rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-16039 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16040 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16041 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16042 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass vulnerability. Successful exploitation could lead to information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16043 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16044 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16045 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16046 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16047 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-18T17:00:00.000Z
CVE-2018-16048 
An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Missing Authorization Control for API Repository Storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-03T16:00:00.000Z
CVE-2018-16049 
An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-03T16:00:00.000Z
CVE-2018-16050 
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-03T16:00:00.000Z
CVE-2018-16051 
An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload Files Exposure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-03T16:00:00.000Z
CVE-2018-16055 
An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGUI user with privileges for the affected page to execute commands in the context of the root user when submitting a request to relinquish a DHCP lease for an interface which is configured to obtain its address via DHCP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T22:00:00.000Z
CVE-2018-16056 
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth Attribute Protocol dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by verifying that a dissector for a specific UUID exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T01:00:00.000Z
CVE-2018-16057 
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was addressed in epan/dissectors/packet-ieee80211-radiotap-iter.c by validating iterator operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T01:00:00.000Z
CVE-2018-16058 
In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash. This was addressed in epan/dissectors/packet-btavdtp.c by properly initializing a data structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T01:00:00.000Z
CVE-2018-16059 
Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2018-16060 
Mitsubishi Electric Europe B.V. SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-15T19:04:21.000Z
CVE-2018-16061 
Mitsubishi Electric Europe B.V. SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-15T19:04:31.000Z
CVE-2018-16062 
dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T03:00:00.000Z
CVE-2018-16064 
Insufficient data validation in Extensions API in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-16065 
A Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16066 
A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16067 
A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16068 
Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Out of bounds read and write
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16069 
Unintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-16070 
Integer overflows in Skia in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-16071 
A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16072 
A missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16073 
Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-16074 
Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-16075 
Insufficient file type enforcement in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain local file data via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-16076 
Missing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16077 
Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Problem types: description: Object lifecycle issue
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-16078 
Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16079 
A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Race
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16080 
A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16081 
Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system without file access permission via a crafted Chrome Extension.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16082 
An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16083 
An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16084 
The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16085 
A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16086 
Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-06-27T16:13:41.000Z
CVE-2018-16087 
Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16088 
A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page.
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2018-16089 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-16090 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-16091 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-16092 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-16093 LXCI for VMware
In versions prior to 5.5, LXCI for VMware allows an authenticated user to write to any system file due to insufficient sanitization during the upload of a backup file.
Problem types: description: information disclosure
Affected products: vendor: Lenovo
product: LXCI for VMware
Published: 2018-11-30T14:00:00.000Z
CVE-2018-16094 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-16095 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-16096 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-16097 LXCI for VMware and LXCI for Microsoft System Center
LXCI for VMware versions prior to 5.5 and LXCI for Microsoft System Center versions prior to 3.5, allow an authenticated user to write to any system file due to insufficient sanitization during the upload of a certificate.
Problem types: description: file system modification
Affected products: vendor: Lenovo
product: LXCI for VMware
vendor: Lenovo
product: LXCI for Microsoft System Center
Published: 2018-11-30T14:00:00.000Z
CVE-2018-16098 
In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.
Problem types: description: Code execution
Affected products: vendor: Lenovo Group Ltd.
product: Various ThinkPad products
Published: 2019-01-24T22:00:00.000Z
CVE-2018-16115 
Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. The custom RNG implementations were not configured by default but examples in the documentation showed (and therefore implicitly recommended) using the custom ones. This can be used by an attacker to compromise the communication if these random number generators are enabled in configuration. It would be possible to eavesdrop, replay, or modify the messages sent with Akka Remoting/Cluster.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T22:00:00.000Z
CVE-2018-16116 
SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQL commands via the "username" GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T16:18:55.000Z
CVE-2018-16117 
A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T16:06:13.000Z
CVE-2018-16118 
A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T16:02:54.000Z
CVE-2018-16119 
Stack-based buffer overflow in the httpd server of TP-Link WR1043nd (Firmware Version 3) allows remote attackers to execute arbitrary code via a malicious MediaServer request to /userRpm/MediaServerFoldersCfgRpm.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T15:51:45.000Z
CVE-2018-16130 
System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-16131 
The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T13:00:00.000Z
CVE-2018-16132 
The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed, resulting in a forced restart of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T22:00:00.000Z
CVE-2018-16133 
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T22:00:00.000Z