rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-11013 
Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with firmware version 1.10B05 allows unauthenticated remote attackers to execute arbitrary code via a request with a long HTTP Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-13T15:00:00.000Z
CVE-2018-11017 
The newVar_N function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-13T21:00:00.000Z
CVE-2018-11018 
An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-13T22:00:00.000Z
CVE-2018-11019 
kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 3221773726 and cause a kernel crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T22:00:00.000Z
CVE-2018-11020 
kernel/omap/drivers/rpmsg/rpmsg_omx.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device file /dev/rpmsg-omx1 with the command 3221772291, and cause a kernel crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T22:00:00.000Z
CVE-2018-11021 
kernel/omap/drivers/video/omap2/dsscomp/device.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/dsscomp with the command 1118064517 and cause a kernel crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T22:00:00.000Z
CVE-2018-11022 
kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 3224132973 and cause a kernel crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T22:00:00.000Z
CVE-2018-11023 
kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 3222560159 and cause a kernel crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T22:00:00.000Z
CVE-2018-11024 
kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 1077435789 and cause a kernel crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T22:00:00.000Z
CVE-2018-11025 
kernel/omap/drivers/mfd/twl6030-gpadc.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/twl6030-gpadc with the command 24832 and cause a kernel crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T22:00:00.000Z
CVE-2018-11027 
A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-29T20:00:00.000Z
CVE-2018-11031 
application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an api[url]=file:////etc/passwd&api[method]=get POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-14T00:00:00.000Z
CVE-2018-11032 
PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-14T00:00:00.000Z
CVE-2018-11033 
The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JPEG data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-14T00:00:00.000Z
CVE-2018-11034 
In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x8000200D.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-14T01:00:00.000Z
CVE-2018-11035 
In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCTL 0x80002019.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-14T01:00:00.000Z
CVE-2018-11036 
Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale) on vSZ, SZ-100, SZ-300, and SCG-200 devices allows remote attackers to obtain sensitive information or modify data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-31T12:00:00.000Z
CVE-2018-11037 
In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-14T03:00:00.000Z
CVE-2018-11039 
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Problem types: description: Cross Site Tracing
Affected products: vendor: Pivotal
product: Spring Framework
Published: 2018-06-25T15:00:00.000Z
CVE-2018-11040 
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Problem types: description: JSONP enabled by default in MappingJackson2JsonView
Affected products: vendor: Pivotal
product: Spring Framework
Published: 2018-06-25T15:00:00.000Z
CVE-2018-11041 
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.
Problem types: description: Open Redirect
Affected products: vendor: Cloud Foundry
product: Cloud Foundry UAA
Published: 2018-06-25T15:00:00.000Z
CVE-2018-11044 
Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0.17 and 1.12.x prior to 1.12.26, does not escape all user-provided content when sending invitation emails. A malicious authenticated user can inject content into an invite to another user, exploiting the trust implied by the source of the email.
Problem types: description: Information exposure
Affected products: vendor: Pivotal
product: Pivotal Application Service
Published: 2018-07-24T19:00:00.000Z
CVE-2018-11045 
Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the contents of the corresponding seed from the published image and therefore infer the initial state of the LRNG.
Problem types: description: Random number generation
Affected products: vendor: Pivotal
product: Pivotal Operations Manager
Published: 2018-07-11T20:00:00.000Z
CVE-2018-11046 
Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches. An attacker with access to the NGINX processes and knowledge of how to exploit the unpatched vulnerabilities may be able to impact Operations Manager
Problem types: description: unpatched vulnerabilities
Affected products: vendor: Pivotal
product: Operations Manager
Published: 2018-06-25T15:00:00.000Z
CVE-2018-11047 
Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.
Problem types: description: Application Logic Error
Affected products: vendor: Cloud Foundry
product: Cloud Foundry UAA
Published: 2018-07-24T19:00:00.000Z
CVE-2018-11048 
Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request.
Problem types: description: XML External Entity Vulnerability
Affected products: vendor: Dell EMC
product: Data Protection Advisor
vendor: Dell EMC
product: Integrated Data Protection Appliance
Published: 2018-08-10T20:00:00.000Z
CVE-2018-11049 RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability
RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system.
Problem types: description: uncontrolled search path vulnerability
Affected products: vendor: Pivotal
product: Pivotal Operations Manager
Published: 2018-07-11T20:00:00.000Z
CVE-2018-11050 
Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in the Rabbit MQ Advanced Message Queuing Protocol (AMQP) component. User credentials are sent unencrypted to the remote AMQP service. An unauthenticated attacker in the same network collision domain, could potentially sniff the password from the network and use it to access the component using the privileges of the compromised user.
Problem types: description: Clear-Text authentication over network vulnerability
Affected products: vendor: Dell EMC
product: Networker
Published: 2018-08-01T06:00:00.000Z
CVE-2018-11051 RSA Certificate Manager Path Traversal Vulnerability
RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enroll Server. A remote unauthenticated attacker could potentially exploit this vulnerability by manipulating input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
Problem types: description: Authentication Bypass Vulnerability
Affected products: vendor: RSA
product: Certificate Manager Path Traversal Vulnerability
Published: 2018-07-03T17:00:00.000Z
CVE-2018-11052 Dell EMC ECS S3 Authentication Bypass Vulnerability
Dell EMC ECS versions 3.2.0.0 and 3.2.0.1 contain an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to read and modify S3 objects by supplying specially crafted S3 requests.
Problem types: description: Authentication Bypass Vulnerability
Affected products: vendor: Dell EMC
product: ECS
Published: 2018-07-03T17:00:00.000Z
CVE-2018-11053 iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability
Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privileged operating system user or process could modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content.
