rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-6360 
mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-28T02:00:00.000Z
CVE-2018-6361 
Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z
CVE-2018-6362 
Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z
CVE-2018-6363 
SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T05:00:00.000Z
CVE-2018-6364 
SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T05:00:00.000Z
CVE-2018-6365 
SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T05:00:00.000Z
CVE-2018-6367 
SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T05:00:00.000Z
CVE-2018-6368 
SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6370 
SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under the all-offers/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6372 
SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6373 
SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6374 
The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate Validation. This can lead to the manipulation of the Pulse Connection set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T21:00:00.000Z
CVE-2018-6376 
In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T17:00:00.000Z
CVE-2018-6377 
In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T17:00:00.000Z
CVE-2018-6378 
In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-22T15:00:00.000Z
CVE-2018-6379 
In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T17:00:00.000Z
CVE-2018-6380 
In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T17:00:00.000Z
CVE-2018-6381 
In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T17:00:00.000Z
CVE-2018-6382 
MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T06:00:00.000Z
CVE-2018-6383 
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T18:00:00.000Z
CVE-2018-6384 
Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with elevated privileges on the system via a malicious program.exe executable in the %SYSTEMDRIVE% folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T16:00:00.000Z
CVE-2018-6387 
iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of support for the support account, and a hardcoded password of user for the user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T18:00:00.000Z
CVE-2018-6388 
iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping test arguments on the Diagnostics page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T18:00:00.000Z
CVE-2018-6389 
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T17:00:00.000Z
CVE-2018-6390 
The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of the source memory block before an _copy call, which allows remote attackers to cause a denial of service (access violation and application crash) via a crafted (a) web page, (b) office document, or (c) .rtf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T19:00:00.000Z
CVE-2018-6391 
A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation List settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T19:00:00.000Z
CVE-2018-6392 
The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T19:00:00.000Z
CVE-2018-6393 
FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can "directly modify SQL tables ... [or] run shell scripts ... once ... logged in to the administration interface; there is no need to try to find input validation errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T20:00:00.000Z
CVE-2018-6394 
SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6395 
SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T15:00:00.000Z
CVE-2018-6396 
SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a layout=form_markers action, or the map parameter in a layout=default action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-17T07:00:00.000Z
CVE-2018-6397 
Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T15:00:00.000Z
CVE-2018-6398 
SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T15:00:00.000Z
CVE-2018-6400 
Kingsoft WPS Office Free 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of \\.\pipe\WPSCloudSvr\WpsCloudSvr -- an "insecurely created named pipe." Ensures full access to Everyone users group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T21:00:00.000Z
CVE-2018-6401 
Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T07:00:00.000Z
CVE-2018-6402 
Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal. An attacker must be able to set up a nearby SSID, similar to an "Evil Twin" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-14T18:40:34.000Z
CVE-2018-6405 
In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T21:00:00.000Z
CVE-2018-6406 
The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm through 2018-01-30 does not validate the child_frame_length data obtained from a .webm file, which allows remote attackers to cause an information leak or a denial of service (heap-based buffer over-read and later out-of-bounds write), or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T21:00:00.000Z
CVE-2018-6407 
An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to /hy-cgi/devices.cgi?cmd=searchlandevice. The crash completely freezes the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T21:00:00.000Z
CVE-2018-6408 
An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. CSRF exists in hy-cgi/user.cgi, as demonstrated by changing an administrator password or adding a new administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-30T21:00:00.000Z
CVE-2018-6409 
An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding ap_form table leads to a path traversal vulnerability via the download.php q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T22:00:00.000Z
CVE-2018-6410 
An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T22:00:00.000Z
CVE-2018-6411 
An issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to the filters. If the filter is set to a whitelist, the dangerous extensions can be bypassed through ap_form_elements SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-26T22:00:00.000Z
CVE-2018-6412 
In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T07:00:00.000Z
CVE-2018-6413 
There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerability allows remote attackers to launch a denial of service attack (service interruption) via a crafted network setting interface request.
Problem types: description: Buffer Overflow
Affected products: vendor: hikvision
product: DS-2CD9111-S
Published: 2018-04-18T15:00:00.000Z
CVE-2018-6414 
A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially crafted message to affected devices. Due to the insufficient input validation, successful exploit can corrupt memory and lead to arbitrary code execution or crash the process.
