rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-14611 
Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) NUC(R)
Published: 2019-12-16T19:11:44.000Z
CVE-2019-14612 
Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) NUC(R)
Published: 2019-12-16T19:11:55.000Z
CVE-2019-14613 
Improper access control in driver for Intel(R) VTune(TM) Amplifier for Windows* before update 8 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: Intel
product: Intel(R) VTune(TM) Amplifier for Windows*
Published: 2020-01-17T17:37:48.000Z
CVE-2019-14615 
Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: Intel
product: Intel(R) Processors
Published: 2020-01-17T17:36:57.000Z
CVE-2019-14620 
Insufficient control flow management for some Intel(R) Wireless Bluetooth(R) products may allow an unprivileged user to potentially enable denial of service via adjacent access.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Intel(R) Wireless Bluetooth(R) Advisory
Published: 2020-08-13T03:29:54.000Z
CVE-2019-14625 
Improper access control in on-card storage for the Intel® FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
Affected products: vendor: Intel
product: Intel(R) FPGA Programmable Acceleration Card N3000
Published: 2020-03-12T17:43:20.000Z
CVE-2019-14626 
Improper access control in PCIe function for the Intel® FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel
product: Intel(R) FPGA Programmable Acceleration Card N3000
Published: 2020-03-12T17:43:10.000Z
CVE-2019-14629 
Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: Intel
product: Intel(R) DAAL
Published: 2020-01-17T17:38:56.000Z
CVE-2019-14630 
Reliance on untrusted inputs in a security decision in some Intel(R) Thunderbolt(TM) controllers may allow unauthenticated user to potentially enable information disclosure via physical access.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) Controller Advisory
Published: 2020-08-13T02:08:32.000Z
CVE-2019-14652 
explorer.js in Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) v2 alpha before 2019-08-02 allows XSS in certain circumstances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-13T04:47:18.000Z
CVE-2019-14653 
pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-03T13:20:00.000Z
CVE-2019-14654 
In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T00:39:07.000Z
CVE-2019-14656 
Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:01:20.000Z
CVE-2019-14657 
Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary code execution as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:02:34.000Z
CVE-2019-14662 
Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T11:14:59.000Z
CVE-2019-14663 
Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T11:15:13.000Z
CVE-2019-14664 
In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, he unknowingly leaks the plaintext of the encrypted message part(s) back to the attacker. This attack variant bypasses protection mechanisms implemented after the "EFAIL" attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T19:25:58.000Z
CVE-2019-14665 
Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T18:29:45.000Z
CVE-2019-14666 
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-25T19:19:15.000Z
CVE-2019-14667 
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T19:23:40.000Z
CVE-2019-14668 
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T19:23:34.000Z
CVE-2019-14669 
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T19:23:23.000Z
CVE-2019-14670 
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T19:23:15.000Z
CVE-2019-14671 
Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T19:23:08.000Z
CVE-2019-14672 
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T19:22:58.000Z
CVE-2019-14678 
SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T20:59:44.000Z
CVE-2019-14679 
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T20:00:39.000Z
CVE-2019-14680 
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T19:59:36.000Z
CVE-2019-14681 
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T19:57:14.000Z
CVE-2019-14682 
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T19:56:11.000Z
CVE-2019-14683 
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T19:54:52.000Z
CVE-2019-14684 
A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process. This process is very similar, yet not identical to CVE-2019-14687.
Problem types: description: DLL Hijacking
Affected products: vendor: Trend Micro
product: Trend Micro Password Manager
Published: 2019-08-20T13:30:04.000Z
CVE-2019-14685 
A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service.
Problem types: description: Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2019-08-21T19:41:36.000Z
CVE-2019-14686 
A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micro Ransom Buster (1.0) tool in which, if exploited, would allow an attacker to load a malicious DLL, leading to elevated privileges.
Problem types: description: DLL Hijacking
Affected products: vendor: Trend Micro
product: Trend Micro Ransom Buster, Trend Micro Security (Consumer)
Published: 2019-08-21T19:42:17.000Z
CVE-2019-14687 
A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process. This process is very similar, yet not identical to CVE-2019-14684.
Problem types: description: DLL Hijacking
Affected products: vendor: Trend Micro
product: Trend Micro Password Manager
Published: 2019-08-20T13:30:51.000Z
CVE-2019-14688 
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.
