rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-6964 
VMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege escalation vulnerability due to insecure usage of SUID binary. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on a Linux machine where Horizon Client is installed.
Problem types: description: Local privilege escalation vulnerability
Affected products: vendor: VMware
product: Horizon Client for Linux
Published: 2018-05-29T20:00:00.000Z
CVE-2018-6965 
VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6966 and CVE-2018-6967.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: VMware ESXi, Workstation, and Fusion
Published: 2018-07-09T20:00:00.000Z
CVE-2018-6966 
VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6965 and CVE-2018-6967.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: VMware ESXi, Workstation, and Fusion
Published: 2018-07-09T20:00:00.000Z
CVE-2018-6967 
VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6965 and CVE-2018-6966.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: VMware ESXi, Workstation, and Fusion
Published: 2018-07-09T20:00:00.000Z
CVE-2018-6968 
The VMware AirWatch Agent for Android prior to 8.2 and AirWatch Agent for Windows Mobile prior to 6.5.2 contain a remote code execution vulnerability in real time File Manager capabilities. This vulnerability may allow for unauthorized creation and execution of files in the Agent sandbox and other publicly accessible directories such as those on the SD card by a malicious administrator.
Problem types: description: Remote Code Execution
Affected products: vendor: VMware
product: AirWatch Agent
Published: 2018-06-11T22:00:00.000Z
CVE-2018-6969 
VMware Tools (10.x and prior before 10.3.0) contains an out-of-bounds read vulnerability in HGFS. Successful exploitation of this issue may lead to information disclosure or may allow attackers to escalate their privileges on the guest VMs. In order to be able to exploit this issue, file sharing must be enabled.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: VMware Tools
Published: 2018-07-13T13:00:00.000Z
CVE-2018-6970 
VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privileged process running on a system where Horizon Connection Server, Horizon Agent or Horizon Client are installed. Note: This issue doesn't apply to Horizon 6, 7 Agents installed on Linux systems or Horizon Clients installed on non-Windows systems.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: VMware Horizon 6, Horizon 7, and Horizon Client
Published: 2018-08-13T21:00:00.000Z
CVE-2018-6971 
VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log file when an account other than the currently logged on user is specified during installation (including silent installations). Successful exploitation of this issue may allow low privileged users access to the credentials specified during the Horizon View Agent installation.
Problem types: description: Local information disclosure vulnerability
Affected products: vendor: VMware
product: Horizon View Agent
Published: 2018-07-25T13:00:00.000Z
CVE-2018-6972 
VMware ESXi (6.7 before ESXi670-201806401-BG, 6.5 before ESXi650-201806401-BG, 6.0 before ESXi600-201806401-BG and 5.5 before ESXi550-201806401-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain a denial-of-service vulnerability due to NULL pointer dereference issue in RPC handler. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.
Problem types: description: Denial-of-service vulnerability
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2018-07-25T13:00:00.000Z
CVE-2018-6973 
VMware Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds write vulnerability in the e1000 device. This issue may allow a guest to execute code on the host.
Problem types: description: Out-of-bounds write vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2018-08-15T12:00:00.000Z
CVE-2018-6974 
VMware ESXi (6.7 before ESXi670-201810101-SG, 6.5 before ESXi650-201808401-BG, and 6.0 before ESXi600-201808401-BG), Workstation (14.x before 14.1.3) and Fusion (10.x before 10.1.3) contain an out-of-bounds read vulnerability in SVGA device. This issue may allow a guest to execute code on the host.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2018-10-16T20:00:00.000Z
CVE-2018-6975 
The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted.
Problem types: description: Data protection vulnerability
Affected products: vendor: VMware
product: AirWatch Agent for iOS prior to 5.8.1
Published: 2018-09-11T15:00:00.000Z
CVE-2018-6976 
The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted filenames and associated metadata in SQLite database for the Content Locker.
Problem types: description: Data protection vulnerability
Affected products: vendor: VMware
product: Content Locker for iOS
Published: 2018-09-11T15:00:00.000Z
CVE-2018-6977 
VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerability due to an infinite loop in a 3D-rendering shader. Successfully exploiting this issue may allow an attacker with normal user privileges in the guest to make the VM unresponsive, and in some cases, possibly result other VMs on the host or the host itself becoming unresponsive.
