rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-7075 
A remote cross-site scripting (XSS) vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT version v7.3 (E0506). The vulnerability is fixed in Intelligent Management Center PLAT 7.3 E0605P04 or subsequent version.
Problem types: description: cross site scripting (XSS)
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (IMC)
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7076 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) prior to iMC PLAT 7.3 E0605P04.
Problem types: description: remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HPE intelligence Management Center (iMC) PLAT
Published: 2018-10-17T13:00:00.000Z
CVE-2018-7077 
A security vulnerability in HPE XP P9000 Command View Advanced Edition (CVAE) Device Manager (DevMgr 8.5.0-00 and prior to 8.6.0-00), Configuration Manager (CM 8.5.0-00 and prior to 8.6.0-00) could be exploited to allow local and remote unauthorized access to sensitive information.
Problem types: description: Local and Remote Unauthorized Access to Sensitive Information
Affected products: vendor: Hewlett Packard Enterprise
product: HPE XP P9000 Command View Advanced Edition (CVAE)
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7078 
A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than version v1.30.
Problem types: description: remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 5 (iLO 5)
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7079 
Aruba ClearPass Policy Manager guest authorization failure. Certain administrative operations in ClearPass Guest do not properly enforce authorization rules, which allows any authenticated administrative user to execute those operations regardless of privilege level. This could allow low-privilege users to view, modify, or delete guest users. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.
Problem types: description: remote access restriction bypass
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass Policy Manager
Published: 2018-12-07T21:00:00.000Z
CVE-2018-7080 
A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit the vulnerability could install new, potentially malicious firmware into the AP's BLE radio and could then gain access to the AP's console port. This vulnerability is applicable only if the BLE radio has been enabled in affected access points. The BLE radio is disabled by default. Note - Aruba products are NOT affected by a similar vulnerability being tracked as CVE-2018-16986.
Problem types: description: remote access restriction bypass
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba Access Points
Published: 2018-12-07T21:00:00.000Z
CVE-2018-7081 
A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: Aruba Mobility Controllers
Published: 2019-09-13T16:49:09.000Z
CVE-2018-7082 
A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that would not be logged. Workaround: None. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0
Problem types: description: Authenticated command injection
Affected products: vendor: n/a
product: Aruba Instant (IAP)
Published: 2019-05-10T16:49:16.000Z
CVE-2018-7083 
If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at the time it crashed. It was discovered that core dumps are stored in a way that unauthenticated users can access them through the Aruba Instant web interface. Core dumps could contain sensitive information such as keys and passwords. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0
Problem types: description: Core dumps are publicly accessible
Affected products: vendor: n/a
product: Aruba Instant (IAP)
Published: 2019-05-10T16:43:30.000Z
CVE-2018-7084 
A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1
Problem types: description: Unauthenticated command execution
Affected products: vendor: n/a
product: Aruba Instant (IAP)
Published: 2019-05-10T17:14:37.000Z
CVE-2018-7090 
HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr and RepMgr.
Problem types: description: cross site scripting (XSS)
Affected products: vendor: Hewlett Packard Enterprise
product: HPE XP P9000 Command View Advanced Edition Software (CVAE) versions 7.0.0-00 to earlier than 8.60-00
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7091 
HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr and RepMgr.
Problem types: description: open redirect
Affected products: vendor: Hewlett Packard Enterprise
product: HPE XP P9000 Command View Advanced Edition Software (CVAE)
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7092 
A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. The vulnerability could be remotely exploited to allow for remote directory traversal leading to arbitrary file deletion.
Problem types: description: remote directory traversal leading to arbitrary file deletion
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center Platform (IMC Plat)
Published: 2018-08-06T20:00:00.000Z
CVE-2018-7093 
A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager firmware prior to v1.58, and Moonshot Component Pack prior to v2.55 could be remotely exploited to create a denial of service.
Problem types: description: remote denial of service
Affected products: vendor: Hewlett Packard Enterprise
product: iLO 5 for HPE Gen10 Servers, iLO 4, iLO 3, Moonshot Chassis Management Firmware, Moonshot Component Packs for HPE ProLiant m510 and m710x server cartridges
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7094 
A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-5.0.0.0-22913(GA). The vulnerability may be exploited locally to allow disclosure of privileged information.
Problem types: description: Local Disclosure of Privileged Information
Affected products: vendor: Hewlett Packard Enterprise
product: HPE 3PAR Service Processors
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7095 
A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow access restriction bypass.
Problem types: description: remote access restriction bypass
Affected products: vendor: Hewlett Packard Enterprise
product: HPE 3PAR Service Processors
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7096 
A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow code execution.
