rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-14809 
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T20:54:24.000Z
CVE-2019-14810 
A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T18:07:51.000Z
CVE-2019-14811 
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Problem types: cwe_id: CWE-648
description: CWE-648
Affected products: vendor: Artifex Software
product: ghostscript
Published: 2019-09-03T15:17:12.000Z
CVE-2019-14812 
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Problem types: cwe_id: CWE-648
description: CWE-648
Affected products: vendor: Red Hat
product: ghostscript
Published: 2019-11-27T13:50:15.000Z
CVE-2019-14813 
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Problem types: cwe_id: CWE-648
description: CWE-648
Affected products: vendor: Artifex Software
product: ghostscript
Published: 2019-09-06T13:27:47.000Z
CVE-2019-14814 
There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Linux
product: kernel
Published: 2019-09-20T18:27:42.000Z
CVE-2019-14815 
A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Linux
product: kernel
Published: 2019-11-25T10:51:15.000Z
CVE-2019-14816 
There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Linux
product: kernel
Published: 2019-09-20T18:25:15.000Z
CVE-2019-14817 
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
Problem types: cwe_id: CWE-648
description: CWE-648
Affected products: vendor: Artifex Software
product: ghostscript
Published: 2019-09-03T15:50:42.000Z
CVE-2019-14818 
A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: DPDK
product: dpdk
Published: 2019-11-14T00:00:00.000Z
CVE-2019-14819 
A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints.
Problem types: cwe_id: CWE-266
description: CWE-266
cwe_id: CWE-270
description: CWE-270
Affected products: vendor: [Red Hat]
product: openshift-ansible
Published: 2020-01-07T17:02:01.000Z
CVE-2019-14820 
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: keycloak
product: keycloak
Published: 2020-01-08T14:50:44.000Z
CVE-2019-14821 
An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: Linux
product: Kernel
Published: 2019-09-19T17:37:24.000Z
CVE-2019-14822 
A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: n/a
product: ibus
Published: 2019-11-25T11:01:18.000Z
CVE-2019-14823 
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: Dogtag
product: JSS
Published: 2019-10-14T19:35:04.000Z
CVE-2019-14824 
A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: [UNKNOWN]
product: 389-ds-base
Published: 2019-11-08T14:45:46.000Z
CVE-2019-14825 
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
Problem types: cwe_id: CWE-312
description: CWE-312
Affected products: vendor: Red Hat
product: katello
Published: 2019-11-25T00:00:00.000Z
CVE-2019-14826 
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.
Problem types: cwe_id: CWE-613
description: CWE-613
Affected products: vendor: Red Hat
product: ipa
Published: 2019-09-17T15:09:31.000Z
CVE-2019-14827 
A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: n/a
product: Moodle
Published: 2021-05-17T15:37:26.000Z
CVE-2019-14828 
A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Moodle
Published: 2021-03-19T20:09:16.000Z
CVE-2019-14829 
A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.
Problem types: cwe_id: CWE-573
description: CWE-573
Affected products: vendor: n/a
product: Moodle
Published: 2021-03-19T20:11:57.000Z
CVE-2019-14830 
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: n/a
product: Moodle
Published: 2021-03-19T20:15:25.000Z
CVE-2019-14831 
A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled. If a forum's subscription mode was set to "forced subscription", the forum's subscribe link contained an open redirect.
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: n/a
product: Moodle
Published: 2021-03-19T20:19:10.000Z
CVE-2019-14832 
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: keycloak
product: keycloak REST API
Published: 2019-10-15T18:13:17.000Z
CVE-2019-14833 
A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.
Problem types: cwe_id: CWE-305
description: CWE-305
Affected products: vendor: Samba
product: samba
Published: 2019-11-06T00:00:00.000Z
CVE-2019-14834 
A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: The Dnsmasq Project
product: dnsmasq
Published: 2020-01-07T16:30:04.000Z
CVE-2019-14835 
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
Problem types: cwe_id: CWE-120
description: CWE-120
Affected products: vendor: Linux Kernel
product: Linux kernel
Published: 2019-09-17T15:09:37.000Z
CVE-2019-14836 
A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access unauthorized information or conduct further attacks.
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: Red Hat 3scale API Management
Published: 2021-05-26T11:18:13.000Z
CVE-2019-14837 
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
Problem types: cwe_id: CWE-547
description: CWE-547
Affected products: vendor: Red Hat
product: keycloak
Published: 2020-01-07T16:33:21.000Z
CVE-2019-14838 
A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Red Hat
product: wildfly-core
Published: 2019-10-14T14:32:53.000Z
CVE-2019-14839 
It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp suite etc.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Business-central
Published: 2022-04-01T22:17:27.000Z
CVE-2019-14840 
A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials.
