rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-13233 
The sell function of a smart contract implementation for GSI, an Ethereum token, has an integer overflow in which "amount * sellPrice" can be zero, consequently reducing a seller's assets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T02:00:00.000Z
CVE-2018-13250 
libming 0.4.8 has a NULL pointer dereference in the getString function of the decompile.c file, related to decompileSTRINGCONCAT. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T14:00:00.000Z
CVE-2018-13251 
In libming 0.4.8, there is an excessive memory allocation attempt in the readBytes function of the util/read.c file, related to parseSWF_DEFINEBITSJPEG2. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T14:00:00.000Z
CVE-2018-13252 
Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T17:00:00.000Z
CVE-2018-13256 
PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-09T12:00:00.000Z
CVE-2018-13257 
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing attack from the CAS server login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T15:32:42.000Z
CVE-2018-13258 Tarball was missing .htaccess files
Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible.
Problem types: description: missing .htaccess files in release tarball used to protect directories that shouldn't be web accessible.
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-10-04T20:00:00.000Z
CVE-2018-13259 
An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.
Problem types: description: improper parsing
Affected products: vendor: n/a
product: zsh before 5.6
Published: 2018-09-05T07:00:00.000Z
CVE-2018-13280 
Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors.
Problem types: cwe_id: CWE-330
description: Use of Insufficiently Random Values (CWE-330)
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
Published: 2018-07-30T12:00:00.000Z
CVE-2018-13281 
Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the file_path parameter.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
Published: 2018-10-31T16:00:00.000Z
CVE-2018-13282 
Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
Problem types: cwe_id: CWE-384
description: Session Fixation (CWE-384)
Affected products: vendor: Synology
product: Photo Station
Published: 2018-10-31T16:00:00.000Z
CVE-2018-13283 
Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command, (2) hostname, or (3) port parameter.
Problem types: cwe_id: CWE-671
description: Lack of Administrator Control over Security (CWE-671)
Affected products: vendor: Synology
product: SSL VPN Client
Published: 2019-04-01T14:25:46.642Z
CVE-2018-13284 
Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command (CWE-78)
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
Published: 2019-04-01T14:26:30.018Z
CVE-2018-13285 
Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command (CWE-78)
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
Published: 2019-04-01T14:26:58.107Z
CVE-2018-13286 
Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions (CWE-276)
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
Published: 2019-04-01T14:26:30.087Z
CVE-2018-13287 
Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain sensitive information via the world readable configuration.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions (CWE-276)
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
Published: 2019-04-01T14:26:58.147Z
CVE-2018-13288 
Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: File Station
Published: 2019-04-01T14:27:25.734Z
CVE-2018-13289 
Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive information via the (1) folder_path or (2) real_path parameter.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
Published: 2019-04-01T14:28:24.612Z
CVE-2018-13290 
Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the existence of files or obtain sensitive information of files via the file_path parameter.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
Published: 2019-04-01T14:28:24.662Z
CVE-2018-13291 
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to obtain sensitive information via the world readable configuration.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
Published: 2019-04-01T14:28:46.507Z
CVE-2018-13292 
Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain sensitive information via the world readable configuration.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
Published: 2019-04-01T14:28:24.699Z
CVE-2018-13293 
Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation (CWE-79)
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
Published: 2019-04-01T14:28:46.543Z
CVE-2018-13294 
Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: Application Service
Published: 2019-04-01T14:29:32.386Z
CVE-2018-13295 
Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the version parameter.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: Application Service
Published: 2019-04-01T14:29:32.442Z
CVE-2018-13296 
Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers to conduct denial-of-service attacks via client-initiated renegotiation.
Problem types: cwe_id: CWE-400
description: Uncontrolled Resource Consumption (CWE-400)
Affected products: vendor: Synology
product: MailPlus Server
Published: 2019-04-01T14:29:55.085Z
CVE-2018-13297 
Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsm_path parameter.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: Drive
Published: 2019-04-01T14:30:30.257Z
CVE-2018-13298 
Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.
Problem types: cwe_id: CWE-300
description: Channel Accessible by Non-Endpoint (CWE-300)
Affected products: vendor: Synology
product: Android Moments
Published: 2019-04-01T14:30:54.811Z
CVE-2018-13299 
Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter.
Problem types: cwe_id: CWE-23
description: Relative Path Traversal (CWE-23)
Affected products: vendor: Synology
product: Calendar
Published: 2019-04-01T14:31:19.573Z
CVE-2018-13300 
In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T17:00:00.000Z
CVE-2018-13301 
In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T17:00:00.000Z
CVE-2018-13302 
In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T17:00:00.000Z
CVE-2018-13303 
In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T17:00:00.000Z
CVE-2018-13304 
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T17:00:00.000Z
CVE-2018-13305 
In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T17:00:00.000Z
CVE-2018-13306 
System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13307 
System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certain payloads cause the device to become permanently inoperable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13308 
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13309 
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13310 
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13311 
System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13312 
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13313 Admin Password returned in password.htm
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T18:16:17.000Z
CVE-2018-13314 
System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13315 
Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13316 
System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13317 
Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13318 
System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13319 
Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13320 
System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13321 
Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13322 
Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13323 
Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13324 
Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-26T22:00:00.000Z
CVE-2018-13325 
The _sell function of a smart contract implementation for GROWCHAIN (GROW), an Ethereum token, has an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T18:00:00.000Z
CVE-2018-13326 
The transfer and transferFrom functions of a smart contract implementation for Bittelux (BTX), an Ethereum token, have an integer overflow. NOTE: this has been disputed by a third party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T00:00:00.000Z
CVE-2018-13327 
The transfer and transferFrom functions of a smart contract implementation for ChuCunLingAIGO (CCLAG), an Ethereum token, have an integer overflow. NOTE: this has been disputed by a third party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T00:00:00.000Z
CVE-2018-13328 
The transfer, transferFrom, and mint functions of a smart contract implementation for PFGc, an Ethereum token, have an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T18:00:00.000Z
CVE-2018-13329 
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13330 
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13331 
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13332 
Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13333 
Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13334 
Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options[sysname]" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13335 
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13336 
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13337 
Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13338 
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-27T21:00:00.000Z
CVE-2018-13339 
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T22:00:00.000Z
CVE-2018-13340 
Gleez CMS 1.2.0 has CSRF, as demonstrated by a /page/add request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T22:00:00.000Z
CVE-2018-13341 
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-10T19:00:00.000Z