Problem types: description: Denial-of-service vulnerability
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2018-10-09T20:00:00.000Z
CVE-2018-6978 
vRealize Operations (7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6.1.11286876) contains a local privilege escalation vulnerability due to improper permissions of support scripts. Admin user of the vROps application with shell access may exploit this issue to elevate the privileges to root on a vROps machine. Note: the admin user (non-sudoer) should not be confused with root of the vROps machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-18T20:00:00.000Z
CVE-2018-6979 
The VMware Workspace ONE Unified Endpoint Management Console (A/W Console) 9.7.x prior to 9.7.0.3, 9.6.x prior to 9.6.0.7, 9.5.x prior to 9.5.0.16, 9.4.x prior to 9.4.0.22, 9.3.x prior to 9.3.0.25, 9.2.x prior to 9.2.3.27, and 9.1.x prior to 9.1.5.6 contains a SAML authentication bypass vulnerability which can be leveraged during device enrollment. This vulnerability may allow for a malicious actor to impersonate an authorized SAML session if certificate-based authentication is enabled. This vulnerability is also relevant if certificate-based authentication is not enabled, but the outcome of exploitation is limited to an information disclosure (Important Severity) in those cases.
Problem types: description: SAML authentication bypass
Affected products: vendor: VMware
product: VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console)
Published: 2018-10-05T13:00:00.000Z
CVE-2018-6980 
VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which they are not allowed to perform.
Problem types: description: Authorization bypass vulnerability
Affected products: vendor: VMware
product: VMware vRealize Log Insight
Published: 2018-11-13T22:00:00.000Z
CVE-2018-6981 
VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG, VMware Workstation 15, VMware Workstation 14.1.3 or below, VMware Fusion 11, VMware Fusion 10.1.3 or below contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which may allow a guest to execute code on the host.
Problem types: description: uninitialized stack memory
Affected products: vendor: VMware
product: VMware ESXi, VMware Workstation, and VMware Fusion
Published: 2018-12-04T14:00:00.000Z
CVE-2018-6982 
VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which may lead to an information leak from host to guest.
Problem types: description: uninitialized stack memory
Affected products: vendor: VMware
product: VMware ESXi
Published: 2018-12-04T14:00:00.000Z
CVE-2018-6983 
VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer overflow vulnerability in the virtual network devices. This issue may allow a guest to execute code on the host.
Problem types: description: Integer overflow vulnerability
Affected products: vendor: VMware
product: VMware Workstation and Fusion
Published: 2018-11-27T17:00:00.000Z
CVE-2018-7032 
webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a MitM attacker to take advantage of it for arbitrary code execution, as demonstrated by an "ext::sh -c" attack or an option injection attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-14T15:00:00.000Z
CVE-2018-7033 
SchedMD Slurm before 17.02.10 and 17.11.x before 17.11.5 allows SQL Injection attacks against SlurmDBD.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T22:00:00.000Z
CVE-2018-7034 
TRENDnet TEW-751DR v1.03B03, TEW-752DRU v1.03B01, and TEW733GR v1.03B01 devices allow authentication bypass via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-14T16:00:00.000Z
CVE-2018-7035 
Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode in an Add Blog action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-05T14:00:00.000Z
CVE-2018-7039 
CCN-lite 2.0.0 Beta allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because the ccnl_ndntlv_prependBlob function in ccnl-pkt-ndntlv.c can be called with wrong arguments. Specifically, there is an incorrect integer data type causing a negative third argument in some cases of crafted TLV data with inconsistent length information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-14T19:00:00.000Z
CVE-2018-7046 
Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C# code in a "Pages -> Edit -> Template -> Edit template properties -> Layout" box.  NOTE: the vendor has responded that there is intended functionality for authorized users to edit and update ascx code layout
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-20T15:00:00.000Z
CVE-2018-7047 
An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX credentials (remote code execution may be possible as well).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-01T20:00:00.000Z
CVE-2018-7048 
An issue was discovered in Wowza Streaming Engine before 4.7.1. There is a denial of service (memory consumption) via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-01T20:00:00.000Z
CVE-2018-7049 
An issue was discovered in Wowza Streaming Engine before 4.7.1. There is an XSS vulnerability in the HTTP providers (com.wowza.wms.http.HTTPProviderMediaList and com.wowza.wms.http.streammanager.HTTPStreamManager) causing script injection and/or reflection via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-01T20:00:00.000Z
CVE-2018-7050 
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. A NULL pointer dereference occurs for an "empty" nick.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-15T20:00:00.000Z
CVE-2018-7051 
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Certain nick names could result in out-of-bounds access when printing theme strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-15T20:00:00.000Z
CVE-2018-7052 
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. When the number of windows exceeds the available space, a crash due to a NULL pointer dereference would occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-15T20:00:00.000Z
CVE-2018-7053 
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when SASL messages are received in an unexpected order.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-15T20:00:00.000Z
CVE-2018-7054 
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netsplits. NOTE: this issue exists because of an incomplete fix for CVE-2017-7191.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-15T20:00:00.000Z
CVE-2018-7055 
GroupViewProxyServlet in RoomWizard before 4.4.x allows SSRF via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-15T10:00:00.000Z
CVE-2018-7056 
RoomWizard before 4.4.x allows remote attackers to obtain potentially sensitive information about IP addresses via /getGroupTimeLineJSON.action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-15T10:00:00.000Z
CVE-2018-7057 
RoomWizard before 4.4.x allows XSS via the HelpAction.action pageName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-15T10:00:00.000Z
CVE-2018-7058 
Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to gain administrator privileges on the system. The vulnerability is exposed only on ClearPass web interfaces, including administrative, guest captive portal, and API. Customers who do not expose ClearPass web interfaces to untrusted users are impacted to a lesser extent.
