rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1115 
postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: unspecified
product: postgresql
Published: 2018-05-10T19:00:00.000Z
CVE-2018-1116 
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: [UNKNOWN]
product: polkit
Published: 2018-07-10T19:00:00.000Z
CVE-2018-1117 
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.
Problem types: cwe_id: CWE-532
description: CWE-532
Affected products: vendor: [UNKNOWN]
product: ovirt-ansible-roles
Published: 2018-06-19T13:00:00.000Z
CVE-2018-1118 
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.
Problem types: cwe_id: CWE-665
description: CWE-665
Affected products: vendor: kernel
product: vhost
Published: 2018-05-10T22:00:00.000Z
CVE-2018-1120 
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: [UNKNOWN]
product: kernel
Published: 2018-06-20T13:00:00.000Z
CVE-2018-1121 
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.
Problem types: cwe_id: CWE-367
description: CWE-367
Affected products: vendor: [UNKNOWN]
product: procps-ng, procps
Published: 2018-06-13T20:00:00.000Z
CVE-2018-1122 
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
Problem types: cwe_id: CWE-829
description: CWE-829
Affected products: vendor: [UNKNOWN]
product: procps-ng, procps
Published: 2018-05-23T14:00:00.000Z
CVE-2018-1123 
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: [UNKNOWN]
product: procps-ng, procps
Published: 2018-05-23T14:00:00.000Z
CVE-2018-1124 
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
Problem types: cwe_id: CWE-190
description: CWE-190
cwe_id: CWE-122
description: CWE-122
Affected products: vendor: [UNKNOWN]
product: procps-ng
Published: 2018-05-23T13:00:00.000Z
CVE-2018-1125 
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: [UNKNOWN]
product: procps-ng, procps
Published: 2018-05-23T14:00:00.000Z
CVE-2018-1126 
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: [UNKNOWN]
product: procps-ng, procps
Published: 2018-05-23T13:00:00.000Z
CVE-2018-1127 
Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.
Problem types: cwe_id: CWE-613
description: CWE-613
Affected products: vendor: Red Hat
product: Red Hat Gluster Storage
Published: 2018-09-11T15:00:00.000Z
CVE-2018-1128 
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
Problem types: cwe_id: CWE-294
description: CWE-294
Affected products: vendor: Red Hat, Inc.
product: ceph
Published: 2018-07-10T14:00:00.000Z
CVE-2018-1129 
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Red Hat, Inc.
product: ceph
Published: 2018-07-10T14:00:00.000Z
CVE-2018-1130 
Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: unspecified
product: kernel
Published: 2018-05-10T13:00:00.000Z
CVE-2018-1131 
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Problem types: cwe_id: CWE-349
description: CWE-349
Affected products: vendor: Red Hat, Inc.
product: infinispan
Published: 2018-05-15T13:00:00.000Z
CVE-2018-1132 
A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: [UNKNOWN]
product: opendaylight
Published: 2018-06-20T13:00:00.000Z
CVE-2018-1133 
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
Problem types: description: eval injection
Affected products: vendor: n/a
product: Moodle 3.x unknown
Published: 2018-05-25T12:00:00.000Z
CVE-2018-1134 
An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.
Problem types: description: incorrect access control
Affected products: vendor: n/a
product: Moodle 3.x unknown
Published: 2018-05-25T12:00:00.000Z
CVE-2018-1135 
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.
Problem types: description: incorrect access control
Affected products: vendor: n/a
product: Moodle 3.x unknown
Published: 2018-05-25T12:00:00.000Z
CVE-2018-1136 
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.
Problem types: description: incorrect access control
Affected products: vendor: n/a
product: Moodle 3.x unknown
Published: 2018-05-25T12:00:00.000Z
CVE-2018-1137 
An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.
Problem types: description: incorrect access control
Affected products: vendor: n/a
product: Moodle 3.x unknown
Published: 2018-05-25T12:00:00.000Z
CVE-2018-1139 
A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: The Samba Team
product: samba
Published: 2018-08-22T14:00:00.000Z
CVE-2018-1140 
A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server, used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: The Samba Team
product: samba
Published: 2018-08-22T14:00:00.000Z
CVE-2018-1141 
When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the installation location.
Problem types: description: Local Privilege Escalation
Affected products: vendor: Tenable
product: Nessus
Published: 2018-03-20T18:00:00.000Z
CVE-2018-1142 
Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request, an authenticated attacker could potentially execute arbitrary JavaScript code by manipulating certain URL parameters related to offline plugins.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Tenable
product: Tenable Appliance
Published: 2018-03-28T13:00:00.000Z
CVE-2018-1143 
A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to twonky_command.cgi.
Problem types: description: Command Injection
Affected products: vendor: Belkin
product: N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
Published: 2018-04-19T13:00:00.000Z
CVE-2018-1144 
A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to proxy.cgi.
