rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-1010191 
marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is: Hacker inputs a SQL to a vulnerable vector(header, http parameter, etc). The fixed version is: 1.6.
Problem types: description: SQL Injection
Affected products: vendor: marginalia
product: marginalia
Published: 2019-07-24T13:10:33.000Z
CVE-2019-1010193 
hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS).
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: hisiphp
product: hisiphp
Published: 2019-07-24T12:50:16.000Z
CVE-2019-1010199 
ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: ServiceStack
product: ServiceStack Framework
Published: 2019-07-23T17:17:14.000Z
CVE-2019-1010200 
Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The impact is: Remote code execution with the same privileges as the servers. The component is: Two web servers in the projects expose three vulnerable endpoints that can be accessed remotely. The endpoints are defined at: - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/merlin_model_server/api.js#L34 - /alignment: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#L28 - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#L65. The attack vector is: Attacker sends a GET request to the vulnerable endpoint with a specially formatted query parameter. The fixed version is: After commit f6660e6d8f0d1d931359d591dbdec580fef36d36.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Voice Builder
product: Voice Builder
Published: 2019-07-23T17:15:40.000Z
CVE-2019-1010201 
Jeesite 1.2.7 is affected by: SQL Injection. The impact is: sensitive information disclosure. The component is: updateProcInsIdByBusinessId() function in src/main/java/com.thinkgem.jeesite/modules/act/ActDao.java has SQL Injection vulnerability. The attack vector is: network connectivity,authenticated. The fixed version is: 4.0 and later.
Problem types: description: SQL Injection
Affected products: vendor: Jeesite
product: Jeesite
Published: 2019-07-23T17:07:14.000Z
CVE-2019-1010202 
Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The attack vector is: network connectivity,authenticated,must upload a specially crafted xml file. The fixed version is: 4.0 and later.
Problem types: description: XML External Entity (XXE)
Affected products: vendor: Jeesite
product: Jeesite
Published: 2019-07-23T13:52:49.000Z
CVE-2019-1010204 
GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.
Problem types: description: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read
Affected products: vendor: GNU binutils
product: gold
Published: 2019-07-23T13:39:02.000Z
CVE-2019-1010205 
LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff) is affected by: Directory Traversal. The impact is: The vulnerability allows an attacker to access any file (with a fixed extension) on the server. The component is: A web-view renderer; details here: https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1. The attack vector is: Attacker sends a specially crafted HTTP request.
Problem types: description: Directory Traversal
Affected products: vendor: LINAGORA
product: hublin
Published: 2019-07-23T13:35:44.000Z
CVE-2019-1010206 
OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.
Problem types: description: Missing SSL certificate validation
Affected products: vendor: OSS
product: Http Request (Apache Cordova Plugin)
Published: 2019-07-23T13:30:18.000Z
CVE-2019-1010207 
Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting (XSS). The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/her account. The fixed version is: 3.0.16.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Genetechsolutions
product: Pie Register
Published: 2019-07-23T13:15:41.000Z
CVE-2019-1010208 
IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buffer Overflow. The impact is: Minor information disclosure of kernel stack. The component is: Veracrypt NT Driver (veracrypt.sys). The attack vector is: Locally executed code, IOCTL request to driver. The fixed version is: 1.23-Hotfix-1.
Problem types: description: Buffer Overflow
Affected products: vendor: IDRIX, Truecrypt
product: Veracrypt, Truecrypt
Published: 2019-07-23T13:12:38.000Z
CVE-2019-1010209 
GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: GoUrl.io
product: GoURL Wordpress Plugin
Published: 2019-07-23T13:09:11.000Z
CVE-2019-1010218 
Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The component is: Main cherokee command. The attack vector is: Overwrite argv[0] to an insane length with execl. The fixed version is: There's no fix yet.
Problem types: cwe_id: CWE-120
description: Buffer Overflow - CWE-120
Affected products: vendor: Cherokee Webserver
product: Latest Cherokee Web server
Published: 2019-07-22T17:30:25.000Z
CVE-2019-1010220 
tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". The attack vector is: The victim must open a specially crafted pcap file.
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: tcpdump.org
product: tcpdump
Published: 2019-07-22T17:30:14.000Z
CVE-2019-1010221 
LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell session. The component is: adb shell (patches to fix this are at https://review.lineageos.org/c/LineageOS/android_system_core/+/234800, https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799). The attack vector is: When adb is enabled, and an attacker has physical access, `adb shell setprop service.adb.root 1` allows restarting adb as root.
Problem types: description: Incorrect Access Control
Affected products: vendor: LineageOS
product: LineageOS
Published: 2019-07-23T13:04:35.000Z
CVE-2019-1010228 
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
Problem types: description: Buffer Overflow
Affected products: vendor: OFFIS.de
product: DCMTK
Published: 2019-07-22T16:50:02.000Z
CVE-2019-1010232 
Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) is affected by: Buffer Overflow. The impact is: remote dos. The component is: slaxlexer.c:601(funtion:slaxGetInput). The attack vector is: ./slaxproc --slax-to-xslt POC0.
Problem types: description: Buffer Overflow
Affected products: vendor: Juniper
product: juniper/libslax
Published: 2019-07-22T15:27:40.000Z
CVE-2019-1010234 
The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: network connectivity.