Problem types: description: authentication bypass can lead to server compromise
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7059 
Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An authenticated user with the "mon" permission could use this vulnerability to obtain cluster credentials which could allow privilege escalation. This vulnerability is only present when authenticated as a user with "mon" permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7060 
Aruba ClearPass 6.6.x prior to 6.6.9 and 6.7.x prior to 6.7.1 is vulnerable to CSRF attacks against authenticated users. An attacker could manipulate an authenticated user into performing actions on the web administrative interface.
Problem types: description: authenticated sessions are vulnerable to cross site request forgery (CSRF)
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7063 
In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.
Problem types: description: remote access restriction bypass
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass Policy Manager
Published: 2018-12-07T21:00:00.000Z
CVE-2018-7064 
A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0
Problem types: description: Reflected Cross-Site Scripting
Affected products: vendor: n/a
product: Aruba Instant (IAP)
Published: 2019-05-10T17:10:32.000Z
CVE-2018-7065 
An authenticated SQL injection vulnerability in Aruba ClearPass Policy Manager can lead to privilege escalation. All versions of ClearPass are affected by multiple authenticated SQL injection vulnerabilities. In each case, an authenticated administrative user of any type could exploit this vulnerability to gain access to "appadmin" credentials, leading to complete cluster compromise. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.
Problem types: description: SQL Injection
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass Policy Manager
Published: 2018-12-07T21:00:00.000Z
CVE-2018-7066 
An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> Network -> Devices -> CLI Settings. Resolution: Fixed in 6.7.5 and 6.6.10-hotfix.
Problem types: description: remote command execution
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass Policy Manager
Published: 2018-12-07T21:00:00.000Z
CVE-2018-7067 
A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass could allow an attacker to compromise the entire cluster through a specially crafted API call. Network access to the administrative web interface is required to exploit this vulnerability. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.
Problem types: description: remote authentication bypass
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass Policy Manager
Published: 2018-12-07T21:00:00.000Z
CVE-2018-7068 
HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
Problem types: description: remote HOST header attack
Affected products: vendor: Hewlett Packard Enterprise
product: HPE CentralView Fraud Risk Management
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7069 
HPE has identified a remote unauthenticated access to files vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
Problem types: description: remote unathenticated access to files
Affected products: vendor: Hewlett Packard Enterprise
product: HPE CentralView Fraud Risk Management
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7070 
HPE has identified a remote disclosure of information vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
Problem types: description: remote disclosure of information
Affected products: vendor: Hewlett Packard Enterprise
product: HPE CentralView Fraud Risk Management
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7071 
HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 prior to gui patch 3.
Problem types: description: remote unauthorized access to sensitive information
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Network Function Virtualization Director (NFVD)
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7072 
A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24.
Problem types: description: remote bypass of security restrictions
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Moonshot Provisioning Manager
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7073 
A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24.
Problem types: description: local arbitrary file modification
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Moonshot Provisioning Manager
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7074 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07. The vulnerability was resolved in iMC PLAT 7.3 E0605P04 or subsequent version.
Problem types: description: remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (IMC)
Published: 2018-08-06T20:00:00.000Z