rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-12474 
Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T15:58:05.000Z
CVE-2019-12475 
In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T16:10:34.000Z
CVE-2019-12476 
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T17:02:28.000Z
CVE-2019-12477 
Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri&uri= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T14:51:07.000Z
CVE-2019-12479 
An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in the LocalStorageProvider allows creating and reading files outside of the specified basepath. If the application using this library does not sanitize user-supplied filenames, then this issue may be exploited to read or write arbitrary files. This affects LocalStorageProvider.cs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T20:46:14.000Z
CVE-2019-12480 
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, AtomicReadFile and DeviceCommunicationControl services. An unauthenticated remote attacker could cause a denial of service (bacserv daemon crash) because there is an invalid read in bacdcode.c during parsing of alarm tag numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-30T21:53:09.000Z
CVE-2019-12481 
An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function GetESD at isomedia/track.c in libgpac.a, as demonstrated by MP4Box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-30T22:40:36.000Z
CVE-2019-12482 
An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function gf_isom_get_original_format_type at isomedia/drm_sample.c in libgpac.a, as demonstrated by MP4Box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-30T22:40:44.000Z
CVE-2019-12483 
An issue was discovered in GPAC 0.7.1. There is a heap-based buffer overflow in the function ReadGF_IPMPX_RemoveToolNotificationListener in odf/ipmpx_code.c in libgpac.a, as demonstrated by MP4Box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-30T22:40:57.000Z
CVE-2019-12489 
An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices. By using the usb_remove service through an HTTP request, it is possible to inject and execute a command between two & characters in the mount parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-26T14:42:40.000Z
CVE-2019-12490 
An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. Reverse tabnabbing can occur because of use of _blank for external links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T05:10:39.000Z
CVE-2019-12491 
OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors. To exploit the vulnerability an attacker has to have control of a single server on a given cloud (e.g. by renting one). From the source server, the attacker can craft any command and trigger the OnApp platform to execute that command with root privileges on a target server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T15:42:37.000Z
CVE-2019-12492 
Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information disclosure via the FT Command Centre Service and FT Controller Service services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T19:29:20.000Z
CVE-2019-12493 
A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace mishandle tint transform functions. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T01:12:02.000Z
CVE-2019-12494 
In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T18:44:33.000Z
CVE-2019-12495 
An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to a one-byte out-of-bounds write in the gsym_addr function in x86_64-gen.c. This occurs because tccasm.c mishandles section switches.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T10:45:28.000Z
CVE-2019-12496 
An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T10:59:23.000Z
CVE-2019-12497 
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents (e.g., Name and mail address) can be disclosed in external notes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T00:00:00.000Z
CVE-2019-12498 
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T18:37:23.000Z
CVE-2019-12499 
Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T11:35:12.000Z
CVE-2019-12500 
The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T11:55:23.000Z
CVE-2019-12502 
There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T12:04:55.000Z
CVE-2019-12503 
Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:57:30.000Z
CVE-2019-12504 
Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T20:23:34.000Z
CVE-2019-12505 
Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T20:04:48.000Z
CVE-2019-12506 
Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T20:26:42.000Z
CVE-2019-12507 
An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T13:44:24.000Z
CVE-2019-12510 Auth Bypass Via X-Forwarded-For Header in SOAP API
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa") by supplying a malicious X-Forwarded-For header of the device's LAN IP address (192.168.1.1) in every request. As a result, an attacker may modify almost all of the device's settings and view various configuration settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T18:16:22.000Z
CVE-2019-12511 Root Command Injection via MAC Address in SOAP API
In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC. Although this requires QoS being enabled, advanced QoS being enabled, and a valid authentication JWT, additional vulnerabilities (CVE-2019-12510) allow an attacker to interact with the entire SOAP API without authentication. Additionally, DNS rebinding techniques may be used to exploit this vulnerability remotely. Exploiting this vulnerability is somewhat involved. The following limitations apply to the payload and must be overcome for successful exploitation: - No more than 17 characters may be used. - At least one colon must be included to prevent mangling. - A single-quote and meta-character must be used to break out of the existing command. - Parent command remnants after the injection point must be dealt with. - The payload must be in all-caps. Despite these limitations, it is still possible to gain access to an interactive root shell via this vulnerability. Since the web server assigns certain HTTP headers to environment variables with all-caps names, it is possible to insert a payload into one such header and reference the subsequent environment variable in the injection point.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T18:16:26.000Z
CVE-2019-12512 Stored XSS via X-Forwarded-For Header During Incorrect Login
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs, found at Advanced settings->Administration->Logs, and may trigger when the page is viewed. Although this value is inserted into a textarea tag, the attack simply needs to supply a closing textarea tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T18:16:28.000Z
CVE-2019-12513 Stored XSS via DHCP Discover Request Hostname
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing the malicious hostname. This log entry may then be viewed at Advanced settings->Administration->Logs to trigger the exploit. Although this value is inserted into a textarea tag, converted to all-caps, and limited in length, attacks are still possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T18:16:30.000Z
CVE-2019-12515 
There is an out-of-bounds read vulnerability in the function FlateStream::getChar() located at Stream.cc in Xpdf 4.01.01. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure or a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-01T23:39:32.000Z
CVE-2019-12516 
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-13T12:19:23.000Z
CVE-2019-12517 
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress backend for all users with at least Subscriber rights. Because the plugin does not properly validate and sanitize this data, a malicious payload in either the name or email field is executed directly within the backend at /wp-admin/admin.php?page=slickquiz across all users with the privileges of at least Subscriber.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-13T12:20:44.000Z
CVE-2019-12518 
Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:49:52.000Z
CVE-2019-12519 
An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T19:20:41.000Z
CVE-2019-12520 
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T19:14:25.000Z
CVE-2019-12521 
An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T18:47:43.000Z
CVE-2019-12522 
An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T19:00:01.000Z
CVE-2019-12523 
An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-26T16:39:59.000Z
CVE-2019-12524 
An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T18:35:11.000Z
CVE-2019-12525 
An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T18:17:49.000Z
CVE-2019-12526 
An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-26T16:41:57.000Z
CVE-2019-12527 
An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T18:10:16.000Z
CVE-2019-12528 
An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-04T20:07:15.000Z
CVE-2019-12529 
An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T18:33:55.000Z
CVE-2019-12530 
Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-02T16:03:30.000Z
CVE-2019-12532 
Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T17:06:07.000Z
CVE-2019-12537 
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:17:44.000Z
CVE-2019-12538 
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T14:40:41.000Z
CVE-2019-12539 
An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:16:35.000Z