rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-12402 
The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resources otherwise unreachable to the malicious page, if they can convince the visitor to save the complete web page. Similarly, SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, which can result in saving the wrong version of resources based on those cookies. This vulnerability affects Firefox < 63.
Problem types: description: WebBrowserPersist uses incorrect origin information
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-02-28T18:00:00.000Z
CVE-2018-12403 
If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability affects Firefox < 63.
Problem types: description: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-02-28T18:00:00.000Z
CVE-2018-12404 
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.
Problem types: description: Cryptographic Issues
Affected products: vendor: Mozilla
product: Network Security Services (NSS)
Published: 2019-05-02T16:40:14.000Z
CVE-2018-12405 
Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
Problem types: description: Memory safety bugs fixed in Firefox 64, Firefox ESR 60.4, and Thunderbird 60.4
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2019-02-28T18:00:00.000Z
CVE-2018-12406 
Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 64.
Problem types: description: Memory safety bugs fixed in Firefox 64
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-02-28T18:00:00.000Z
CVE-2018-12407 
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. This vulnerability affects Firefox < 64.
Problem types: description: Buffer overflow with ANGLE library when using VertexBuffer11 module
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-02-28T18:00:00.000Z
CVE-2018-12408 TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability
The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML eXternal Entity (XXE) attacks via incoming network messages, and may disclose the contents of files accessible to a running BusinessWorks engine Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks for z/Linux: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric: versions up to and including 5.13.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility of an unauthenticated user gaining access to sensitive information that is available to the system account hosting the BusinessWorks engine.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BusinessWorks
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BusinessWorks for z/Linux
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric
Published: 2018-08-08T14:00:00.000Z
CVE-2018-12409 
The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T19:00:00.000Z
CVE-2018-12410 TIBCO Spotfire Statistics Services remote execution vulnerabilities
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Affected releases are TIBCO Software Inc. TIBCO Spotfire Statistics Services versions up to and including 7.11.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility of unrestricted remote access to the operating system account hosting the web server component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Statistics Services
Published: 2018-10-10T20:00:00.000Z
CVE-2018-12411 TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks
The administrative daemon (tibdgadmind) of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: 3.3.0; 3.4.0; 3.5.0, TIBCO ActiveSpaces - Developer Edition: 3.0.0; 3.1.0; 3.3.0; 3.4.0; 3.5.0, and TIBCO ActiveSpaces - Enterprise Edition: 3.0.0; 3.1.0; 3.2.0; 3.3.0; 3.4.0; 3.5.0.
Problem types: description: In deployments that use the administrative daemon, there is a theoretical possibility that an attacker could gain full administrative access to the data grid, including the possibility of deleting data tables, and removing nodes from operation.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveSpaces - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO ActiveSpaces - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO ActiveSpaces - Enterprise Edition
Published: 2018-11-07T00:00:00.000Z
CVE-2018-12412 TIBCO FTL Realm Server Vulnerable to CSRF Attacks
The realm server (tibrealmserver) component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO FTL - Community Edition: versions up to and including 5.4.0, TIBCO FTL - Developer Edition: versions up to and including 5.4.0, TIBCO FTL - Enterprise Edition: versions up to and including 5.4.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an attacker could gain full access to realm configuration. With such access, the attacker might also be able to gain access to all data sent to endpoints controlled by the realm server.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO FTL - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Enterprise Edition
Published: 2018-11-07T00:00:00.000Z
CVE-2018-12413 TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF Attacks
The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition: 1.0.0, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition: 1.0.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an attacker could gain full access to the configuration of message schemas used with an Apache Kafka deployment. With such access, the attacker could also configure Apache Kafka communications to fail.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition
Published: 2018-11-07T00:00:00.000Z
CVE-2018-12414 TIBCO Rendezvous Vulnerable to CSRF Attacks
The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.'s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2.
Problem types: description: The impact of these vulnerabilities includes the theoretical possibility of reconfiguring all messaging handled by TIBCO Rendezvous (RV). With such access, the attacker might also be able to gain access to all data sent via RV.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Rendezvous
vendor: TIBCO Software Inc.
product: TIBCO Rendezvous Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO Rendezvous for z/Linux
vendor: TIBCO Software Inc.
product: TIBCO Rendezvous for z/OS
vendor: TIBCO Software Inc.
product: TIBCO Rendezvous Network Server
vendor: TIBCO Software Inc.
product: TIBCO Substation ES
Published: 2018-11-07T00:00:00.000Z
CVE-2018-12415 TIBCO Enterprise Message Service Vulnerable to CSRF Attacks
The Central Administration server (emsca) component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Message Service: versions 8.4.0 and below, TIBCO Enterprise Message Service - Community Edition: versions 8.4.0 and below, and TIBCO Enterprise Message Service - Developer Edition: versions 8.4.0 and below.