Problem types: description: Improper Input Validation
Affected products: vendor: The Linux Foundation
product: ONOS
Published: 2019-07-22T14:58:04.000Z
CVE-2019-1010235 
Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Frog CMS
product: Frog CMS
Published: 2019-07-22T14:52:31.000Z
CVE-2019-1010237 
Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap (attacker) / Corrections view (victim). The fixed version is: 5.3.12.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent)
Affected products: vendor: Ilias
product: Ilias
Published: 2019-07-22T14:46:07.000Z
CVE-2019-1010238 
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
Problem types: description: Buffer Overflow
Affected products: vendor: Gnome
product: Pango
Published: 2019-07-19T16:42:41.000Z
CVE-2019-1010239 
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.
Problem types: description: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: DaveGamble/cJSON
product: cJSON
Published: 2019-07-19T16:41:01.000Z
CVE-2019-1010241 
Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job.
Problem types: cwe_id: CWE-257
description: CWE-257: Storing Passwords in a Recoverable Format
Affected products: vendor: Jenkins Credentials Binding Plugin
product: Jenkins
Published: 2019-07-19T16:36:02.000Z
CVE-2019-1010245 
The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The attack vector is: network connectivity. The fixed version is: 1.15.
Problem types: description: Improper Input Validation
Affected products: vendor: The Linux Foundation
product: ONOS SDN Controller
Published: 2019-07-19T14:23:36.000Z
CVE-2019-1010246 
MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.
Problem types: description: Unauthenticated MySQL database password information disclosure
Affected products: vendor: MailCleaner
product: MailCleaner
Published: 2019-07-18T18:04:34.000Z
CVE-2019-1010247 
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: ZmartZone IAM
product: mod_auth_openidc
Published: 2019-07-19T14:13:56.000Z
CVE-2019-1010248 
Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1.
Problem types: description: SQL Injection
Affected products: vendor: Synetics GmbH
product: I-doit
Published: 2019-07-18T17:59:39.000Z
CVE-2019-1010249 
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
Problem types: description: Integer Overflow
Affected products: vendor: The Linux Foundation
product: ONOS
Published: 2019-07-18T17:53:37.000Z
CVE-2019-1010250 
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
Problem types: description: Poor Input-validation
Affected products: vendor: The Linux Foundation
product: ONOS
Published: 2019-07-18T17:51:49.000Z
CVE-2019-1010251 
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.
Problem types: description: Denial of Service - DNS detection bypass
Affected products: vendor: Open Information Security Foundation
product: Suricata
Published: 2019-07-18T17:48:48.000Z
CVE-2019-1010252 
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: applyFlowRules() and apply() functions in FlowRuleManager.java. The attack vector is: network management and connectivity.
Problem types: description: Poor Input-validation
Affected products: vendor: The Linux Foundation
product: ONOS
Published: 2019-07-18T17:43:41.000Z
CVE-2019-1010257 
An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.
Problem types: description: Information Disclosure / Data Modification
Affected products: vendor: article2pdf
product: article2pdf Wordpress plug-in
Published: 2019-03-27T18:07:57.000Z
CVE-2019-1010258 
nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function nsvg__parseColorRGB in src/nanosvg.h / line 1227. The attack vector is: It depends library usage. If input is passed from the network, then network connectivity is enough. Most likely an attack will require opening a specially crafted .svg file.
Problem types: description: Buffer Overflow
Affected products: vendor: nanosvg library
product: nanosvg
Published: 2019-05-15T17:24:40.000Z
CVE-2019-1010259 
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
Problem types: description: SQL Injection
Affected products: vendor: SaltStack
product: Salt
Published: 2019-07-18T16:33:35.000Z
CVE-2019-1010260 
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
Problem types: description: Other
Affected products: vendor: ktlint
product: ktlint
Published: 2019-04-02T14:03:49.000Z
CVE-2019-1010261 
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Gitea
product: Gitea
Published: 2019-07-18T16:30:02.000Z
CVE-2019-1010263 
Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.
Problem types: description: Incorrect Access Control
Affected products: vendor: Perl Crypt::JWT
product: Perl Crypt::JWT
Published: 2019-07-17T20:32:15.000Z
CVE-2019-1010266 
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: lodash
product: lodash
Published: 2019-07-17T20:25:30.000Z
CVE-2019-1010268 
Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.
Problem types: description: XML External Entity (XXE)
Affected products: vendor: Ladon
product: Ladon
Published: 2019-07-18T16:05:12.000Z
CVE-2019-1010275 
helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: helm
product: helm
Published: 2019-07-17T20:14:50.000Z
CVE-2019-1010279 
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b). The attack vector is: An attacker can trigger the vulnerability by a specifically crafted network TCP session. The fixed version is: 4.1.3.
Problem types: description: Denial of Service - TCP/HTTP detection bypass
Affected products: vendor: Open Information Security Foundation
product: Suricata
Published: 2019-07-18T18:07:29.000Z
CVE-2019-1010283 
Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connection() in src/callback.c. The attack vector is: network connectivity. The fixed version is: 12.0.1-4 and later.
Problem types: cwe_id: CWE-213
description: CWE-213: Intentional Information Exposure
Affected products: vendor: Univention Corporate Server
product: univention-directory-notifier
Published: 2019-07-17T20:04:58.000Z
CVE-2019-1010287 
Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Timesheet Next Gen
product: Timesheet Next Gen
Published: 2019-07-17T20:02:05.000Z
CVE-2019-1010290 
Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" parameter. The component is: redirect.php. The attack vector is: The victim must open a link created by an attacker. Attacker may use any legitimate site using Babel to redirect user to a URL of his/her choosing.
Problem types: description: Open Redirection
Affected products: vendor: Babel: Multilingual site
product: Babel
Published: 2019-07-16T13:50:17.000Z