Problem types: description: Buffer Overflow
Affected products: vendor: hikvision
product: DS-2DE4xxxW,DS-2DE5xxxW,DS-2DE7xxxW
Published: 2018-08-13T15:00:00.000Z
CVE-2018-6433 
A vulnerability in the secryptocfg export command of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to bypass the export file access restrictions and initiate a file copy from the source to a remote system.
Problem types: description: Privilege Escalation
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-11-08T14:00:00.000Z
CVE-2018-6434 
A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a user's session ID.
Problem types: description: Session Hijacking
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-11-08T14:00:00.000Z
CVE-2018-6435 
A Vulnerability in the secryptocfg command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, and gain root access.
Problem types: description: Privilege Escalation
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-11-08T14:00:00.000Z
CVE-2018-6436 
A Vulnerability in the firmwaredownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.
Problem types: description: Privilege Escalation
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-11-08T19:00:00.000Z
CVE-2018-6437 
A Vulnerability in the help command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.
Problem types: description: Privilege Escalation
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-11-08T19:00:00.000Z
CVE-2018-6438 
A Vulnerability in the supportsave command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.
Problem types: description: Privilege Escalation
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-11-08T19:00:00.000Z
CVE-2018-6439 
A Vulnerability in the configdownload command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.
Problem types: description: Privilege Escalation
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-12-03T22:00:00.000Z
CVE-2018-6440 
A vulnerability in the proxy service of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow remote unauthenticated attackers to obtain sensitive information and possibly cause a denial of service attack.
Problem types: description: Information Exposure
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-12-03T22:00:00.000Z
CVE-2018-6441 
A vulnerability in Secure Shell implementation of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to provide arbitrary environment variables, and bypass the restricted configuration shell.
Problem types: description: Privilege Escalation
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-11-08T14:00:00.000Z
CVE-2018-6442 
A vulnerability in the Brocade Webtools firmware update section of Brocade Fabric OS before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow remote authenticated attackers to execute arbitrary commands.
Problem types: description: Code Injection
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Fabric OS
Published: 2018-11-08T14:00:00.000Z
CVE-2018-6443 
A vulnerability in Brocade Network Advisor Versions before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interface of an affected system using an undocumented user credentials and install additional JEE applications. A remote unauthenticated user who has access to Network Advisor client libraries and able to decrypt the Jboss credentials could gain access to the Jboss web console.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Network Advisor
Published: 2019-01-22T17:00:00.000Z
CVE-2018-6444 
A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands.
Problem types: description: Remote Code Execution
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Network Advisor
Published: 2019-01-22T17:00:00.000Z
CVE-2018-6445 
A Vulnerability in Brocade Network Advisor versions before 14.0.3 could allow a remote unauthenticated attacker to export the current user database which includes the encrypted (not hashed) password of the systems. The attacker could gain access to the Brocade Network Advisor System after extracting/decrypting the passwords.
Problem types: description: Improper Access Control
Affected products: vendor: Brocade Communications Systems, Inc.
product: Brocade Network Advisor
Published: 2019-01-22T17:00:00.000Z
CVE-2018-6446 
A vulnerability in Brocade Network Advisor Version Before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interface of an affected system using an undocumented user credentials and install additional JEE applications.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Brocade Network Advisor
Published: 2020-06-29T17:43:11.000Z
CVE-2018-6447 
A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g could allow authenticated attackers with access to the web interface to hijack a user’s session and take over the account.
Problem types: description: Reflective XSS Vulnerability
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:06:37.000Z
CVE-2018-6448 
A vulnerability in the management interface in Brocade Fabric OS Versions before Brocade Fabric OS v9.0.0 could allow a remote attacker to perform a denial of service attack on the vulnerable host.
Problem types: description: denial of service attack
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:08:37.000Z
CVE-2018-6449 
Host Header Injection vulnerability in the http management interface in Brocade Fabric OS versions before v9.0.0 could allow a remote attacker to exploit this vulnerability by injecting arbitrary HTTP headers
Problem types: description: Host Header Injection
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:08:25.000Z
CVE-2018-6458 
Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z
CVE-2018-6459 
The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that lacks a mask generation function parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-20T15:00:00.000Z
CVE-2018-6460 
Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including configuration. User controlled input is not sufficiently filtered: an unauthenticated attacker can send a POST request to /status.js with the parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including whether the user is connected to a VPN, to which VPN he/she is connected, and what is their real IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-31T17:00:00.000Z