rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-15585 
Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-27T19:01:33.000Z
CVE-2018-15586 
Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T17:00:00.000Z
CVE-2018-15587 
GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T17:00:00.000Z
CVE-2018-15588 
MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T17:00:00.000Z
CVE-2018-15590 
An issue was discovered in Ivanti Workspace Control before 10.3.0.0 and RES One Workspace, when file and folder security are configured. A local authenticated user can bypass file and folder security restriction by leveraging an unspecified attack vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T16:00:00.000Z
CVE-2018-15591 
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can bypass Application Whitelisting restrictions to execute arbitrary code by leveraging multiple unspecified attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T16:00:00.000Z
CVE-2018-15592 
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can execute processes with elevated privileges via an unspecified attack vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T16:00:00.000Z
CVE-2018-15593 
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can decrypt the encrypted datastore or relay server password by leveraging an unspecified attack vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T16:00:00.000Z
CVE-2018-15594 
arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T08:00:00.000Z
CVE-2018-15596 
An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can generate a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15. The thread titles (within title elements of the generated XML documents) aren't sanitized, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T19:00:00.000Z
CVE-2018-15598 
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T01:00:00.000Z
CVE-2018-15599 
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T01:00:00.000Z
CVE-2018-15601 
apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T02:00:00.000Z
CVE-2018-15602 
Zyxel VMG3312 B10B devices are affected by a persistent XSS vulnerability via the pages/connectionStatus/connectionStatus-hostEntry.cmd hostname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-26T21:00:00.000Z
CVE-2018-15603 
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T02:00:00.000Z
CVE-2018-15605 
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-24T19:00:00.000Z
CVE-2018-15606 
An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T17:00:00.000Z
CVE-2018-15607 
In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T15:00:00.000Z
CVE-2018-15608 
Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T19:00:00.000Z
CVE-2018-15610 Improper access controls in IP Office one-X Portal
A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Avaya
product: IP Office
Published: 2018-09-12T21:00:00.000Z
CVE-2018-15611 Communication Manager Local Administrator PrivEsc
A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Avaya
product: Communication Manager
Published: 2018-09-27T23:00:00.000Z
CVE-2018-15612 Orchestration Designer Runtime Config CSRF
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Avaya
product: Orchestration Designer
Published: 2018-09-21T18:00:00.000Z
CVE-2018-15613 Orchestration Designer Runtime Config XSS
A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
Affected products: vendor: Avaya
product: Orchestration Designer
Published: 2018-09-21T18:00:00.000Z
CVE-2018-15614 IP Office one-X Portal XSS
A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Avaya
product: IP Office
Published: 2019-01-23T17:00:00.000Z
CVE-2018-15615 CMS Supervisor Information Disclosure
A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: Avaya
product: Call Management System Supervisor
Published: 2018-09-24T13:00:00.000Z
CVE-2018-15616 System Platform Web UI Deserialization
A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Avaya
product: Avaya Aura® System Platform
Published: 2018-10-17T19:00:00.000Z
CVE-2018-15617 Communication Manager Denial of Service
A vulnerability in the "capro" (Call Processor) process component of Avaya Aura Communication Manager could allow a remote, unauthenticated user to cause denial of service. Affected versions include 6.3.x, all 7.x versions prior to 7.1.3.2, and all 8.x versions prior to 8.0.1.
