rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-16196 
Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00 - R6.03.10), CENTUM VP Entry Class(R4.01.00 - R6.03.10), Exaopc(R3.10.00 - R3.75.00), PRM(R2.06.00 - R3.31.00), ProSafe-RS(R1.02.00 - R4.02.00), FAST/TOOLS(R9.02.00 - R10.02.00), B/M9000 VP(R6.03.01 - R8.01.90)) allows remote attackers to cause a denial of service attack that may result in stopping Vnet/IP Open Communication Driver's communication via unspecified vectors.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: Yokogawa Electric Corporation
product: Multiple Yokogawa products that contain Vnet/IP Open Communication Driver
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16197 
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to bypass access restriction to access the information and files stored on the affected device.
Problem types: description: Fails to restrict access
Affected products: vendor: Toshiba Lighting & Technology Corporation
product: Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16198 
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same network segment to access a non-documented developer screen to perform operations on the affected device.
Problem types: description: Hidden Functionality
Affected products: vendor: Toshiba Lighting & Technology Corporation
product: Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16199 
Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an remote attacker to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Toshiba Lighting & Technology Corporation
product: Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16200 
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute arbitrary OS commands.
Problem types: description: OS Command Injection
Affected products: vendor: Toshiba Lighting & Technology Corporation
product: Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16201 
Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on the same network segment to login to the administrators settings screen and change the configuration or execute arbitrary OS commands.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: Toshiba Lighting & Technology Corporation
product: Toshiba Home gateway HEM-GW16A and Toshiba Home gateway HEM-GW26A
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16202 
Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors.
Problem types: description: Directory Traversal
Affected products: vendor: npm, Inc.
product: cordova-plugin-ionic-webview
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16203 
PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: PgPool Global Development Group
product: PgpoolAdmin
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16204 
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Arne Brachhold
product: Google XML Sitemaps
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16205 
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2019-01-09T22:00:00.000Z
CVE-2018-16206 
Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Yohsuke Ohkouchi
product: spam-byebye
Published: 2019-01-13T00:00:00.000Z
CVE-2018-16207 
PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit unauthorized files via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: OMRON SOCIAL SOLUTIONS Co.,Ltd.
product: PowerAct Pro Master Agent for Windows
Published: 2019-03-27T13:17:58.000Z
CVE-2018-16210 
WAGO 750-88X and WAGO 750-89X Ethernet Controller devices, versions 01.09.18(13) and before, have XSS in the SNMP configuration via the webserv/cplcfg/snmp.ssi SNMP_DESC or SNMP_LOC_SNMP_CONT field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-12T20:00:00.000Z
CVE-2018-16216 
A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.12) VoIP phone allows an authenticated remote attacker in the same network as the device to trigger OS commands (like starting telnetd or opening a reverse shell) via a POST request to the web server. In combination with another attack (unauthenticated password change), the attacker can circumvent the authentication requirement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T19:52:20.000Z
CVE-2018-16217 
The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated attacker to trigger OS commands or open a reverse shell via command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T17:52:30.000Z
CVE-2018-16218 
A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone SIP-T41P firmware version 66.83.0.35 allows a remote attacker to trigger code execution or settings modification on the device by providing a crafted link to the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T17:56:20.000Z
CVE-2018-16219 
A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the device) to change the admin password without authentication via a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T19:56:44.000Z
CVE-2018-16220 
Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker (local or remote) to inject JavaScript into the web interface of the device by manipulating the phone book entries or manipulating the domain name sent to the device from the domain controller.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T19:57:37.000Z
CVE-2018-16221 
The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) does not validate (escape) the path information (path traversal), which allows an authenticated remote attacker to get access to privileged information (e.g., /etc/passwd) via path traversal (relative path information in the file parameter of the corresponding POST request).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T17:59:34.000Z
CVE-2018-16222 
Cleartext Storage of credentials in the iSmartAlarmData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to retrieve the username and password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-16223 
Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamera_preferences.xml in the QBee Cam application through 1.0.5 for Android allows an attacker to retrieve the username and password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-16224 
Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted TCP request to port 12345 and 22306, and access sensitive information from the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-20T19:00:00.000Z
CVE-2018-16225 
The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android), which results in an attacker being able to reuse cookies to bypass authentication and disable the camera.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T21:00:00.000Z
CVE-2018-16226 
A vulnerability in the web admin component of Mitel MiVoice Office 400, versions R5.0 HF3 (v8839a1) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack, due to insufficient validation for the start.asp page. A successful exploit could allow the attacker to execute arbitrary scripts to access sensitive browser-based information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-16227 
The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T15:44:35.000Z
CVE-2018-16228 
The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T15:46:38.000Z
CVE-2018-16229 
The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T15:48:05.000Z
CVE-2018-16230 
The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T15:49:01.000Z
CVE-2018-16231 
Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (daemon crash) via an unspecified sequence of FTP commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T22:00:00.000Z
CVE-2018-16232 
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with privileges for the affected page to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T14:00:00.000Z
CVE-2018-16233 
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T22:00:00.000Z
CVE-2018-16234 
MorningStar WhatWeb 0.4.9 has XSS via JSON report files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T22:00:00.000Z
CVE-2018-16235 
Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-23T21:00:00.000Z
CVE-2018-16236 
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T22:00:00.000Z
CVE-2018-16237 
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T22:00:00.000Z
CVE-2018-16238 
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T22:00:00.000Z
CVE-2018-16239 
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-30T22:00:00.000Z
CVE-2018-16242 
oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-14T21:00:00.000Z
CVE-2018-16243 
SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-15T22:31:23.000Z
CVE-2018-16247 
YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T15:48:54.000Z
CVE-2018-16248 
b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T15:46:52.000Z
CVE-2018-16249 
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T13:54:12.000Z
CVE-2018-16250 
The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first name" and "last name" parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T13:42:10.000Z
CVE-2018-16251 
A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T13:23:46.000Z
CVE-2018-16252 
FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-16253 
In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509 certificates. This is an even more permissive variant of CVE-2006-4790 and CVE-2014-1568.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-07T20:00:00.000Z
CVE-2018-16254 
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-12T17:57:02.000Z
CVE-2018-16255 
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-12T17:59:02.000Z
CVE-2018-16256 
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-12T18:00:13.000Z
CVE-2018-16257 
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-12T18:02:31.000Z
CVE-2018-16258 
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-12T18:03:54.000Z
CVE-2018-16259 
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-12T18:05:35.000Z
CVE-2018-16261 
In Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege Escalation Vulnerability with Dynamic Certificate Trust.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T23:00:00.000Z
CVE-2018-16262 
The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations. Such actions include installing, decrypting, and killing other packages. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T12:20:33.000Z
CVE-2018-16263 
The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T12:41:08.000Z
CVE-2018-16264 
The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T12:42:59.000Z
CVE-2018-16265 
The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing process, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T12:45:43.000Z
CVE-2018-16266 
The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T12:15:27.000Z
CVE-2018-16267 
The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T12:49:24.000Z
CVE-2018-16268 
The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security policy configurations. Such actions include playing an arbitrary sound file or DTMF tones. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T12:51:16.000Z
CVE-2018-16269 
The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T12:59:55.000Z
CVE-2018-16270 
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T13:01:29.000Z