Problem types: description: remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HPE 3PAR Service Processors
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7097 
A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be exploited remotely to allow cross-site request forgery.
Problem types: description: cross-site request forgery
Affected products: vendor: Hewlett Packard Enterprise
product: HPE 3PAR Service Processors
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7098 
A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be locally exploited to allow directory traversal.
Problem types: description: local directory traversal
Affected products: vendor: Hewlett Packard Enterprise
product: HPE 3PAR Service Processors
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7099 
A security vulnerability was identified in 3PAR Service Processor (SP) prior to SP-4.4.0.GA-110(MU7). The vulnerability may be locally exploited to allow disclosure of privileged information.
Problem types: description: local disclosure of privileged information
Affected products: vendor: Hewlett Packard Enterprise
product: HPE 3PAR Service Processors
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7100 
A potential security vulnerability has been identified in HPE OfficeConnect 1810 Switch Series (HP 1810-24G - P.2.22 and previous versions, HP 1810-48G PK.1.34 and previous versions, HP 1810-8 v2 P.2.22 and previous versions). The vulnerability could allow local disclosure of sensitive information.
Problem types: description: local disclosure of sensitive information
Affected products: vendor: Hewlett Packard Enterprise
product: HP 1810-24G, HP 1810-48G, HP 1810-8 v2 Switches
Published: 2018-08-14T14:00:00.000Z
CVE-2018-7101 
A potential remote denial of service security vulnerability has been identified in HPE Integrated Lights Out 4 prior to v2.60 and iLO 5 for Gen 10 servers prior to v1.30.
Problem types: description: remote denial of service
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers, HPE Integrated Lights-Out 4 (iLO 4)
Published: 2018-09-27T18:00:00.000Z
CVE-2018-7102 
A security vulnerability in HPE Intelligent Management Center (iMC) PLAT E0506P09, createFabricAutoCfgFile could be remotely exploited via directory traversal to allow remote arbitrary file modification.
Problem types: description: Remote Arbitrary File Modification
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (iMC) PLAT
Published: 2018-09-27T18:00:00.000Z
CVE-2018-7103 
A Remote Code Execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Services Manager Software earlier than version IMC WSM 7.3 E0506P02.
Problem types: description: Remote Code Execution
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (iMC) Wireless Services Manager Software
Published: 2018-09-27T18:00:00.000Z
CVE-2018-7104 
A Remote Code Execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Services Manager Software earlier than version IMC WSM 7.3 E0506P02.
Problem types: description: Remote Code Execution
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (iMC) Wireless Services Manager Software
Published: 2018-09-27T18:00:00.000Z
CVE-2018-7105 
A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 (iLO 4) prior to v2.61, HPE Integrated Lights-Out 3 (iLO 3) prior to v1.90 could be remotely exploited to execute arbitrary code leading to disclosure of information.
Problem types: description: remote execution of arbitrary code
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers, HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 3 (iLO 3)
Published: 2018-09-27T18:00:00.000Z
CVE-2018-7107 
A potential security vulnerability has been identified in HPE Device Entitlement Gateway (DEG) v3.2.4, v3.3 and v3.3.1. The vulnerability could be remotely exploited to allow local SQL injection and elevation of privilege.
Problem types: description: Remote SQL Injection and Elevation of Privileges
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Device Entitlement Gateway (DEG)
Published: 2018-09-27T18:00:00.000Z
CVE-2018-7108 
HPE StorageWorks XP7 Automation Director (AutoDir) version 8.5.2-02 to earlier than 8.6.1-00 has a local and remote authentication bypass vulnerability that exposed the user authentication information of the storage system. This problem sometimes occurred under specific conditions when running a service template.
Problem types: description: Local and Remote Authentication Bypass
Affected products: vendor: Hewlett Packard Enterprise
product: HPE StorageWorks XP7 Automation Director (AutoDir)
Published: 2018-09-27T18:00:00.000Z
CVE-2018-7109 
HPE has addressed a remote arbitrary file modification vulnerability in HPE enhanced Internet Usage Manager (eIUM) v9.0FP1 with the cumulative patch for v9.0FP1 - eIUM90FP01XXX.YYYYMMDD-HHMM.
Problem types: description: Remote Arbitrary File Modification
Affected products: vendor: Hewlett Packard Enterprise
product: HPE enhanced Internet Usage Manager (eIUM)
Published: 2018-09-27T18:00:00.000Z
CVE-2018-7110 
A remote unauthorized disclosure of information vulnerability was identified in HPE Service Governance Framework (SGF) version 4.2, 4.3. A race condition under high load in SGF exists where SGF transferred different parameter to the enabler.
