rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1000813 
Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000814 
aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000815 
Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000816 
Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000817 
Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially crafted GET request containing directory traversal from assets-pipeline context. This vulnerability appears to have been fixed in 2.14.1.1 (for Grails 2.x), 2.15.1 (for Grails 3 and Java 7) and 3.0.6 (for Grails 3 and Java 8).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000820 
neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000821 
MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted SMathStudio files. This vulnerability appears to have been fixed in after commit 5c05ac8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000822 
codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000823 
exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000824 
MegaMek version < v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000825 
FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000826 
Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000827 
Ubilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000828 
FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to update the software.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000829 
Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 80359b4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000830 
XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000831 
K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDAV server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000832 
ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000833 
ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000834 
runelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000835 
KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000836 
bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000837 
UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000838 
autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000839 
LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000840 
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000841 
Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser.. This attack appear to be exploitable via HTTP POST request. This vulnerability appears to have been fixed in 5.16-1 Beta.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000842 
FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000843 
Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such as task name, id, parameter, etc. will be leaked to unauthorized users. This attack appear to be exploitable via The victim must visit a specially crafted webpage from the network where their Luigi server is accessible.. This vulnerability appears to have been fixed in 2.8.0 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000844 
Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000846 
FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website containing attacker's javascript. This vulnerability appears to have been fixed in 1.0.5 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000847 
FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Full Name in their account details. The victim (e.g. the administrator of the FreshDNS instance) opens the User List in the admin interface.. This vulnerability appears to have been fixed in 1.0.5 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000848 
Wampserver version prior to version 3.1.5 contains a Cross Site Scripting (XSS) vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000849 
Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file, due to bugs in handling long link target name and the way a regular file is extracted.. This vulnerability appears to have been fixed in 2.6.10, 2.7.6, and 2.10.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000850 
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack appear to be exploitable via An attacker should have access to an encoded path parameter on POST, PUT or DELETE request.. This vulnerability appears to have been fixed in 2.5.0 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000851 
Copay Bitcoin Wallet version 5.01 to 5.1.0 included. contains a Other/Unknown vulnerability in wallet private key storage that can result in Users' private key can be compromised. . This attack appear to be exploitable via Affected version run the malicious code at startup . This vulnerability appears to have been fixed in 5.2.0 and later .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000852 
FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server with echo option. This vulnerability appears to have been fixed in after commit 205c612820dac644d665b5bb1cdf437dc5ca01e3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T15:00:00.000Z
CVE-2018-1000854 
esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T16:00:00.000Z
CVE-2018-1000855 
easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T16:00:00.000Z
CVE-2018-1000856 
DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear to be exploitable via Victim must visit the vulnerable page. This vulnerability appears to have been fixed in No fix yet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T16:00:00.000Z
CVE-2018-1000857 
log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session that can result in User to root privilege escalation. This attack appear to be exploitable via Malicious unprivileged user executes the vulnerable binary/(remote) environment variable manipulation similar shell-shock also possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T16:00:00.000Z
CVE-2018-1000858 
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T16:00:00.000Z
CVE-2018-1000860 
phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on the login page encapsulated in single quotes. Editing the value of the cookie to r5zkh'><script>alert(1)</script>quqtl exploits an XSS vulnerability. that can result in Arbitrary code executes in victims browser.. This attack appear to be exploitable via Needs to be chained with another exploit that allows an attacker to set or modify a cookie for the phpIPAM instance's domain..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T16:00:00.000Z
CVE-2018-1000861 
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T14:00:00.000Z
CVE-2018-1000862 
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T14:00:00.000Z
CVE-2018-1000863 
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T14:00:00.000Z
CVE-2018-1000864 
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T14:00:00.000Z
CVE-2018-1000865 
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T14:00:00.000Z
CVE-2018-1000866 
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T14:00:00.000Z
CVE-2018-1000867 
WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T17:00:00.000Z
CVE-2018-1000868 
WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T17:00:00.000Z
CVE-2018-1000869 
phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to have been fixed in 1.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T17:00:00.000Z