rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-11146 
Improper file verification in Intel® Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Driver & Support Assistant Advisory
Published: 2019-08-19T16:13:08.000Z
CVE-2019-11147 
Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10; TXEInfo software for Intel(R) TXE before versions 3.1.70 and 4.0.20; INTEL-SA-00086 Detection Tool version 1.2.7.0 or before; INTEL-SA-00125 Detection Tool version 1.0.45.0 or before may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) CSME
Published: 2019-12-18T21:07:52.000Z
CVE-2019-11148 
Improper permissions in the installer for Intel(R) Remote Displays SDK before version 2.0.1 R2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Remote Displays SDK Advisory
Published: 2019-08-19T16:12:33.000Z
CVE-2019-11151 
Memory corruption issues in Intel(R) WIFI Drivers before version 21.40 may allow a privileged user to potentially enable escalation of privilege, denial of service, and information disclosure via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) WIFI Drivers and Intel(R) PROSet/Wireless WiFi Software extension DLL
Published: 2019-11-14T16:55:12.000Z
CVE-2019-11152 
Memory corruption issues in Intel(R) WIFI Drivers before version 21.40 may allow a privileged user to potentially enable escalation of privilege, denial of service, and information disclosure via adjacent access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) WIFI Drivers and Intel(R) PROSet/Wireless WiFi Software extension DLL
Published: 2019-11-14T16:55:35.000Z
CVE-2019-11153 
Memory corruption issues in Intel(R) PROSet/Wireless WiFi Software extension DLL before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and a denial of service via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) WIFI Drivers and Intel(R) PROSet/Wireless WiFi Software extension DLL
Published: 2019-11-14T16:55:53.000Z
CVE-2019-11154 
Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of service and information disclosure via local access.
Problem types: description: Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi Software Security
Published: 2019-11-14T16:53:59.000Z
CVE-2019-11155 
Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of service and information disclosure via local access.
Problem types: description: Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi Software Security
Published: 2019-11-14T16:54:16.000Z
CVE-2019-11156 
Logic errors in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, denial of service, and information disclosure via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi Software Security
Published: 2019-11-14T16:54:27.000Z
CVE-2019-11157 
Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access.
Problem types: description: Escalation of Privilege, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2019-12-16T19:12:29.000Z
CVE-2019-11162 
Insufficient access control in hardware abstraction in SEMA driver for Intel(R) Computing Improvement Program before version 2.4.0.04733 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) Computing Improvement Program Advisory
Published: 2019-08-19T16:11:56.000Z
CVE-2019-11163 
Insufficient access control in a hardware abstraction driver for Intel(R) Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) Processor Identification Utility for Windows* Advisory
Published: 2019-08-19T16:12:16.000Z
CVE-2019-11165 
Improper conditions check in the Linux kernel driver for the Intel(R) FPGA SDK for OpenCL(TM) Pro Edition before version 19.4 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel(R) FPGA SDK for OpenCL(TM) Pro Edition
Published: 2019-12-16T19:12:39.000Z
CVE-2019-11166 
Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable escalation of privilege via local attack.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Easy Streaming Wizard Advisory
Published: 2019-09-16T15:58:08.000Z
CVE-2019-11167 
Improper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel®
product: Smart Connect Technology for Intel® NUC Advisory
Published: 2019-10-11T17:57:08.000Z
CVE-2019-11168 
Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:35:58.000Z
CVE-2019-11170 
Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:36:15.000Z
CVE-2019-11171 
Heap corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via network access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:36:30.000Z
CVE-2019-11172 
Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:36:45.000Z
CVE-2019-11173 
Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via local access.
Problem types: description: Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:37:00.000Z
CVE-2019-11174 
Insufficient access control in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:37:10.000Z
CVE-2019-11175 
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:37:26.000Z
CVE-2019-11177 
Unhandled exception in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:37:36.000Z
CVE-2019-11178 
Stack overflow in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure and/or denial of service via network access.
Problem types: description: Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:37:44.000Z
CVE-2019-11179 
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure via network access.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:38:07.000Z
CVE-2019-11180 
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:38:15.000Z
CVE-2019-11181 
Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:38:23.000Z
CVE-2019-11182 
Memory corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel(R) BMC
Published: 2019-11-14T16:38:31.000Z
CVE-2019-11184 
A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Partial Information Disclosure Advisory
Published: 2019-09-16T15:59:11.000Z
CVE-2019-11185 
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T20:34:53.000Z
CVE-2019-11187 
Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T16:21:51.000Z
CVE-2019-11189 
Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earlier allows attackers to bypass network access control via data plane packet injection. To exploit the vulnerability, an attacker sends a gratuitous ARP reply that causes the host mobility application to remove existing access control flow denial rules in the network. The access control application does not re-install flow deny rules, so the attacker can bypass the intended access control policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T21:36:02.000Z
CVE-2019-11190 
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-11T23:06:40.000Z
CVE-2019-11191 
The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. NOTE: the software maintainer disputes that this is a vulnerability because ASLR for a.out format executables has never been supported
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-11T23:07:29.000Z
CVE-2019-11193 
The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T18:36:27.000Z
CVE-2019-11196 
An authentication bypass vulnerability in all versions of ValuePLUS Integrated University Management System (IUMS) allows unauthenticated, remote attackers to gain administrator privileges via the Teachers Web Panel (TWP) User ID or Password field. If exploited, the attackers could perform any actions with administrator privileges (e.g., enumerate/delete all the students' personal information or modify various settings).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-12T02:56:10.000Z
CVE-2019-11198 
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T17:13:06.000Z
CVE-2019-11199 
Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T15:36:51.000Z
CVE-2019-11200 
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T15:39:02.000Z
CVE-2019-11201 
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T15:40:53.000Z
CVE-2019-11202 
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T16:01:47.000Z
CVE-2019-11203 TIBCO ActiveMatrix BPM Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities
The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and cross-site request forgery vulnerabilities. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an unprivileged remote attacker could gain full access to the APIs exposed by the affected ActiveMatrix BPM components.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix BPM
Credits: lang: en
value: TIBCO would like to extend its appreciation to Giulio Comi and Flavio Baldassi of Horizon Security for discovery of these vulnerabilities.
Published: 2019-04-24T20:20:12.316Z
CVE-2019-11204 TIBCO Spotfire Statistics Services Exposes Sensitive Files
The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticated user to access sensitive information needed by the Spotfire Statistics Services server. The sensitive information that might be affected includes database, JMX, LDAP, Windows service account, and user credentials. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions up to and including 7.11.1; 10.0.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that credentials to both the Spotfire Statistics Services server, and to other systems could be exposed.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Statistics Services
Published: 2019-05-14T19:57:29.767Z
CVE-2019-11205 TIBCO Spotfire Server Exposes Multiple Reflected Cross-Site Scripting Vulnerabilities
The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0, and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an unauthenticated attacker could gain administrative access to the web interface of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
Published: 2019-05-14T19:57:29.812Z
CVE-2019-11206 TIBCO Spotfire Server Vulnerabilities With Integrity of Comments and Bookmarks
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.2.0, and TIBCO Spotfire Server: versions up to and including 7.11.2; 7.12.0; 7.13.0; 7.14.0; 10.0.0; 10.0.1; 10.1.0; and 10.2.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an unauthenticated attacker could remove comments from the system, rename bookmarks, and trick other users about which user authored a comment.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
Published: 2019-05-14T19:57:29.852Z