rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-15468 
The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app (versionCode=1, versionName=QL1715_201812071953) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:43.000Z
CVE-2019-15469 
The Xiaomi Mi Pad 4 Android device with a build fingerprint of Xiaomi/clover/clover:8.1.0/OPM1.171019.019/V9.6.26.0.ODJCNFD:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=27, versionName=8.1.0) that allows other pre-installed apps to perform microphone audio recording via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that export their capabilities to other pre-installed app. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:44.000Z
CVE-2019-15470 
The Xiaomi Redmi Note 6 Pro Android device with a build fingerprint of xiaomi/tulip/tulip:8.1.0/OPM1.171019.011/V10.2.2.0.OEKMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=27, versionName=8.1.0) that allows other pre-installed apps to perform microphone audio recording via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that export their capabilities to other pre-installed app. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:46.000Z
CVE-2019-15471 
The Xiaomi Mi Mix 2S Android device with a build fingerprint of Xiaomi/polaris/polaris:8.0.0/OPR1.170623.032/V9.5.19.0.ODGMIFA:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=27, versionName=8.1.0) that allows other pre-installed apps to perform microphone audio recording via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that export their capabilities to other pre-installed app. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:47.000Z
CVE-2019-15472 
The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:48.000Z
CVE-2019-15473 
The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/jasmine/jasmine_sprout:9/PKQ1.180904.001/V10.0.2.0.PDIMIFJ:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:50.000Z
CVE-2019-15474 
The Xiaomi Cepheus Android device with a build fingerprint of Xiaomi/cepheus/cepheus:9/PKQ1.181121.001/V10.2.6.0.PFAMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:51.000Z
CVE-2019-15475 
The Xiaomi Mi A3 Android device with a build fingerprint of xiaomi/onc_eea/onc:9/PKQ1.181021.001/V10.2.8.0.PFLEUXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:53.000Z
CVE-2019-15476 
Former before 4.2.1 has XSS via a checkbox value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:17:24.000Z
CVE-2019-15477 
Jooby before 1.6.4 has XSS via the default error handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:19:16.000Z
CVE-2019-15478 
Status Board 1.1.81 has reflected XSS via logic.ts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T11:42:52.000Z
CVE-2019-15479 
Status Board 1.1.81 has reflected XSS via dashboard.ts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T13:49:16.000Z
CVE-2019-15480 
Domoticz 4.10717 has XSS via item.Name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:24:03.000Z
CVE-2019-15481 
Kimai v2 before 1.1 has XSS via a timesheet description.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:25:49.000Z
CVE-2019-15482 
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:51:09.000Z
CVE-2019-15483 
Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:29:17.000Z
CVE-2019-15484 
Bolt before 3.6.10 has XSS via an image's alt or title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:30:05.000Z
CVE-2019-15485 
Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:30:42.000Z
CVE-2019-15486 
django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:31:58.000Z
CVE-2019-15487 
DfE School Experience before v16333-GA has XSS via a teacher training URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:34:41.000Z
CVE-2019-15488 
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:37:31.000Z
CVE-2019-15489 
laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T11:57:41.000Z
CVE-2019-15490 
openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:41:08.000Z
CVE-2019-15491 
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:42:02.000Z
CVE-2019-15492 
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:42:45.000Z
CVE-2019-15493 
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:43:29.000Z
CVE-2019-15494 
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T12:44:12.000Z
CVE-2019-15496 
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-28T16:34:15.000Z
CVE-2019-15497 
Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T20:29:14.000Z
CVE-2019-15498 
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T03:05:45.000Z