Problem types: cwe_id: CWE-399
description: CWE-399: Resource Management Errors
Affected products: vendor: Avaya
product: Communication Manager
Published: 2019-02-01T15:00:00.000Z
CVE-2018-15631 
Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
Published: 2019-04-09T15:41:20.000Z
CVE-2018-15632 
Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
Credits: lang: en
value: P. Valov (SoCyber)
Published: 2020-12-22T16:25:31.000Z
CVE-2018-15633 
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
Credits: lang: en
value: Nathanael ROTA (Capgemini)
lang: en
value: Lauri Vakkala (Silverskin)
lang: en
value: Tomas Canzoniero
Published: 2020-12-22T16:25:32.000Z
CVE-2018-15634 
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
Credits: lang: en
value: Nathanael ROTA (Capgemini)
lang: en
value: Alessandro Innocenti
Published: 2020-12-22T16:25:33.000Z
CVE-2018-15635 
Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a crafted name.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
Published: 2019-04-09T15:41:20.000Z
CVE-2018-15638 
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
Credits: lang: en
value: Subash SN and Bharath Kumar (Appsecco)
lang: en
value: Dipanshu Agrawal
Published: 2020-12-22T16:25:33.000Z
CVE-2018-15640 
Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Odoo
product: Odoo Enterprise
Published: 2019-04-09T15:41:20.453Z
CVE-2018-15641 
Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
Credits: lang: en
value: msg systems ag
lang: en
value: Lauri Vakkala (Silverskin)
lang: en
value: Bharath Kumar (Appsecco)
lang: en
value: Anıl Yüksel
lang: en
value: Aitor Fuentes (kr0no)
Published: 2020-12-22T16:25:34.000Z
CVE-2018-15645 
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Odoo
product: Odoo Community
vendor: Odoo
product: Odoo Enterprise
Credits: lang: en
value: Nils Hamerlinck (Trobz)
Published: 2020-12-22T16:25:35.000Z
CVE-2018-15655 
An issue was discovered in 42Gears SureMDM before 2018-11-27, related to CORS settings. Cross-origin access is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T03:00:00.000Z
CVE-2018-15656 
An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email, where :email is a base64 encoded e-mail address, to receive confirmation as to whether a user account exists in the system with the specified e-mail address. The request must be made with an "apiKey" value in the "ApiKey" header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T03:00:00.000Z
CVE-2018-15657 
An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T03:00:00.000Z
CVE-2018-15658 
An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master.html, an attacker is able to see the markup that would be presented to an authenticated user. This is caused by the session validation occurring after the initial markup is loaded. This results in a list of unprotected API endpoints that disclose call logs, SMS logs, and user-account data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T03:00:00.000Z
CVE-2018-15659 
An issue was discovered in 42Gears SureMDM before 2018-11-27, related to the access policy for Silverlight applications. Cross-origin access is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T03:00:00.000Z
CVE-2018-15660 
An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions, then the attacker can read certain Ola Money data such as a credit card number, expiration date, bank account number, and transaction history. NOTE: the vendor does not agree that this is a security issue requiring a fix
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T17:00:00.000Z
CVE-2018-15661 
An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions and the ability to read SMS messages, then the Forgot Password screen can be used to bypass authentication. NOTE: the vendor does not agree that this is a security issue requiring a fix
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T17:00:00.000Z
CVE-2018-15664 
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T13:58:37.000Z
CVE-2018-15665 
An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.2.x through 1.4.0. Unauthenticated users can get a list of user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-21T14:18:37.000Z
CVE-2018-15667 
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. It registers and uses the airmail:// URL scheme. The "send" command in the URL scheme allows an external application to send arbitrary emails from an active account without authentication. The handler has no restriction on who can use its functionality. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an attacker crafted email from the target account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T23:00:00.000Z
CVE-2018-15668 
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary emails from an active account. URL parameters for the "send" command with the "attachment_" prefix designate attachment parameters. If the value of an attachment parameter corresponds to an accessible file path, the file is attached to the outbound message. In addition, relative file paths are acceptable attachment parameter values. The handler can be invoked using any method that invokes the URL handler such as a hyperlink in an email. The user is not prompted when the handler processes the "send" command, thus leading to automatic transmission of an email with designated attachments from the target account to a target address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T23:00:00.000Z
CVE-2018-15669 
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are not forbidden by the policy. An attacker may abuse HTML plug-in elements within an email to trigger frame navigation requests that bypass this filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T23:00:00.000Z
CVE-2018-15670 
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. A navigation request is processed by the default URL handler only if the currentEvent is NX_LMOUSEUP or NX_OMOUSEUP. An attacker may abuse HTML elements with an EventHandler for a chance to validate navigation requests for URLs that are processed during the NX_LMOUSEUP event triggered by clicking an email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T23:00:00.000Z
CVE-2018-15671 
An issue was discovered in the HDF HDF5 1.10.2 library. Excessive stack consumption has been detected in the function H5P__get_cb() in H5Pint.c during an attempted parse of a crafted HDF file. This results in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-21T23:00:00.000Z
CVE-2018-15676 
An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-15677 
The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-15678 
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-15679 
An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-15680 
An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-15681 
An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie can efficiently brute-force it to retrieve the user's cleartext password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z