Problem types: description: In deployments of TIBCO Enterprise Message Service (EMS) that use the Central Administration server, the impact of this vulnerability includes the theoretical possibility of reconfiguring all EMS servers administered by the affected component. With such access, the attacker might also be able to gain access to all data sent via EMS.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Enterprise Message Service
vendor: TIBCO Software Inc.
product: TIBCO Enterprise Message Service - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO Enterprise Message Service - Developer Edition
Published: 2018-11-07T00:00:00.000Z
CVE-2018-12416 TIBCO DataSynapse GridServer Manager Component Vulnerable to Cross-Site Request Forgery
The GridServer Broker and GridServer Director components of TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an unauthenticated user to perform cross-site request forgery (CSRF). Affected releases are TIBCO Software Inc. TIBCO DataSynapse GridServer Manager: versions up to and including 5.2.0; 6.0.0; 6.0.1; 6.0.2; 6.1.0; 6.1.1; 6.2.0; 6.3.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a malicious actor could gain full access to the web interface of the affected components.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO DataSynapse GridServer Manager
Published: 2018-11-13T19:00:00.000Z
CVE-2018-12418 
Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-14T16:00:00.000Z
CVE-2018-12420 
IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-14T21:00:00.000Z
CVE-2018-12421 
LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-14T19:00:00.000Z
CVE-2018-12422 
addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the required string length first, and then allocated a large-enough buffer on the heap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T16:00:00.000Z
CVE-2018-12423 
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-14T21:00:00.000Z
CVE-2018-12426 
The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-02T17:00:00.000Z
CVE-2018-12429 
JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-18T16:00:00.000Z
CVE-2018-12431 
SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-14T23:00:00.000Z
CVE-2018-12432 
JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-14T23:00:00.000Z
CVE-2018-12433 
cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. NOTE: the vendor does not include side-channel attacks within its threat model
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T02:00:00.000Z
CVE-2018-12434 
LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T02:00:00.000Z
CVE-2018-12435 
Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, related to dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T02:00:00.000Z
CVE-2018-12436 
wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T02:00:00.000Z
CVE-2018-12437 
LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T02:00:00.000Z
CVE-2018-12438 
The Elliptic Curve Cryptography library (aka sunec or libsunec) allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T02:00:00.000Z
CVE-2018-12439 
MatrixSSL through 3.9.5 Open allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T02:00:00.000Z
CVE-2018-12440 
BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a DSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T02:00:00.000Z
CVE-2018-12441 
The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARY_PATH_NAME, leading to complete control of the affected system. The issue exists due to the Windows "Everyone" group being granted SERVICE_ALL_ACCESS permissions to the CorsairService Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-11T21:00:00.000Z
CVE-2018-12445 
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in conjunction with the Android keyGenerator class is not implemented. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-20T12:00:00.000Z
CVE-2018-12446 
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-20T12:00:00.000Z
CVE-2018-12447 
The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.8 and other products, has an integer overflow that leads to a heap-based buffer overflow and remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T13:00:00.000Z
CVE-2018-12448 
Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: NAVER Corporation
product: Whale Browser
Credits: lang: en
value: YongShao (Zhiyong Feng) of Mobike Security Team
Published: 2018-08-02T13:00:00.000Z
CVE-2018-12449 
The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.
Problem types: cwe_id: CWE-426
description: CWE-426
Affected products: vendor: NAVER Corporation
product: Whale Browser Installer
Credits: lang: en
value: Kushal Arvind Shah of Fortinet's FortiGuard Labs
Published: 2018-10-11T13:00:00.000Z
CVE-2018-12453 
Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-16T17:00:00.000Z
CVE-2018-12454 
The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-17T12:00:00.000Z
CVE-2018-12455 
Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "admin:" as the name of a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-10T21:00:00.000Z
CVE-2018-12456 
Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing the wireless SSID, rebooting the device, editing access control lists, or activating remote access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-10T21:00:00.000Z
CVE-2018-12457 
expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T14:00:00.000Z