rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-19954 
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: Photo Station
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-11-02T15:57:02.671Z
CVE-2018-19955 
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: Photo Station
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-11-02T15:57:02.727Z
CVE-2018-19956 
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: Photo Station
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-11-02T15:57:02.771Z
CVE-2018-19957 Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud
A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later
Problem types: cwe_id: CWE-1021
description: CWE-1021
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
vendor: QNAP Systems Inc.
product: QuTScloud
Credits: lang: en
value: Independent Security Evaluators
Published: 2021-09-10T04:00:18.472Z
CVE-2018-19960 
The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-07T16:00:00.000Z
CVE-2018-19961 
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-08T04:00:00.000Z
CVE-2018-19962 
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-08T04:00:00.000Z
CVE-2018-19963 
An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource accounting (for external emulators) was mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-08T04:00:00.000Z
CVE-2018-19964 
An issue was discovered in Xen 4.11.x allowing x86 guest OS users to cause a denial of service (host OS hang) because the p2m lock remains unavailable indefinitely in certain error conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-08T04:00:00.000Z
CVE-2018-19965 
An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-08T04:00:00.000Z
CVE-2018-19966 
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-08T04:00:00.000Z
CVE-2018-19967 
An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel's mishandling of certain HLE transactions associated with the KACQUIRE instruction prefix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-08T04:00:00.000Z
CVE-2018-19968 
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-11T17:00:00.000Z
CVE-2018-19969 
phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-11T17:00:00.000Z
CVE-2018-19970 
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-11T17:00:00.000Z
CVE-2018-19971 
JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-16T18:12:15.000Z
CVE-2018-19974 
In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to discover addresses in the real stack (not the YARA virtual stack).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-19975 
In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifically, OP_COUNT can read a DWORD.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-19976 
In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the design of the YARA virtual machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-19977 
A command injection (missing input validation, escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows an authenticated remote attacker (simple user) -- in the same network as the device -- to trigger OS commands (like starting telnetd or opening a reverse shell) via a POST request to the web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T17:18:21.000Z
CVE-2018-19978 
A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a remote attacker (authenticated as simple user in the same network as the device) to trigger remote code execution via a POST request (ManufacturerName parameter) to the web server on the device. The web server is running with root privileges and the injected code will also run with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T17:25:15.000Z
CVE-2018-19980 
Anker Nebula Capsule Pro NBUI_M1_V2.1.9 devices allow attackers to cause a denial of service (reboot of the underlying Android 7.1.2 operating system) via a crafted application that sends data to WifiService.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-08T18:00:00.000Z
CVE-2018-19981 
Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege access to the Android filesystem in order to exploit this vulnerability (i.e. the device has been compromised, such as disabling or bypassing Android's fundamental security mechanisms).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-04T14:34:56.000Z
CVE-2018-19982 
An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP > Server > Controller (HUB) > Node (products which are controlled by HUB). The prerequisite is that the attacker is on the same network as the target HUB, and can use IP Changer to change destination IP addresses (of all packets whose destination IP address is Server) to a proxy-server IP address. This allows sniffing of cleartext between Server and Controller. The cleartext command data is transmitted to Controller using the proxy server's fake certificate, and it is able to control each Node of the HUB. Also, by operating HUB in Z-Wave Pairing Mode, it is possible to obtain the Z-Wave network key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-09T19:00:00.000Z
CVE-2018-19983 
An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., Z-Wave PC Controller, OpenZWave, CC1110, etc.). Next, the attacker conducts a DoS attack against the Z-Wave S0 Security version product by continuously sending divided "Nonce Get (0x98 0x81)" frames. The reason for dividing the "Nonce Get" frame is that, in security version S0, when a node receives a "Nonce Get" frame, the node produces a random new nonce and sends it to the Src node of the received "Nonce Get" frame. After the nonce value is generated and transmitted, the node transitions to wait mode. At this time, when "Nonce Get" is received again, the node discards the previous nonce value and generates a random nonce again. Therefore, because the frame is encrypted with previous nonce value, the received normal frame cannot be decrypted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-09T19:00:00.000Z
CVE-2018-19985 
The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:48:52.000Z
