rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-3995 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Foxit Software
product: Foxit PDF Reader
Published: 2018-10-03T15:00:00.000Z
CVE-2018-3996 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Foxit Software
product: Foxit PDF Reader
Published: 2018-10-08T16:00:00.000Z
CVE-2018-3997 
An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Foxit Software
product: Foxit PDF Reader
Published: 2018-10-08T16:00:00.000Z
CVE-2018-3998 
An exploitable heap-based buffer overflow vulnerability exists in the Windows enhanced metafile parser of Atlantis Word Processor, version 3.2.5.0. A specially crafted image embedded within a document can cause an undersized allocation, resulting in an overflow when the application tries to copy data into it. An attacker must convince a victim to open a document in order to trigger this vulnerability.
Problem types: description: heap-based buffer overflow
Affected products: vendor: The Atlantis Word Processor Team
product: Atlantis Word Processor
Published: 2018-10-01T20:00:00.000Z
CVE-2018-3999 
An exploitable stack-based buffer overflow vulnerability exists in the JPEG parser of Atlantis Word Processor, version 3.2.5.0. A specially crafted image embedded within a document can cause a length to be miscalculated and underflow. This length is then treated as unsigned and then used in a copying operation. Due to the length underflow, the application will then write outside the bounds of a stack buffer, resulting in a buffer overflow. An attacker must convince a victim to open a document in order to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: The Atlantis Word Processor Team
product: Atlantis Word Processor
Published: 2018-10-01T20:00:00.000Z
CVE-2018-4000 
An exploitable double-free vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0. A specially crafted document can cause a TTableRow instance to be referenced twice, resulting in a double-free vulnerability when both the references go out of scope. An attacker must convince a victim to open a document in order to trigger this vulnerability.
Problem types: description: double free code execution
Affected products: vendor: The Atlantis Word Processor Team
product: Atlantis Word Processor
Published: 2018-10-01T20:00:00.000Z
CVE-2018-4001 
An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0. A specially crafted document can cause an uninitialized pointer representing a TTableRow to be assigned to a variable on the stack. This variable is later dereferenced and then written to allow for controlled heap corruption, which can lead to code execution under the context of the application. An attacker must convince a victim to open a document in order to trigger this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-01T20:00:00.000Z
CVE-2018-4002 
An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packets, the firewall unsafely handles label compression pointers, leading to an uncontrolled recursion that eventually exhausts the stack, crashing the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: n/a
product: CUJO
Published: 2019-10-31T20:37:17.000Z
CVE-2018-4003 
An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. The string lengths are handled incorrectly when parsing character strings in mDNS resource records, leading to arbitrary code execution in the context of the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
Problem types: description: heap overflow
Affected products: vendor: n/a
product: CUJO
Published: 2019-03-21T15:05:44.000Z
CVE-2018-4004 
An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the disconnectService functionality. A non-root user is able to kill any privileged process on the system. An attacker would need local access to the machine for a successful exploit.
Problem types: description: local privilege escalation
Affected products: vendor: n/a
product: Shimo VPN
Published: 2019-04-17T14:15:43.000Z
CVE-2018-4005 
An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the configureRoutingWithCommand function. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine for a successful exploit.
Problem types: description: local privilege escalation
Affected products: vendor: n/a
product: Shimo VPN
Published: 2019-04-17T14:15:36.000Z
CVE-2018-4006 
An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the writeConfig functionality. A non-root user is able to write a file anywhere on the system. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to exploit it successfully.
Problem types: description: local privilege escalation
Affected products: vendor: n/a
product: Shimo VPN
Published: 2019-04-17T14:35:06.000Z
CVE-2018-4007 
An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the deleteConfig functionality. The program is able to delete any protected file on the system. An attacker would need local access to the machine to successfully exploit the bug.
Problem types: description: local privilege escalation
Affected products: vendor: n/a
product: Shimo VPN
Published: 2019-04-17T14:15:20.000Z
CVE-2018-4008 
An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the RunVpncScript command. The command takes a user-supplied script argument and executes it under root context. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to successfully exploit this bug.
