rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-16862 
A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: [UNKNOWN]
product: kernel:
Published: 2018-11-26T19:00:00.000Z
CVE-2018-16863 
It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.
Problem types: cwe_id: CWE-184
description: CWE-184
Affected products: vendor: Artifex
product: ghostscript
Published: 2018-12-03T17:00:00.000Z
CVE-2018-16864 
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: The systemd Project
product: systemd
Published: 2019-01-11T20:00:00.000Z
CVE-2018-16865 
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: The systemd Project
product: systemd
Published: 2019-01-11T21:00:00.000Z
CVE-2018-16866 
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
Problem types: cwe_id: CWE-125
description: CWE-125
cwe_id: CWE-200
description: CWE-200
Affected products: vendor: The systemd Project
product: systemd
Published: 2019-01-11T19:00:00.000Z
CVE-2018-16867 
A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host.
Problem types: cwe_id: CWE-362
description: CWE-362
Affected products: vendor: [UNKNOWN]
product: QEMU:
Published: 2018-12-12T13:00:00.000Z
CVE-2018-16868 
A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.
Problem types: cwe_id: CWE-203
description: CWE-203
Affected products: vendor: [UNKNOWN]
product: gnutls
Published: 2018-12-03T14:00:00.000Z
CVE-2018-16869 
A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.
Problem types: cwe_id: CWE-203
description: CWE-203
Affected products: vendor: [UNKNOWN]
product: nettle
Published: 2018-12-03T14:00:00.000Z
CVE-2018-16870 
It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS. This may lead to leakage of sensible data.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: wolfssl
Published: 2019-01-03T16:00:00.000Z
CVE-2018-16871 
A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: Red Hat
product: kernel:
Published: 2019-07-30T16:19:25.000Z
CVE-2018-16872 
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
Problem types: cwe_id: CWE-367
description: CWE-367
Affected products: vendor: [UNKNOWN]
product: QEMU:
Published: 2018-12-13T21:00:00.000Z
CVE-2018-16873 
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: [UNKNOWN]
product: golang
Published: 2018-12-14T14:00:00.000Z
CVE-2018-16874 
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: [UNKNOWN]
product: golang
Published: 2018-12-14T14:00:00.000Z
CVE-2018-16875 
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: [UNKNOWN]
product: golang
Published: 2018-12-14T14:00:00.000Z
CVE-2018-16876 
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Red Hat
product: ansible
Published: 2019-01-03T15:00:00.000Z
CVE-2018-16877 
A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: ClusterLabs
product: pacemaker
Published: 2019-04-18T00:00:00.000Z
CVE-2018-16878 
A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: ClusterLabs
product: pacemaker
Published: 2019-04-18T00:00:00.000Z
CVE-2018-16879 
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.
Problem types: cwe_id: CWE-311
description: CWE-311
Affected products: vendor: [UNKNOWN]
product: Tower
Published: 2019-01-03T14:00:00.000Z
CVE-2018-16880 
A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: The Linux Foundation
product: kernel
Published: 2019-01-29T16:00:00.000Z
CVE-2018-16881 
A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: The rsyslog Project
product: rsyslog:
Published: 2019-01-25T18:00:00.000Z
CVE-2018-16882 
A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: The Linux Foundation
product: kernel:
Published: 2019-01-03T16:00:00.000Z
CVE-2018-16883 
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: [UNKNOWN]
product: sssd
Published: 2018-12-19T14:00:00.000Z
CVE-2018-16884 
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: [UNKNOWN]
product: kernel:
Published: 2018-12-18T22:00:00.000Z
CVE-2018-16885 
A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases causing a memory access fault and a system halt by accessing invalid memory address. This issue only affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The Linux Foundation
product: kernel
Published: 2019-01-03T16:00:00.000Z
CVE-2018-16886 
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: The etcd Project
product: etcd:
Published: 2019-01-14T19:00:00.000Z
CVE-2018-16887 
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: The Katello Project
product: katello
Published: 2019-01-13T02:00:00.000Z
CVE-2018-16888 
It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
Problem types: cwe_id: CWE-250
description: CWE-250
Affected products: vendor: The systemd Project
product: systemd
Published: 2019-01-14T22:00:00.000Z
CVE-2018-16889 
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
Problem types: cwe_id: CWE-532
description: CWE-532
Affected products: vendor: The Ceph Project
product: ceph
Published: 2019-01-28T14:00:00.000Z
CVE-2018-16890 
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The curl Project
product: curl
Published: 2019-02-06T20:00:00.000Z
CVE-2018-16946 
LG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) files and download backup files (via download.php) without authenticating. These backup files contain user credentials and configuration information for the camera device. An attacker is able to discover the backup filename via reading the system logs or report data, or just by brute-forcing the backup filename pattern. It may be possible to authenticate to the admin account with the admin password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T01:00:00.000Z
CVE-2018-16947 
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T01:00:00.000Z
CVE-2018-16948 
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T01:00:00.000Z
CVE-2018-16949 
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T01:00:00.000Z
CVE-2018-16950 
Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T02:00:00.000Z
CVE-2018-16951 
xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T01:00:00.000Z
CVE-2018-16952 
The Oracle WebCenter Interaction Portal 10.3.3 does not implement protection against Cross-site Request Forgery in its design. The impact is sensitive actions in the portal (such as changing a portal user's password). NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T02:00:00.000Z
CVE-2018-16953 
The AjaxView::DisplayResponse() function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T02:00:00.000Z
CVE-2018-16954 
An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The login function of the portal is vulnerable to insecure redirection (also called an open redirect). The in_hi_redirect parameter is not validated by the application after a successful login. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T02:00:00.000Z
CVE-2018-16955 
The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). The content of the in_hi_redirect parameter, when prefixed with the https:// scheme, is unsafely reflected in a HTML META tag in the HTTP response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T02:00:00.000Z
CVE-2018-16956 
The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be renamed to include characters unsupported for URIs by the web server hosting the WCI Portal software (such as IIS). Renaming pages to include unsupported characters, such as 0x7f, prevents these pages from being accessed over the web server, causing a Denial of Service (DoS) to the page. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T02:00:00.000Z
CVE-2018-16957 
The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. Authentication to the Oracle WCI search service uses this hardcoded password and cannot be customised by customers. An adversary able to access this service over a network could perform search queries to extract large quantities of sensitive information from the WCI installation. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T02:00:00.000Z
CVE-2018-16958 
An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NET_SessionID primary session cookie, when Internet Information Services (IIS) with ASP.NET is used, is not protected with the HttpOnly attribute. The attribute cannot be enabled by customers. Consequently, this cookie is exposed to session hijacking attacks should an adversary be able to execute JavaScript in the origin of the portal installation. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T02:00:00.000Z
CVE-2018-16959 
An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecure default User Profile community configuration that allows anonymous users to retrieve the account names of all portal users via /portal/server.pt/user/user/ requests. When WCI is synchronised with Active Directory (AD), this vulnerability can expose the account names of all AD users. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-18T02:00:00.000Z
CVE-2018-16960 
An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xd_user_formal_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T19:31:24.000Z
CVE-2018-16961 
An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/dl_publication.php allows Path traversal via the file parameter, allowing remote attackers to read PDF files in arbitrary directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T19:33:46.000Z
CVE-2018-16962 
Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-12T20:00:00.000Z
CVE-2018-16965 
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z