rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-5981 
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5982 
SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5983 
SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5984 
SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the category/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T10:00:00.000Z
CVE-2018-5985 
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T10:00:00.000Z
CVE-2018-5986 
SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T10:00:00.000Z
CVE-2018-5987 
SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay action, the searchVal parameter in a view=search action, or the uid parameter in a view=likes action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5988 
SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T10:00:00.000Z
CVE-2018-5989 
SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue to CVE-2011-5099.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5990 
SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5991 
SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5992 
SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5993 
SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5994 
SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resume request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-5995 
The pcpu_embed_first_chunk function in mm/percpu.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a "pages/cpu" printk call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-07T18:00:00.000Z
CVE-2018-5996 
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T18:00:00.000Z
CVE-2018-5997 
An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a path traversal vulnerability, it is possible to upload a file on a filesystem with root privileges: this will lead to remote code execution as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-25T17:00:00.000Z
CVE-2018-5999 
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T20:00:00.000Z
CVE-2018-6000 
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T20:00:00.000Z
CVE-2018-6001 
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php (war_sdy_pl_preview parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T20:00:00.000Z
CVE-2018-6002 
The Soundy Background Music plugin 3.9 and below for WordPress has Cross-Site Scripting via soundy-background-music\templates\front-end.php (war_soundy_preview parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T20:00:00.000Z
CVE-2018-6003 
An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T20:00:00.000Z
CVE-2018-6004 
SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6005 
SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6006 
SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6007 
CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T05:00:00.000Z
CVE-2018-6008 
Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T05:00:00.000Z
CVE-2018-6009 
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T22:00:00.000Z
CVE-2018-6010 
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T22:00:00.000Z
CVE-2018-6011 
The time-based one-time-password (TOTP) function in the application logic of the Green Electronics RainMachine Mini-8 (2nd generation) uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "Use of Password Hash Instead of Password for Authentication" issue. This is exploitable by an attacker who discovers a hash value in the rainmachine-settings.sqlite file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-6012 
The 'Weather Service' feature of the Green Electronics RainMachine Mini-8 (2nd generation) allows an attacker to inject arbitrary Python code via the 'Add new weather data source' upload function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-6013 
Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter. This issue exists in core/admin/ajax/developer/extensions/file-browser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-23T00:00:00.000Z
CVE-2018-6014 
Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to steal user data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-23T00:00:00.000Z
CVE-2018-6015 
An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-26T20:00:00.000Z
CVE-2018-6016 
Unquoted Windows search path vulnerability in the srvInventoryWebServer service in 10-Strike Network Monitor 5.4 allows local users to gain privileges via a malicious artefact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T21:00:00.000Z
CVE-2018-6017 
Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by sniffing network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T15:00:00.000Z
CVE-2018-6018 
Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T15:00:00.000Z
CVE-2018-6019 
Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use encryption during information transmission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T20:00:00.000Z
CVE-2018-6020 
In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-09T21:00:00.000Z
CVE-2018-6021 
Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not properly sanitized, which may allow remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-09T21:00:00.000Z
CVE-2018-6022 
Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-23T06:00:00.000Z
CVE-2018-6023 
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi activating, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z
CVE-2018-6024 
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-18T20:00:00.000Z
CVE-2018-6029 
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery (SSRF), because URL validation only considers whether the URL contains the "csdn" substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-23T06:00:00.000Z
CVE-2018-6031 
Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6032 
Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6033 
Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted Chrome Extension.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6034 
Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6035 
Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6036 
Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6037 
Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestures via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6038 
Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6039 
Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6040 
Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6041 
Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6042 
Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6043 
Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary programs on user machine via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6045 
Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6046 
Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6047 
Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6048 
Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6049 
Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is granted via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6050 
Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6051 
XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6052 
Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain referrer details from a web page that had thought it had opted out of sending referrer data.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6053 
Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing browser data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6054 
Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6055 
Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-09-25T14:00:00.000Z
CVE-2018-6056 
Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-6057 
Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass inter-process read only guarantees via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-6060 
Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-6061 
A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Race
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-6062 
Heap overflow write in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Problem types: description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-6063 
Incorrect use of mojo::WrapSharedMemoryHandle in Mojo in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z
CVE-2018-6064 
Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2018-11-14T15:00:00.000Z