Problem types: description: Improper File Permission Vulnerability
Affected products: vendor: Dell EMC
product: iDRAC Service Module
Published: 2018-06-26T22:00:00.000Z
CVE-2018-11054 
RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service.
Problem types: description: integer overflow vulnerability
Affected products: vendor: RSA
product: BSAFE Micro Edition Suite
Published: 2018-08-31T18:00:00.000Z
CVE-2018-11055 
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability. Decoded PKCS #12 data in heap memory is not zeroized by MES before releasing the memory internally and a malicious local user could gain access to the unauthorized data by doing heap inspection.
Problem types: description: Improper Clearing of Heap Memory Before Release ('Heap Inspection') vulnerability
Affected products: vendor: RSA
product: BSAFE Micro Edition Suite
Published: 2018-08-31T18:00:00.000Z
CVE-2018-11056 
RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would exhaust the stack, potentially causing a Denial Of Service.
Problem types: description: Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability
Affected products: vendor: RSA
product: BSAFE Micro Edition Suite
vendor: RSA
product: BSAFE Crypto-C Micro Edition
Published: 2018-08-31T18:00:00.000Z
CVE-2018-11057 
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key.
Problem types: description: Covert Timing Channel vulnerability
Affected products: vendor: RSA
product: BSAFE Micro Edition Suite
Published: 2018-08-31T18:00:00.000Z
CVE-2018-11058 
RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 (in 4.0.x) contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would result in such issue.
Problem types: description: Buffer Over-Read vulnerability
Affected products: vendor: RSA
product: BSAFE Micro Edition Suite
vendor: RSA
product: BSAFE  Crypto-C Micro Edition
Published: 2018-09-14T20:00:00.000Z
CVE-2018-11059 
RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.
Problem types: description: Stored Cross-Site Scripting Vulnerability
Affected products: vendor: Dell EMC
product: RSA Archer
Published: 2018-07-24T19:00:00.000Z
CVE-2018-11060 
RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user could potentially exploit this vulnerability to elevate their privileges.
Problem types: description: REST API Authorization Bypass Vulnerability
Affected products: vendor: Dell EMC
product: RSA Archer
Published: 2018-07-24T19:00:00.000Z
CVE-2018-11061 
RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execute arbitrary commands on the server with root privileges.
Problem types: description: server-side template injection vulnerability
Affected products: vendor: Dell EMC
product: RSA NetWitness
vendor: Dell EMC
product: RSA Security Analytics
Published: 2018-08-24T15:00:00.000Z
CVE-2018-11062 Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability
Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default passwords may potentially log in to the system and gain read and write access to certain system files.
Problem types: description: Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability
Affected products: vendor: Dell EMC
product: Integrated Data Protection Appliance
Published: 2018-11-02T22:00:00.000Z
CVE-2018-11063 
Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affected software installs multiple services incorrectly by specifying the paths to the service executables without quotes. This could potentially allow a low-privileged local user to execute arbitrary executables with elevated privileges.
Problem types: description: Unquoted Service Path Vulnerabilities
Affected products: vendor: Dell
product: Wyse Management Suite
Published: 2018-08-10T20:00:00.000Z
CVE-2018-11064 
Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability to alter multiple library files in service tools that might result in arbitrary code execution with elevated privileges. No user file systems are directly affected by this vulnerability.
Problem types: description: Incorrect File Permissions
Affected products: vendor: Dell EMC
product: Dell EMC Unity
vendor: Dell EMC
product: Dell EMC UnityVSA
Published: 2018-10-05T21:00:00.000Z
CVE-2018-11065 
The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injection vulnerability. A malicious user could potentially exploit this vulnerability to execute SQL commands on the back-end database to read certain data. Embedded WorkPoint is upgraded to version 4.10.16, which contains a fix for the vulnerability.
Problem types: description: SQL injection vulnerability
Affected products: vendor: Dell EMC
product: RSA Archer
Published: 2018-08-24T15:00:00.000Z
CVE-2018-11066 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability
Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain a Remote Code Execution vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary commands on the server.
Problem types: description: Remote Code Execution Vulnerability
Affected products: vendor: Dell EMC
product: Avamar
vendor: Dell EMC
product: Integrated Data Protection Appliance
Published: 2018-11-26T20:00:00.000Z
CVE-2018-11067 Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability
Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites.
Problem types: description: Open Redirection Vulnerability
Affected products: vendor: Dell EMC
product: Avamar
vendor: Dell EMC
product: Integrated Data Protection Appliance
Published: 2018-11-26T20:00:00.000Z
CVE-2018-11068 
RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physical access to the system to recover sensitive key material.
Problem types: description: Improper Clearing of Heap Memory Before Release ('Heap Inspection') Vulnerability
Affected products: vendor: Dell EMC
product: RSA BSAFE SSL-J
Published: 2018-09-11T19:00:00.000Z
CVE-2018-11069 
RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key.
Problem types: description: Covert Timing Channel Vulnerability
Affected products: vendor: Dell EMC
product: RSA BSAFE SSL-J
Published: 2018-09-11T19:00:00.000Z
CVE-2018-11070 
RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS #1 unpadding operations, also known as a Bleichenbacher attack. A remote attacker may be able to recover a RSA key.
Problem types: description: Covert Timing Channel Vulnerability
Affected products: vendor: Dell EMC
product: RSA BSAFE Crypto-J
vendor: Dell EMC
product: RSA BSAFE SSL-J
Published: 2018-09-11T19:00:00.000Z