rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-4043 
An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validation. A user with local access can use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful exploit.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4044 
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4045 
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4046 
An exploitable denial-of-service vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. A user with local access can use this vulnerability to terminate a privileged helper application. An attacker would need local access to the machine for a successful exploit.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4047 
An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
Problem types: description: Improper Input Validation
Affected products: vendor: n/a
product: Clean My Mac
Published: 2019-01-10T15:00:00.000Z
CVE-2018-4048 
An exploitable local privilege elevation vulnerability exists in the file system permissions of the `Temp` directory in GOG Galaxy 1.2.48.36 (Windows 64-bit Installer). An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with SYSTEM privileges.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Talos
product: GOG Galaxy
Published: 2019-05-30T16:06:43.000Z
CVE-2018-4049 
An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” directory, version 1.2.48.36 (Windows 64-bit Installer). An attacker can overwrite executables of installed games to exploit this vulnerability and execute arbitrary code with elevated privileges.
Problem types: description: local privilege elevation
Affected products: vendor: GOG.COM
product: GOG Galaxy
Published: 2019-04-02T15:35:37.000Z
CVE-2018-4050 
An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally adjust folder permissions leading to execution of arbitrary code with elevated privileges.
Problem types: description: local privilege escalation
Affected products: vendor: Talos
product: GOG Galaxy
Published: 2019-04-01T18:29:38.000Z
CVE-2018-4051 
An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally create directories and subdirectories on the root file system, as well as change the permissions of existing directories.
Problem types: description: improper input validation
Affected products: vendor: GOG.COM
product: GOG Galaxy
Published: 2019-04-02T15:19:44.000Z
CVE-2018-4052 
An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can pass a PID and receive information running on it that would usually only be accessible to the root user.
Problem types: description: improper input validation
Affected products: vendor: GOG.COM
product: GOG Galaxy
Published: 2019-04-02T15:19:41.000Z
CVE-2018-4053 
An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can send malicious data to the root-listening service, causing the application to terminate and become unavailable.
Problem types: description: denial of service
Affected products: vendor: GOG.COM
product: GOG Galaxy
Published: 2019-04-02T15:35:33.000Z
CVE-2018-4054 
A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine to successfully exploit this flaw.
Problem types: description: local privilege escalation
Affected products: vendor: Talos
product: Pixar Renderman
Published: 2019-03-08T20:00:00.000Z
CVE-2018-4055 
A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to read any root file from the file system. An attacker would need local access to the machine to successfully exploit this flaw.
Problem types: description: local privilege escalation
Affected products: vendor: Talos
product: Pixar Renderman
Published: 2019-03-08T20:00:00.000Z
CVE-2018-4056 
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
Problem types: description: Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: Talos
product: coTURN
Published: 2019-02-05T18:00:00.000Z
CVE-2018-4058 
An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.
Problem types: description: Privilege
Affected products: vendor: Talos
product: coTURN
Published: 2019-03-21T14:15:36.000Z
CVE-2018-4059 
An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.
Problem types: description: Other
Affected products: vendor: Talos
product: coTURN
Published: 2019-03-21T14:30:59.000Z
CVE-2018-4061 
An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can inject arbitrary commands, resulting in arbitrary command execution. An attacker can send an authenticated HTTP request to trigger this vulnerability.
Problem types: description: command injection
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:00:11.000Z
CVE-2018-4062 
A hard-coded credentials vulnerability exists in the snmpd function of the Sierra Wireless AirLink ES450 FW 4.9.3. Activating snmpd outside of the WebUI can cause the activation of the hard-coded credentials, resulting in the exposure of a privileged user. An attacker can activate snmpd without any configuration changes to trigger this vulnerability.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:28:04.000Z
CVE-2018-4063 
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:43:31.000Z
CVE-2018-4064 
An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the device. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: description: Unverified password change
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-10-31T20:24:12.000Z
CVE-2018-4065 
An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code running on the victim's browser. An attacker can get a victim to click a link, or embedded URL, that redirects to the reflected cross-site scripting vulnerability to trigger this vulnerability.
Problem types: description: Cross-site Scripting
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:06:09.000Z
CVE-2018-4066 
An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause an authenticated user to perform privileged requests unknowingly, resulting in unauthenticated requests being requested through an authenticated user. An attacker can get an authenticated user to request authenticated pages on the attacker's behalf to trigger this vulnerability.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:38:09.000Z
CVE-2018-4067 
An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a information leak, resulting in the disclosure of internal paths and files. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:50:04.000Z
CVE-2018-4068 
An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A HTTP request can result in disclosure of the default configuration for the device. An attacker can send an unauthenticated HTTP request to trigger this vulnerability.
Problem types: description: Information Exposure
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T17:50:44.000Z
CVE-2018-4069 
An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authentication functionality is done in plaintext XML to the web server. An attacker can listen to network traffic upstream from the device to capitalize on this vulnerability.
Problem types: description: Missing Encryption of Sensitive Data
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T17:42:02.000Z
CVE-2018-4070 
An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Get_Task.cgi endpoint.
Problem types: description: Information Exposure
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:15:09.000Z
CVE-2018-4071 
An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceTLGet_Task.cgi executable is used to retrieve MSCII configuration values within the configuration manager of the AirLink ES450. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_TLGet_Task.cgi endpoint.
Problem types: description: Information Exposure
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:15:42.000Z
CVE-2018-4072 
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSet_Task.cgi executable is used to change MSCII configuration values within the configuration manager of the AirLink ES450. This binary does not have any restricted configuration settings, so once the MSCIID is discovered, any authenticated user can send configuration changes using the /cgi-bin/Embedded_Ace_Set_Task.cgi endpoint.
Problem types: description: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:21:13.000Z
CVE-2018-4073 
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the endpoint /cgi-bin/Embeded_Ace_TLSet_Task.cgi is a very similar endpoint that is designed for use with setting table values that can cause an arbitrary setting writes, resulting in the unverified changes to any system setting. An attacker can make an authenticated HTTP request, or run the binary as any user, to trigger this vulnerability.
Problem types: description: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: n/a
product: Sierra Wireless
Published: 2019-05-06T18:22:09.000Z
CVE-2018-4082 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4083 
An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "Touch Bar Support" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4084 
An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "Wi-Fi" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4085 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "QuartzCore" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4086 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Security" component. It allows remote attackers to spoof certificate validation via crafted name constraints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4087 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Core Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4088 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. iCloud before 7.3 on Windows is affected. iTunes before 12.7.3 on Windows is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4089 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. tvOS before 11.2.5 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4090 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4091 
An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "Sandbox" component. It allows bypass of a sandbox protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4092 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. A race condition allows attackers to bypass intended memory-read restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4093 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4094 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Audio" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4095 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Core Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4096 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. iCloud before 7.3 on Windows is affected. iTunes before 12.7.3 on Windows is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4097 
An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4098 
An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "IOHIDFamily" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4100 
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. watchOS before 4.2.2 is affected. The issue involves the "LinkPresentation" component. It allows remote attackers to cause a denial of service (resource consumption) via a crafted text message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4101 
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4102 
An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2018-4104 
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z