rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-5235 
Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application.
Problem types: description: DLL Preloading
Affected products: vendor: Symantec Corporation
product: Norton Utilities
Published: 2018-08-22T17:00:00.000Z
CVE-2018-5236 
Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition (or race hazard). This type of issue occurs in software where the output is dependent on the sequence or timing of other uncontrollable events.
Problem types: description: Race condition
Affected products: vendor: Symantec Corporation
product: Symantec Endpoint Protection
Published: 2018-06-20T16:00:00.000Z
CVE-2018-5237 
Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels.
Problem types: description: Privilege escalation
Affected products: vendor: Symantec Corporation
product: Symantec Endpoint Protection
Published: 2018-06-20T16:00:00.000Z
CVE-2018-5238 
Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application.
Problem types: description: DLL Preloading
Affected products: vendor: Symantec Corporation
product: Norton Power Eraser
vendor: Symantec Corporation
product: SymDiag
Published: 2018-08-22T17:00:00.000Z
CVE-2018-5239 
Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access.
Problem types: description: App Lock Bypass
Affected products: vendor: Symantec Corporation
product: Norton App Lock
Published: 2018-07-16T17:00:00.000Z
CVE-2018-5240 
The Inventory Plugin for Symantec Management Agent prior to 7.6 POST HF7, 8.0 POST HF6, or 8.1 RU7 may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels.
Problem types: description: Privilege Escalation
Affected products: vendor: Symantec Corporation
product: Inventory Plugin for Symantec Management Agent
Published: 2018-07-25T16:00:00.000Z
CVE-2018-5241 
Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, ASG and ProxySG incorrectly handle XML nodes with comments. A remote attacker can modify a valid SAML response without invalidating its cryptographic signature. This may allow the attacker to bypass user authentication security controls in ASG and ProxySG. This vulnerability only affects authentication of network users in intercepted traffic. It does not affect administrator user authentication for the ASG and ProxySG management consoles.
Problem types: description: Authentication bypass
Affected products: vendor: Symantec Corporation
product: Advanced Secure Gateway (ASG)
vendor: Symantec Corporation
product: ProxySG
Published: 2018-05-29T13:00:00.000Z
CVE-2018-5242 
Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access.
Problem types: description: App Lock Bypass
Affected products: vendor: Symantec Corporation
product: Norton App Lock
Published: 2018-06-13T16:00:00.000Z
CVE-2018-5243 
The Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a specific host within a network.
Problem types: description: Denial of service
Affected products: vendor: Symantec Corporation
product: Symantec Encryption Management Server (SEMS)
Published: 2018-08-20T18:00:00.000Z
CVE-2018-5244 
In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't freed when a vcpu is destroyed. This allows guest OS administrators to cause a denial of service (host OS memory consumption) by rebooting many times.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-05T18:00:00.000Z
CVE-2018-5246 
In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-05T19:00:00.000Z
CVE-2018-5247 
In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-05T19:00:00.000Z
CVE-2018-5248 
In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-05T19:00:00.000Z
CVE-2018-5249 
Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-05T20:00:00.000Z
CVE-2018-5251 
In libming 0.4.8, there is an integer signedness error vulnerability (left shift of a negative value) in the readSBits function (util/read.c). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-05T20:00:00.000Z
CVE-2018-5252 
libimageworsener.a in ImageWorsener 1.3.2, when libjpeg 8d is used, has a large loop in the get_raw_sample_int function in imagew-main.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-05T21:00:00.000Z
CVE-2018-5253 
The AP4_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-05T21:00:00.000Z
CVE-2018-5254 
Arista EOS before 4.20.2F allows remote BGP peers to cause a denial of service (Rib agent restart) via a malformed path attribute in an UPDATE message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T21:00:00.000Z
CVE-2018-5255 
The Mlag agent in Arista EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F allows remote attackers to cause a denial of service (agent restart) via crafted UDP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-05T18:00:00.000Z
CVE-2018-5256 
CoreOS Tectonic 1.7.x before 1.7.9-tectonic.4 and 1.8.x before 1.8.4-tectonic.3 mounts a direct proxy to the kubernetes cluster at /api/kubernetes/ which is accessible without authentication to Tectonic and allows an attacker to directly connect to the kubernetes API server. Unauthenticated users are able to list all Namespaces through the Console, resulting in an information disclosure. Tectonic's exposure of an unauthenticated API endpoint containing information regarding the internal state of the cluster can provide an attacker with information that may assist in other attacks against the cluster. For example, an attacker may not have the permissions required to list all namespaces in the cluster but can instead leverage this vulnerability to enumerate the namespaces and then begin to check each namespace for weak authorization policies that may allow further escalation of privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-18T15:00:00.000Z
CVE-2018-5258 
The Neon app 1.6.14 iOS does not verify X.509 certificates from SSL servers, which allows remote attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-17T17:00:00.000Z
CVE-2018-5259 
Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended attachment-deletion restrictions via a modified aid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T09:00:00.000Z
CVE-2018-5261 
An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the handshake as input for the encryption key used for the encryption of the rest of the session, the server and client disclose sensitive information, such as the authentication credentials, to any man-in-the-middle (MiTM) listener.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-02T21:00:00.000Z
CVE-2018-5262 
A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute arbitrary code in the context of a highly privileged account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T17:00:00.000Z
CVE-2018-5263 
The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T23:00:00.000Z
CVE-2018-5264 
Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/default/login request with the byfree parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T15:26:24.000Z
CVE-2018-5265 
Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T14:59:43.000Z
CVE-2018-5266 
Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with password seatel3, SysAdmin with password seatel2, and User with password seatel1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T03:00:00.000Z
CVE-2018-5267 
Cobham Sea Tel 121 build 222701 devices allow remote attackers to bypass authentication via a direct request to MenuDealerGx.html, MenuDealer.html, MenuEuNCGx.html, MenuEuNC.html, MenuSysGx.html, or MenuSys.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T03:00:00.000Z
CVE-2018-5268 
In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5269 
In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5270 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e010. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5271 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e008. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5272 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e004. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5273 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e014. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5274 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40E024. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5275 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40E020. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5276 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e018. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5277 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e000. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5278 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e00c. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5279 
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e02c. NOTE: the vendor reported that they "have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T05:00:00.000Z
CVE-2018-5280 
SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T09:00:00.000Z
CVE-2018-5281 
SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T09:00:00.000Z
CVE-2018-5282 
Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. NOTE: the vendor disputes this issue because neither a buffer overflow nor a crash can be reproduced; also, reading XML documents is implemented exclusively with managed code within the Microsoft .NET Framework
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T09:00:00.000Z
CVE-2018-5283 
The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T09:00:00.000Z
CVE-2018-5284 
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5285 
The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5286 
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5287 
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5288 
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5289 
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5290 
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5291 
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5292 
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5293 
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5294 
In libming 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the readUInt32 function (util/read.c). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5295 
In PoDoFo 0.9.5, there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5296 
In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T07:00:00.000Z
CVE-2018-5298 
In the Procter & Gamble "Oral-B App" (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with static parameters is used to secure the locally stored shared preferences. An attacker can gain access to locally stored user data more easily by leveraging access to the preferences XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T08:00:00.000Z
CVE-2018-5299 
A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4, leading to memory corruption and possibly remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T22:00:00.000Z
CVE-2018-5301 
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-08T22:00:00.000Z
CVE-2018-5303 
An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The license key parameter of the web application is vulnerable to Cross Site Scripting; this vulnerability allows an attacker to send malicious code to another user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T21:00:00.000Z