Problem types: description: DLL Hijack
Affected products: vendor: Trend Micro
product: Trend Micro IM Security (IMS), Trend Micro Control Manager (TMCM), Trend Micro OfficeScan (OSCE), Trend Micro Endpoint Sensor (TMES), Trend Micro Security (Consumer), Trend Micro ScanMail for Microsoft Exchange (SMEX), Trend Micro ServerProtect (SP), Trend Micro Mobile Security Enterprise (TMMS Enterprise)
Published: 2020-02-20T22:50:22.000Z
CVE-2019-14690 
AdPlug 2.3.1 has a heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:03:26.000Z
CVE-2019-14691 
AdPlug 2.3.1 has a heap-based buffer overflow in CdtmLoader::load() in dtm.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:03:40.000Z
CVE-2019-14692 
AdPlug 2.3.1 has a heap-based buffer overflow in CmkjPlayer::load() in mkj.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:03:53.000Z
CVE-2019-14693 
Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T17:29:58.000Z
CVE-2019-14694 
A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handling IRP_MJ_CLEANUP requests in the minifilter for directory change notifications. This allows an attacker to cause a denial of service (BSOD) when an executable is run inside the container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-28T19:12:32.000Z
CVE-2019-14695 
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T13:14:03.000Z
CVE-2019-14696 
Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T15:38:29.000Z
CVE-2019-14697 
musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T15:34:50.000Z
CVE-2019-14698 
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. In a CGI program running under the HTTPD web server, a buffer overflow in the param parameter leads to remote code execution in the context of the nobody account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:27:07.000Z
CVE-2019-14699 
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can exploit OS Command Injection in the filename parameter for remote code execution as root. This occurs in the Mainproc executable file, which can be run from the HTTPD web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:26:55.000Z
CVE-2019-14700 
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. There is disclosure of the existence of arbitrary files via Path Traversal in HTTPD. This occurs because the filename specified in the TZ parameter is accessed with a substantial delay if that file exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:26:35.000Z
CVE-2019-14701 
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can trigger read operations on an arbitrary file via Path Traversal in the TZ parameter, but cannot retrieve the data that is read. This causes a denial of service if the filename is, for example, /dev/random.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:26:19.000Z
CVE-2019-14702 
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms that are reachable through HTTPD. An attacker can, for example, create an admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:26:02.000Z
CVE-2019-14703 
A CSRF issue was discovered in webparam?user&action=set&param=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:24:46.000Z
CVE-2019-14704 
An SSRF issue was discovered in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 via FTP commands following a newline character in the uploadfile field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:24:21.000Z
CVE-2019-14705 
An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie can be used to make requests as an admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:24:09.000Z
CVE-2019-14706 
A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can upload a file to upload.php with a filename longer than 256 bytes. This will be placed in the updownload area. It will not be deleted, because of a buffer overflow in a Bash command string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:23:55.000Z
CVE-2019-14707 
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading to remote code execution. The attacker can provide arbitrary firmware in a .dat file via a webparam?system&action=set&upgrade URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:23:19.000Z
CVE-2019-14708 
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. A buffer overflow in the action parameter leads to remote code execution in the context of the nobody account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:21:40.000Z
CVE-2019-14709 
A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/mipsca.db. If a camera is compromised, the attacker can gain access to passwords and abuse them to compromise further systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T22:21:16.000Z
CVE-2019-14711 
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T04:31:36.000Z
CVE-2019-14712 
Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T04:33:04.000Z
CVE-2019-14713 
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T04:33:42.000Z
CVE-2019-14715 
Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T04:58:17.000Z
CVE-2019-14716 
Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T04:39:29.000Z
CVE-2019-14717 
Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T04:38:21.000Z
CVE-2019-14718 
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol arbitrary command injection and privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T04:36:47.000Z
CVE-2019-14719 
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T04:35:21.000Z
CVE-2019-14721 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T15:14:28.000Z
CVE-2019-14722 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a victim's account via an attacker account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T15:15:13.000Z
CVE-2019-14723 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T15:16:27.000Z
CVE-2019-14724 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an attacker account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-11T11:28:05.000Z
CVE-2019-14725 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-11T11:26:14.000Z
CVE-2019-14726 
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T15:19:50.000Z