problem types: description: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Schneider Electric SE
product: IIoT Monitor 3.1.38
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7837 
An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its output and expose restricted information.
Problem types: description: Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Schneider Electric SE
product: IIoT Monitor 3.1.38
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7838 
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.
Problem types: cwe_id: CWE-119
description: CWE-119 Buffer Errors
Affected products: vendor: Modicon
product: Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16
Published: 2019-07-15T20:49:01.000Z
CVE-2018-7839 
A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure.
Problem types: description: Cryptographic Issue
Affected products: vendor: Schneider Electric SE
product: IIoT Monitor 3.1.38
Published: 2019-02-06T23:00:00.000Z
CVE-2018-7840 
A Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter versions prior to 3.1 which could allow an attacker to cause the system to call an incorrect DLL.
Problem types: description: Uncontrolled Search Path Element
Affected products: vendor: VideoXpert
product: VideoXpert OpsCenter versions prior to 3.1
Published: 2019-05-22T19:24:55.000Z
CVE-2018-7841 
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Problem types: description: SQL Injection
Affected products: vendor: U.motion
product: U.motion Builder software version 1.3.4
Published: 2019-05-22T19:20:54.000Z
CVE-2018-7842 
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T19:59:46.000Z
CVE-2018-7843 
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T19:58:58.000Z
CVE-2018-7844 
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:06:09.000Z
CVE-2018-7845 
A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:00:49.000Z
CVE-2018-7846 
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T19:57:42.000Z
CVE-2018-7847 
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:00:04.000Z
CVE-2018-7848 
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T19:59:26.000Z
CVE-2018-7849 
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending files the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T19:58:16.000Z
CVE-2018-7850 
A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:00:27.000Z
CVE-2018-7851 
CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware prior to V2.40, All firmware versions of Modicon Premium and 140CRA312xxx when sending a specially crafted Modbus packet, which could cause a denial of service to the device that would force a restart to restore availability.
Problem types: cwe_id: CWE-119
description: CWE-119: Buffer errors
Affected products: vendor: n/a
product: Modicon M580 with firmware prior to V2.50 Modicon M340 with firmware prior to V3.01 BMxCRA312xx with firmware prior to V2.40 All firmware versions of Modicon Premium and 140CRA312xxx
Published: 2019-05-22T19:56:24.000Z
CVE-2018-7852 
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:01:12.000Z
CVE-2018-7853 
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:02:11.000Z
CVE-2018-7854 
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service when sending invalid debug parameters to the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:02:52.000Z
CVE-2018-7855 
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:03:17.000Z
CVE-2018-7856 
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:03:45.000Z
CVE-2018-7857 
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: Modicon M580 Modicon M340 Modicon Quantum Modicon Premium
Published: 2019-05-22T20:04:10.000Z
CVE-2018-7858 
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T21:00:00.000Z
CVE-2018-7859 
A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote attacker to inject malicious scripts in the device and execute commands via browser that is configuring the unit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T19:23:34.000Z
CVE-2018-7866 
A NULL pointer dereference was discovered in newVar3 in util/decompile.c in libming 0.4.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7867 
There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 during a RegisterNumber sprintf. A Crafted input will lead to a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7868 
There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. A Crafted input will lead to a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7869 
There is a memory leak triggered in the function dcinit of util/decompile.c in libming 0.4.8, which will lead to a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7870 
An invalid memory address dereference was discovered in getString in util/decompile.c in libming 0.4.8 for CONSTANT16 data. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7871 
There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT16 data. A crafted input will lead to a denial of service or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7872 
An invalid memory address dereference was discovered in the function getName in libming 0.4.8 for CONSTANT16 data. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7873 
There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for INTEGER data. A Crafted input will lead to a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7874 
An invalid memory address dereference was discovered in strlenext in util/decompile.c in libming 0.4.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7875 
There is a heap-based buffer over-read in the getString function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. A Crafted input will lead to a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7876 
In libming 0.4.8, a memory exhaustion vulnerability was found in the function parseSWF_ACTIONRECORD in util/parser.c, which allows remote attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7877 
There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 for DOUBLE data. A Crafted input will lead to a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T18:00:00.000Z
CVE-2018-7884 
An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl_1956.exe is run as SYSTEM on the %systemroot%\Temp folder, where any user can write a DLL (e.g., version.dll) to perform DLL Hijacking and elevate privileges to SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T21:00:00.000Z
CVE-2018-7886 
An issue was discovered in CloudMe 1.11.0. An unauthenticated local attacker that can connect to the "CloudMe Sync" client application listening on 127.0.0.1 port 8888 can send a malicious payload causing a buffer overflow condition. This will result in code execution, as demonstrated by a TCP reverse shell, or a crash. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-6892.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T02:00:00.000Z
CVE-2018-7889 
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T21:00:00.000Z
CVE-2018-7890 
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-08T22:00:00.000Z
CVE-2018-7891 
The Milestone XProtect Video Management Software (Corporate, Expert, Professional+, Express+, Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a) contains .NET Remoting endpoints that are vulnerable to deserialization attacks resulting in remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T15:00:00.000Z
CVE-2018-7893 
CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T03:00:00.000Z
CVE-2018-7894 
Eramba e1.0.6.033 has Reflected XSS in reviews/filterIndex/ThirdPartyRiskReview via the advanced_filter parameter (aka the Search Parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-09T15:00:00.000Z
CVE-2018-7899 
The Mali Driver of Huawei Berkeley-AL20 and Berkeley-BD smart phones with software Berkeley-AL20 8.0.0.105(C00), 8.0.0.111(C00), 8.0.0.112D(C00), 8.0.0.116(C00), 8.0.0.119(C00), 8.0.0.119D(C00), 8.0.0.122(C00), 8.0.0.132(C00), 8.0.0.132D(C00), 8.0.0.142(C00), 8.0.0.151(C00), Berkeley-BD 1.0.0.21, 1.0.0.22, 1.0.0.23, 1.0.0.24, 1.0.0.26, 1.0.0.29 has a double free vulnerability. An attacker can trick a user to install a malicious application and exploit this vulnerability when in the exception handling process. Successful exploitation may cause system reboot.
Problem types: description: double free
Affected products: vendor: Huawei Technologies Co., Ltd.
product: Berkeley-AL20, Berkeley-BD
Published: 2018-04-19T14:00:00.000Z
CVE-2018-7900 
There is an information leak vulnerability in some Huawei HG products. An attacker may obtain information about the HG device by exploiting this vulnerability.
Problem types: description: information leak
Affected products: vendor: Huawei Technologies Co., Ltd.
product: some HG products
Published: 2019-01-02T16:00:00.000Z