Problem types: description: local privilege escalation
Affected products: vendor: n/a
product: Shimo VPN
Published: 2019-04-15T19:46:21.000Z
CVE-2018-4009 
An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to successfully exploit this bug.
Problem types: description: local privilege escalation
Affected products: vendor: n/a
product: Shimo VPN
Published: 2019-04-15T19:46:16.000Z
CVE-2018-4010 
An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specially crafted configuration file can cause a privilege escalation, resulting in the ability to execute arbitrary commands with the system's privileges.
Problem types: description: OS command injection
Affected products: vendor: Talos
product: ProtonVPN
Published: 2018-09-07T15:00:00.000Z
CVE-2018-4011 
An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003. When parsing SRV records in an mDNS packet, the "RDLENGTH" value is handled incorrectly, leading to an out-of-bounds access that crashes the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
Problem types: description: integer underflow
Affected products: vendor: n/a
product: CUJO
Published: 2019-03-21T15:42:40.000Z
CVE-2018-4012 
An exploitable buffer overflow vulnerability exists in the HTTP header-parsing function of the Webroot BrightCloud SDK. The function bc_http_read_header incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud server to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: n/a
product: Webroot
Published: 2019-01-03T23:00:00.000Z
CVE-2018-4013 
An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
Problem types: description: Stack-based buffer overflow
Affected products: vendor: Live Networks
product: LIVE555 Media Server
Published: 2018-10-19T13:00:00.000Z
CVE-2018-4014 
An exploitable code execution vulnerability exists in Wi-Fi Command 9999 of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
Problem types: description: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: Anker
Published: 2019-05-13T15:21:40.000Z
CVE-2018-4015 
An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightCloud server to exploit this vulnerability.
Problem types: description: Improper Certificate Validation
Affected products: vendor: n/a
product: Webroot
Published: 2018-12-18T14:00:00.000Z
CVE-2018-4016 
An exploitable code execution vulnerability exists in the URL-parsing functionality of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
Problem types: description: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: Anker
Published: 2019-05-13T15:21:45.000Z
CVE-2018-4017 
An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version RoavA1SWV1.9. A set of default credentials can potentially be used to connect to the device. An attacker can connect to the AP to trigger this vulnerability.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: n/a
product: Anker
Published: 2019-05-13T15:21:49.000Z
CVE-2018-4018 
An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9. The HTTP server allows for arbitrary firmware binaries to be uploaded which will be flashed upon next reboot. An attacker can send an HTTP PUT request or upgrade firmware request to trigger this vulnerability.
Problem types: description: External Control of File Name or Path
Affected products: vendor: n/a
product: Novatek
Published: 2019-05-13T15:40:29.000Z
CVE-2018-4019 
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_normal_mode` parameter.
Problem types: description: OS command injection
Affected products: vendor: Netgate
product: Netgate pfSense
Published: 2018-12-03T22:00:00.000Z
CVE-2018-4020 
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_ac_mode` POST parameter parameter.
Problem types: description: OS command injection
Affected products: vendor: Netgate
product: Netgate pfSense
Published: 2018-12-03T22:00:00.000Z
CVE-2018-4021 
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The attacker can exploit this and gain the ability to execute arbitrary commands on the system. An attacker needs to be able to send authenticated POST requests to the administration web interface. Command injection is possible in the `powerd_battery_mode` POST parameter.
Problem types: description: OS command injection
Affected products: vendor: Netgate
product: Netgate pfSense
Published: 2018-12-03T22:00:00.000Z
CVE-2018-4022 
A use-after-free vulnerability exists in the way MKVToolNix MKVINFO v25.0.0 handles the MKV (matroska) file format. A specially crafted MKV file can cause arbitrary code execution in the context of the current user.
Problem types: description: use-after-free
Affected products: vendor: n/a
product: MKVToolNix
Published: 2018-10-26T17:00:00.000Z
CVE-2018-4023 
An exploitable code execution vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution.