Problem types: cwe_id: CWE-522
description: CWE-522
Affected products: vendor: n/a
product: Business-central
Published: 2022-10-17T00:00:00.000Z
CVE-2019-14841 
A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin privileges in the Business Central Console.
Problem types: cwe_id: CWE-281
description: CWE-281
Affected products: vendor: n/a
product: Business-central
Published: 2022-10-17T00:00:00.000Z
CVE-2019-14842 
Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data under control of the server is written to memory before the read buffer supplied by the client. If the read buffer is located on the stack then this allows the stack return address from nbd_pread() to be trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is located on the heap then other memory objects before the buffer can be overwritten, which again would usually lead to arbitrary code execution.
Problem types: cwe_id: CWE-681
description: CWE-681
Affected products: vendor: [UNKNOWN]
product: libnbd
Published: 2019-11-26T15:01:26.000Z
CVE-2019-14843 
A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss EAP 7 and Red Hat SSO 7 are vulnerable to this issue.
Problem types: cwe_id: CWE-592
description: CWE-592
Affected products: vendor: Red Hat
product: wildfly-security-manager
Published: 2020-01-07T16:34:59.000Z
CVE-2019-14844 
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC.
Problem types: cwe_id: CWE-628
description: CWE-628
Affected products: vendor: MIT
product: krb5
Published: 2019-09-26T11:50:05.000Z
CVE-2019-14845 
A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hostname verification. An attacker can take advantage of this flaw by launching a man-in-the-middle attack and injecting malicious content.
Problem types: cwe_id: CWE-494
description: CWE-494
Affected products: vendor: Red Hat
product: openshift
Published: 2019-10-08T18:43:24.000Z
CVE-2019-14846 
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.
Problem types: cwe_id: CWE-117
description: CWE-117
cwe_id: CWE-532
description: CWE-532
Affected products: vendor: Red Hat
product: Ansible
Published: 2019-10-08T18:44:09.000Z
CVE-2019-14847 
A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: Samba
product: samba
Published: 2019-11-06T00:00:00.000Z
CVE-2019-14849 
A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.
Problem types: cwe_id: CWE-201
description: CWE-201
Affected products: vendor: n/a
product: 3scale
Published: 2019-12-12T13:14:53.000Z
CVE-2019-14850 
A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
Problem types: cwe_id: CWE-406
description: CWE-406
Affected products: vendor: n/a
product: nbdkit
Published: 2021-03-18T18:56:42.000Z
CVE-2019-14851 
A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1.
Problem types: cwe_id: CWE-617
description: CWE-617
Affected products: vendor: n/a
product: nbdkit
Published: 2021-03-18T19:04:21.000Z
CVE-2019-14852 
A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue.
Problem types: cwe_id: CWE-327
description: CWE-327
Affected products: vendor: n/a
product: apicast
Published: 2021-03-18T19:07:37.000Z
CVE-2019-14853 
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
Problem types: cwe_id: CWE-391
description: CWE-391
Affected products: vendor: [UNKNOWN]
product: python-ecdsa
Published: 2019-11-26T12:06:20.000Z
CVE-2019-14854 
OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.
Problem types: cwe_id: CWE-117
description: CWE-117
Affected products: vendor: Red Hat
product: library-go
Published: 2020-01-07T16:36:45.000Z
CVE-2019-14855 
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Problem types: cwe_id: CWE-326
description: CWE-326
Affected products: vendor: Red Hat
product: gnupg2
Published: 2020-03-20T00:00:00.000Z
CVE-2019-14856 
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: [UNKNOWN]
product: ansible
Published: 2019-11-26T13:01:31.000Z
CVE-2019-14857 
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: [UNKNOWN]
product: mod_auth_openidc
Published: 2019-11-26T11:56:17.000Z
CVE-2019-14858 
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
Problem types: cwe_id: CWE-117
description: CWE-117
cwe_id: CWE-532
description: CWE-532
Affected products: vendor: Red Hat
product: Ansible
Published: 2019-10-14T14:36:50.000Z
CVE-2019-14859 
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.
Problem types: cwe_id: CWE-347
description: CWE-347
Affected products: vendor: Red Hat
product: python-ecdsa
Published: 2020-01-02T14:15:58.000Z
CVE-2019-14860 
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information.
Problem types: cwe_id: CWE-942
description: CWE-942
Affected products: vendor: [UNKNOWN]
product: syndesis
Published: 2019-11-08T14:45:52.000Z