Problem types: description: remote unauthorized disclosure of information
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Service Governance Framework (SGF)
Published: 2018-10-17T13:00:00.000Z
CVE-2018-7111 
A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users.
Problem types: description: remote unauthorized access
Affected products: vendor: Hewlett Packard Enterprise
product: HPE UIoT
Published: 2018-10-17T13:00:00.000Z
CVE-2018-7112 
The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware updates as follows. The HPE Windows firmware installer was updated in the system ROM updates which also addressed the original Spectre/Meltdown set of vulnerabilities. At that time, the Windows firmware installer was also updated in the versions of HPE Integrated Lights-Out 2, 3, and 4 (iLO 2, 3, and 4) listed in the security bulletin. The updated HPE Windows firmware installer was released in the system ROM and HPE Integrated Lights-Out (iLO) releases documented in earlier HPE Security Bulletins: HPESBHF03805, HPESBHF03835, HPESBHF03831. Windows-based systems that have already been updated to the system ROM or iLO versions described in these security bulletins require no further action.
Problem types: description: local disclosure of privileged information
Affected products: vendor: Hewlett Packard Enterprise
product: Windows firmware installer for Gen9, Gen8, G7,and G6 HPE servers
Published: 2018-12-03T15:00:00.000Z
CVE-2018-7113 
A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security restrictions for firmware updates.
Problem types: description: local bypass of security restrictions
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2018-12-03T15:00:00.000Z
CVE-2018-7114 
HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to remote buffer overflow in dbman leading to code execution. This problem is resolved in IMC PLAT 7.3 (E0605P06) or subsequent versions.
Problem types: description: remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (IMC)
Published: 2018-12-03T15:00:00.000Z
CVE-2018-7115 
HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote buffer overflow in dbman.exe opcode 10001 on Windows. This problem is resolved in IMC PLAT 7.3 (E0605P06) or subsequent versions.
Problem types: description: remote buffer overflow
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (IMC)
Published: 2018-12-03T15:00:00.000Z
CVE-2018-7116 
HPE Intelligent Management Center (IMC) prior to IMC PLAT 7.3 (E0605P06) is vulnerable to a remote denial of service via dbman Opcode 10003 'Filename'. This problem is resolved in IMC PLAT 7.3 (E0605P06) or subsequent versions.
Problem types: description: remote denial of service
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (IMC)
Published: 2018-12-03T15:00:00.000Z
CVE-2018-7117 
A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers earlier than version v1.40.
Problem types: description: remote cross-site scripting
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Published: 2019-04-09T18:28:18.000Z
CVE-2018-7118 
A local access restriction bypass vulnerability was identified in HPE Service Pack for ProLiant (SPP) Bundled Software earlier than version 2018.09.0.
Problem types: description: local access restriction bypass
Affected products: vendor: n/a
product: HPE Service Pack for Proliant (HPE SPP)
Published: 2019-04-09T18:28:13.000Z
CVE-2018-7119 
A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or T9750H05^AIH, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND; all versions on H-series. STDSEC-STANDARD SECURITY PROD All prior versions before T6533L01^ADU or T6533H05^ADW, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND and all versions on H-series . Note that some commands in NonStop Safeguard and NonStop Standard Security software require username and password to be passed as command line parameters, which may lead to a local disclosure of the credentials.
Problem types: description: Local Disclosure of Sensitive Information
Affected products: vendor: HPE
product: NonStop SAFEGAURD and NonStop H-series STDSEC-STANDARD SECURITY Product
Published: 2019-05-10T18:21:24.000Z
CVE-2018-7120 
A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.50, which is part of the HPE Synergy Custom SPP 2018.11.20190205, could allow local or remote unauthorized elevation of privilege.
Problem types: description: Local or Remote Unauthorized Elevation of Privilege
Affected products: vendor: HPE
product: HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy
Published: 2019-05-10T18:22:40.000Z
CVE-2018-7121 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:09:20.000Z
CVE-2018-7122 
A remote disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote disclosure of Information
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:09:58.000Z
CVE-2018-7123 
A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: denial of service
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:10:36.000Z
CVE-2018-7124 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:11:08.000Z
CVE-2018-7125 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:11:37.000Z
CVE-2018-7158 
The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
Problem types: cwe_id: CWE-185
description: CWE-185: Incorrect Regular Expression
Affected products: vendor: The Node.js Project
product: Node.js
Published: 2018-05-17T14:00:00.000Z
CVE-2018-7159 
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
Problem types: cwe_id: CWE-115
description: CWE-115: Misinterpretation of Input
Affected products: vendor: The Node.js Project
product: Node.js
Published: 2018-05-17T14:00:00.000Z