Problem types: description: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: Novatek
Published: 2019-05-13T15:24:21.000Z
CVE-2018-4024 
An exploitable denial-of-service vulnerability exists in the thumbnail display functionality of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a null pointer dereference, resulting in a device reboot.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Novatek
Published: 2019-05-13T15:42:44.000Z
CVE-2018-4025 
An exploitable denial-of-service vulnerability exists in the XML_GetRawEncJpg Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause an invalid memory dereference, resulting in a device reboot.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Novatek
Published: 2019-05-13T15:24:37.000Z
CVE-2018-4026 
An exploitable denial-of-service vulnerability exists in the XML_GetScreen Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted set of packets can cause an invalid memory dereference, resulting in a device reboot.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Novatek
Published: 2019-05-13T15:24:31.000Z
CVE-2018-4027 
An exploitable denial-of-service vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a semaphore deadlock, which prevents the device from receiving any physical or network inputs. An attacker can send a specially crafted packet to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Novatek
Published: 2019-05-13T15:40:40.000Z
CVE-2018-4028 
An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. The HTTP server could allow an attacker to overwrite the root directory of the server, resulting in a denial of service. An attacker can send an HTTP POST request to trigger this vulnerability.
Problem types: description: Incorrect Default Permissions
Affected products: vendor: n/a
product: Novatek
Published: 2019-05-13T15:40:35.000Z
CVE-2018-4029 
An exploitable code execution vulnerability exists in the HTTP request-parsing function of the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause an unlimited and arbitrary write to memory, resulting in code execution.
Problem types: description: Classic Buffer Overflow
Affected products: vendor: n/a
product: Novatek
Published: 2019-05-13T15:42:50.000Z
CVE-2018-4030 
An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function parses HTTP requests. The "Host" header is incorrectly extracted from captured HTTP requests, which would allow an attacker to visit any malicious websites and bypass the firewall. An attacker could send an HTTP request to exploit this vulnerability.
Problem types: description: 'HTTP Request Smuggling
Affected products: vendor: n/a
product: CUJO
Published: 2019-03-21T15:46:08.000Z
CVE-2018-4031 
An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without prior sanitization, which results in arbitrary Lua script execution in the kernel. An attacker could send an HTTP request to exploit this vulnerability.
Problem types: description: Improper control of generation of code
Affected products: vendor: n/a
product: CUJO
Published: 2019-10-31T20:29:02.000Z
CVE-2018-4032 
An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inputs. An attacker with local access could use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful exploit.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4033 
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4034 
The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4035 
The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local access could use this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4036 
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use this vulnerability to modify the running kernel extensions on the system.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4037 
The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access can use this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4038 
An exploitable arbitrary write vulnerability exists in the open document format parser of the Atlantis Word Processor, version 3.2.7.2, while trying to null-terminate a string. A specially crafted document can allow an attacker to pass an untrusted value as a length to a constructor. This constructor will miscalculate a length and then use it to calculate the position to write a null byte. This can allow an attacker to corrupt memory, which can result in code execution under the context of the application. An attacker must convince a victim to open a specially crafted document in order to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Talos
product: Atlantis Word Processor
Published: 2018-12-01T18:00:00.000Z
CVE-2018-4039 
An exploitable out-of-bounds write vulnerability exists in the PNG implementation of Atlantis Word Processor, version 3.2.7.2. This can allow an attacker to corrupt memory, which can result in code execution under the context of the application. An attacker must convince a victim to open a specially crafted document in order to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Talos
product: Atlantis Word Processor
Published: 2018-12-01T19:00:00.000Z
CVE-2018-4040 
An exploitable uninitialized pointer vulnerability exists in the rich text format parser of Atlantis Word Processor, version 3.2.7.2. A specially crafted document can cause certain RTF tokens to dereference a pointer that has been uninitialized and then write to it. An attacker must convince a victim to open a specially crafted document in order to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Talos
product: Atlantis Word Processor
Published: 2018-12-01T20:00:00.000Z
CVE-2018-4041 
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4042 
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z