rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-9559 
In persist_set_key and other functions of cryptfs.cpp, there is a possible out-of-bounds write due to an uncaught error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112731440.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-06T14:00:00.000Z
CVE-2018-9560 
In HID_DevAddRecord of hidd_api.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege in the Bluetooth service with User execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-79946737.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-06T14:00:00.000Z
CVE-2018-9561 
In llcp_util_parse_connect of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-111660010
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-06-19T20:13:03.000Z
CVE-2018-9562 
In bta_ag_do_disc of bta_ag_sdp.cc, there is a possible out-of-bound read due to an incorrect parameter size. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113164621.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-06T14:00:00.000Z
CVE-2018-9563 
In llcp_util_parse_cc of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-114237888
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-06-19T20:01:55.000Z
CVE-2018-9564 
In llcp_util_parse_link_params of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-114238578
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-06-19T20:02:54.000Z
CVE-2018-9565 
In readBytes of xltdecwbxml.c, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-16680558.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-06T14:00:00.000Z
CVE-2018-9566 
In process_service_search_rsp of sdp_discovery.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure when connecting to a malicious Bluetooth device with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-74249842.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-06T14:00:00.000Z
CVE-2018-9567 
On Pixel devices there is a bug causing verified boot to show the same certificate fingerprint despite using different signing keys. This may lead to local escalation of privilege if people are relying on those fingerprints to determine what version of the OS the device is running, with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-65543936.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-06T14:00:00.000Z
CVE-2018-9568 
In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-06T14:00:00.000Z
CVE-2018-9569 
In impd_init_drc_decode_post_config of impd_drc_gain_decoder.c there is a possible out-of-bound write due to incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113885537.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9570 
In impd_parse_drc_ext_v1 of impd_drc_dynamic_payload.c there is a possible out-of-bound write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-115375616.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9571 
In impd_parse_loud_eq_instructions of impd_drc_dynamic_payload.c there is a possible out-of-bound write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116020594.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9572 
In impd_drc_parse_coeff of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116224432.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9573 
In impd_parse_filt_block of impd_drc_dynamic_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116467350.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9574 
In impd_parse_split_drc_characteristic of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116619337.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9575 
In impd_parse_dwnmix_instructions of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116619387.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9576 
In impd_parse_parametric_drc_instructions of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116715245.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9577 
In impd_parametric_drc_parse_gain_set_params of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116715937.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9578 
In ixheaacd_adts_crc_start_reg of ixheaacd_adts_crc_check.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113261928.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-12-07T23:00:00.000Z
CVE-2018-9580 
A Elevation of privilege vulnerability in the HTC bootloader. Product: Android. Versions: Android kernel. Android ID: A-76222002.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-11-14T18:00:00.000Z
CVE-2018-9581 
In WiFi, the RSSI value and SSID information is broadcast as part of android.net.wifi.RSSI_CHANGE and android.net.wifi.STATE_CHANGE intents. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111698366
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:19.000Z
CVE-2018-9582 
In package installer in Android-8.0, Android-8.1 and Android-9, there is a possible bypass of the unknown source warning due to a confused deputy scenario. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-112031362.
Problem types: description: Elevation of privilege
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9583 
In bta_ag_parse_cmer of bta_ag_cmd.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution in the bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-112860487.
Problem types: description: Remote code execution
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9584 
In nfc_ncif_set_config_status of nfc_ncif.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-114047681.
Problem types: description: Elevation of privilege
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9585 
In nfc_ncif_proc_get_routing of nfc_ncif.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-117554809.
Problem types: description: Elevation of privilege
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9586 
In run of InstallPackageTask.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, it is possible that package verification is turned off and remains off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116754444.
Problem types: description: Elevation of privilege
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9587 
In savePhotoFromUriToUri of ContactPhotoUtils.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is possible unauthorized access to files within the contact app due to a confused deputy scenario. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Android ID: A-113597344.
Problem types: description: Elevation of privilege
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9588 
In avdt_scb_hdl_report of avdt_scb_act.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-111450156.
Problem types: description: Information disclosure
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9589 
In ieee802_11_rx_wnmsleep_req of wnm_ap.c in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the wifi driver with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-111893132.
Problem types: description: Information disclosure
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9590 
In add_attr of sdp_discovery.c in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-115900043.
Problem types: description: Information disclosure
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9591 
In bta_hh_ctrl_dat_act of bta_hh_act.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116108738.
Problem types: description: Information disclosure
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9592 
In mca_ccb_hdl_rsp of mca_cact.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116319076.
Problem types: description: Information disclosure
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9593 
In llcp_dlc_proc_i_pdu of llcp_dlc.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116722267.
Problem types: description: Information disclosure
Affected products: vendor: Android
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9594 
In llcp_link_proc_agf_pdu of llcp_link.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116791157.
Problem types: description: Information disclosure
Affected products: vendor: *** n/a ***
product: Android
Published: 2019-02-12T00:00:00.000Z
CVE-2018-9838 
The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-06T18:00:00.000Z
CVE-2018-9839 
An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T18:17:04.000Z
CVE-2018-9840 
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T05:00:00.000Z
CVE-2018-9841 
The export function in libavfilter/vf_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a long filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T07:00:00.000Z
CVE-2018-9842 
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T15:00:00.000Z
CVE-2018-9843 
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T15:00:00.000Z
CVE-2018-9844 
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T07:00:00.000Z
CVE-2018-9845 
Etherpad Lite before 1.6.4 is exploitable for admin access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-29T18:00:00.000Z
CVE-2018-9846 
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T21:00:00.000Z
CVE-2018-9847 
In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to execute arbitrary PHP code by placing this code into a template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T21:00:00.000Z
CVE-2018-9848 
In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the config[upload_class] value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an Admin-Upload-Upload request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-07T21:00:00.000Z
CVE-2018-9849 
Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-10T14:00:00.000Z
CVE-2018-9850 
In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-08T02:00:00.000Z
CVE-2018-9851 
In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '|' instead of '/' as a directory separator, in conjunction with a ".." sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-08T02:00:00.000Z
CVE-2018-9852 
In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query string within a Home-Hits request, as demonstrated hy sid=user,password%20from%20mysql.user%23.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-08T02:00:00.000Z
CVE-2018-9853 
Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to an unprivileged account on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-10T14:00:00.000Z
CVE-2018-9856 
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-09T07:00:00.000Z
CVE-2018-9857 
PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-09T07:00:00.000Z