Problem types: description: Command Injection
Affected products: vendor: Belkin
product: N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
Published: 2018-04-19T13:00:00.000Z
CVE-2018-1145 
A remote unauthenticated user can overflow a stack buffer in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to proxy.cgi.
Problem types: description: Stack Buffer Overflow
Affected products: vendor: Belkin
product: N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
Published: 2018-04-19T13:00:00.000Z
CVE-2018-1146 
A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled the telnet session requires no password and provides root access.
Problem types: description: Improper Access Control
Affected products: vendor: Belkin
product: N750 DB Wi-Fi Dual-Band N+ Gigabit Router (F9K1103)
Published: 2018-04-19T13:00:00.000Z
CVE-2018-1147 
In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file, which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session. In other scenarios, XSS could also occur by altering variables from the Advanced Settings.
Problem types: description: CrossSite Scripting (XSS)
Affected products: vendor: Tenable
product: Tenable Nessus
Published: 2018-05-18T22:00:00.000Z
CVE-2018-1148 
In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change.
Problem types: description: Session Fixation
Affected products: vendor: Tenable
product: Tenable Nessus
Published: 2018-05-18T22:00:00.000Z
CVE-2018-1149 
cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests.
Problem types: description: Stack buffer overflow
Affected products: vendor: NUUO
product: NUUO NVRMini2
Published: 2018-09-19T15:00:00.000Z
CVE-2018-1150 
NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists.
Problem types: description: Backdoor
Affected products: vendor: NUUO
product: NUUO NVRMini2
Published: 2018-09-19T15:00:00.000Z
CVE-2018-1151 
The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Western Digital
product: TV Media Player
vendor: Western Digital
product: TV Live Hub
Published: 2018-06-12T17:00:00.000Z
CVE-2018-1152 
libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
Problem types: description: Denial of Service
Affected products: vendor: Tenable
product: libjpeg-turbo
Published: 2018-06-18T14:00:00.000Z
CVE-2018-1153 
Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic.
Problem types: description: Improper Certificate Validation
Affected products: vendor: Tenable
product: Burp Suite Community Edition
Published: 2018-06-18T14:00:00.000Z
CVE-2018-1154 
In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue.
Problem types: description: Username Enumeration
Affected products: vendor: Tenable
product: SecurityCenter
Published: 2018-08-02T19:00:00.000Z
CVE-2018-1155 
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: Tenable
product: SecurityCenter
Published: 2018-08-02T19:00:00.000Z
CVE-2018-1156 
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T19:00:00.000Z
CVE-2018-1157 
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system via a crafted HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T19:00:00.000Z
CVE-2018-1158 
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T19:00:00.000Z
CVE-2018-1159 
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-23T19:00:00.000Z
CVE-2018-1160 
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
Problem types: cwe_id: CWE-787
description: CWE-787 Out of bounds write
Affected products: vendor: Netatalk
product: Netatalk
Published: 2018-12-20T21:00:00.000Z
CVE-2018-1161 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13. Authentication is not required to exploit this vulnerability. The specific flaw exists within nvwsworker.exe. When parsing the boundary header of a multipart request, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-4215.
Problem types: cwe_id: CWE-121
description: CWE-121-Stack-based Buffer Overflow
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2018-1162 
This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Quest NetVault Backup 11.2.0.13. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed. The specific flaw exists within the handling of Export requests. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to arbitrarily overwrite files resulting in a denial-of-service condition. Was ZDI-CAN-4222.
Problem types: cwe_id: CWE-22
description: CWE-22-Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2018-1163 
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to critical functions. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4752.
Problem types: cwe_id: CWE-287
description: CWE-287-Improper Authentication
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2018-1164 
This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by improper access controls that allow access to critical functions without authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-CAN-4540.
Problem types: cwe_id: CWE-306
description: CWE-306-Missing Authentication for Critical Function
Affected products: vendor: ZyXEL
product: ZyXEL P-870H-51 DSL Router
Published: 2018-02-21T14:00:00.000Z
CVE-2018-1165 
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMB_IOC_SVCENUM IOCTL. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4983.
Problem types: cwe_id: CWE-122
description: CWE-122-Heap-based Buffer Overflow
Affected products: vendor: Joyent
product: Joyent SmartOS
Published: 2018-02-21T14:00:00.000Z
CVE-2018-1166 
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMBIOC_TREE_RELE ioctl. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4984.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Joyent
product: Joyent SmartOS
Published: 2018-02-21T14:00:00.000Z
CVE-2018-1167 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5501.
Problem types: cwe_id: CWE-78
description: CWE-78-Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Spotify
product: Spotify Music Player
Published: 2018-04-19T02:00:00.000Z