CVE-2018-19986 
In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices. In the SetRouterSettings.php source code, the RemotePort parameter is saved in the $path_inf_wan1."/web" internal configuration memory without any regex checking. And in the IPTWAN_build_command function of the iptwan.php source code, the data in $path_inf_wan1."/web" is used with the iptables command without any regex checking. A vulnerable /HNAP1/SetRouterSettings XML message could have shell metacharacters in the RemotePort element such as the `telnetd` string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:22:05.000Z
CVE-2018-19987 
D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code, the IsAccessPoint parameter is saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. A vulnerable /HNAP1/SetAccessPointMode XML message could have shell metacharacters in the IsAccessPoint element such as the `telnetd` string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:23:33.000Z
CVE-2018-19988 
In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. It needs to bypass the wget command option with a single quote. A vulnerable /HNAP1/SetClientInfoDemo XML message could have single quotes and backquotes in the AudioMute or AudioEnable element, such as the '`telnetd`' string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:24:27.000Z
CVE-2018-19989 
In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php source code, the uplink parameter is saved in the /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth internal configuration memory without any regex checking. And in the bwc_tc_spq_start, bwc_tc_wfq_start, and bwc_tc_adb_start functions of the bwcsvcs.php source code, the data in /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth is used with the tc command without any regex checking. A vulnerable /HNAP1/SetQoSSettings XML message could have shell metacharacters in the uplink element such as the `telnetd` string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:25:14.000Z
CVE-2018-19990 
In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pin" and $rphyinf3."/media/wps/enrollee/pin" internal configuration memory without any regex checking. And in the do_wps function of the wps.php source code, the data in $rphyinf3."/media/wps/enrollee/pin" is used with the wpatalk command without any regex checking. A vulnerable /HNAP1/SetWiFiVerifyAlpha XML message could have shell metacharacters in the WPSPIN element such as the `telnetd` string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:26:05.000Z
CVE-2018-19991 
VeryNginx 0.3.3 allows remote attackers to bypass the Web Application Firewall feature because there is no error handler (for get_uri_args or get_post_args) to block the API misuse described in CVE-2018-9230.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T00:00:00.000Z
CVE-2018-19992 
A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to adherents/type.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T19:00:00.000Z
CVE-2018-19993 
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T19:00:00.000Z
CVE-2018-19994 
An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the desiredstock parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T19:00:00.000Z
CVE-2018-19995 
A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to user/card.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T19:00:00.000Z
CVE-2018-19998 
SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T19:00:00.000Z
CVE-2018-19999 
The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T16:13:37.000Z
CVE-2018-1000 
An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0987, CVE-2018-0989.
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Internet Explorer 9
vendor: Microsoft
product: Internet Explorer 11
vendor: Microsoft
product: Internet Explorer 10
Published: 2018-04-12T01:00:00.000Z
CVE-2018-1001 
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0988, CVE-2018-0996.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Internet Explorer 9
vendor: Microsoft
product: Internet Explorer 11
vendor: Microsoft
product: Internet Explorer 10
Published: 2018-04-12T01:00:00.000Z
CVE-2018-1003 
A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows 7
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows RT 8.1
vendor: Microsoft
product: Windows Server 2008
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows 8.1
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2008 R2
vendor: Microsoft
product: Windows 10
Published: 2018-04-12T01:00:00.000Z
CVE-2018-1004 
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Internet Explorer 9, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows 7
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Internet Explorer 9
vendor: Microsoft
product: Windows RT 8.1
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows 8.1
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2008 R2
vendor: Microsoft
product: Windows 10
Published: 2018-04-12T01:00:00.000Z
CVE-2018-1005 
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-1014, CVE-2018-1032, CVE-2018-1034.
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Microsoft SharePoint
Published: 2018-04-12T01:00:00.000Z
CVE-2018-1007 
An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Microsoft Office. This CVE ID is unique from CVE-2018-0950.
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Microsoft Office
Published: 2018-04-12T01:00:00.000Z
CVE-2018-1008 
An elevation of privilege vulnerability exists in Windows Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle objects in memory, aka "OpenType Font Driver Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 7
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows RT 8.1
vendor: Microsoft
product: Windows Server 2008
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows 8.1
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2008 R2
vendor: Microsoft
product: Windows 10
vendor: Microsoft
product: Windows 10 Servers
Published: 2018-04-12T01:00:00.000Z