rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-12540 
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:15:36.000Z
CVE-2019-12541 
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T14:36:03.000Z
CVE-2019-12542 
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T14:25:33.000Z
CVE-2019-12543 
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T14:15:54.000Z
CVE-2019-12548 
Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T20:38:32.000Z
CVE-2019-12549 
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T16:33:13.000Z
CVE-2019-12550 
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T16:29:08.000Z
CVE-2019-12551 
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-22T19:31:57.000Z
CVE-2019-12552 
In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-22T19:40:37.000Z
CVE-2019-12553 
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T16:20:28.000Z
CVE-2019-12554 
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T16:23:49.000Z
CVE-2019-12555 
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T16:17:25.000Z
CVE-2019-12562 
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T19:48:46.000Z
CVE-2019-12564 
In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-02T23:07:06.000Z
CVE-2019-12566 
The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-02T23:34:58.000Z
CVE-2019-12567 
Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2018-10387 and CVE-2019-12568.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T22:45:50.000Z
CVE-2019-12568 
Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2018-10387 and CVE-2019-12567.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T22:45:54.000Z
CVE-2019-12569 
A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user, if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T00:50:00.000Z
CVE-2019-12570 
A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-03T17:22:06.000Z
CVE-2019-12571 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists, it will be truncated and the contents completely overwritten. This file is removed on disconnect. An unprivileged user can create a hard or soft link to arbitrary files owned by any user on the system, including root. This creates a denial of service condition and possible data loss if leveraged by a malicious local user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T19:45:24.000Z
CVE-2019-12572 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. On startup, the PIA Windows service (pia-service.exe) loads the OpenSSL library from %PROGRAMFILES%\Private Internet Access\libeay32.dll. This library attempts to load the C:\etc\ssl\openssl.cnf configuration file which does not exist. By default on Windows systems, authenticated users can create directories under C:\. A low privileged user can create a C:\etc\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine library resulting in arbitrary code execution as SYSTEM when the service starts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-21T17:51:16.000Z
CVE-2019-12573 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpn_launcher binary is setuid root. This binary supports the --log option, which accepts a path as an argument. This parameter is not sanitized, which allows a local unprivileged user to overwrite arbitrary files owned by any user on the system, including root. This creates a denial of service condition and possible data loss if leveraged by a malicious local user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T19:31:02.000Z
CVE-2019-12574 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The updater loads several libraries from a folder that authenticated users have write access to. A low privileged user can leverage this vulnerability to execute arbitrary code as SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T19:55:46.000Z
CVE-2019-12575 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The root_runner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts to load several libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can create a malicious library under this path to execute arbitrary code as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T19:19:50.000Z
CVE-2019-12576 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher binary is setuid root. This program is called during the connection process and executes several operating system utilities to configure the system. The networksetup utility is called using relative paths. A local unprivileged user can execute arbitrary commands as root by creating a networksetup trojan which will be executed during the connection process. This is possible because the PATH environment variable is not reset prior to executing the OS utility.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T19:34:40.000Z
CVE-2019-12577 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpn_launcher.64 is setuid root. This binary creates /tmp/pia_upscript.sh when executed. Because the file creation mask (umask) is not reset, the umask value is inherited from the calling process. This value can be manipulated to cause the privileged binary to create files with world writable permissions. A local unprivileged user can modify /tmp/pia_upscript.sh during the connect process to execute arbitrary code as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T19:27:59.000Z
CVE-2019-12578 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher.64 binary is setuid root. This binary executes /opt/pia/openvpn-64/openvpn, passing the parameters provided from the command line. Care was taken to programmatically disable potentially dangerous openvpn parameters; however, the --route-pre-down parameter can be used. This parameter accepts an arbitrary path to a script/program to be executed when OpenVPN exits. The --script-security parameter also needs to be passed to allow for this action to be taken, and --script-security is not currently in the disabled parameter list. A local unprivileged user can pass a malicious script/binary to the --route-pre-down option, which will be executed as root when openvpn is stopped.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T19:51:31.000Z
CVE-2019-12579 
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA Linux/macOS binary openvpn_launcher.64 binary is setuid root. This binary accepts several parameters to update the system configuration. These parameters are passed to operating system commands using a "here" document. The parameters are not sanitized, which allow for arbitrary commands to be injected using shell metacharacters. A local unprivileged user can pass special crafted parameters that will be interpolated by the operating system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T19:24:30.000Z
CVE-2019-12581 
A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-27T14:10:08.000Z
CVE-2019-12583 
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-27T14:01:02.000Z
CVE-2019-12584 
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T02:27:47.000Z
CVE-2019-12585 
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T02:28:08.000Z
CVE-2019-12586 
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows attackers in radio range to cause a denial of service (crash) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-04T20:00:45.000Z
CVE-2019-12587 
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key (PMK) after the completion of any EAP authentication method, which allows attackers in radio range to replay, decrypt, or spoof frames via a rogue access point.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-04T11:31:48.000Z
CVE-2019-12588 
The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon frames, probe responses, and association responses, which allows attackers in radio range to cause a denial of service (crash) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-04T11:30:13.000Z
CVE-2019-12589 
In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T03:00:21.000Z
CVE-2019-12591 
NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T12:35:50.000Z
CVE-2019-12592 
A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T20:38:59.000Z
CVE-2019-12593 
IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T16:41:07.000Z
CVE-2019-12594 
DOSBox 0.74-2 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-02T16:07:42.000Z
CVE-2019-12595 
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:14:05.000Z
CVE-2019-12596 
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:13:03.000Z
CVE-2019-12597 
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T13:10:22.000Z
CVE-2019-12598 
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T17:36:56.000Z
CVE-2019-12599 
SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T17:38:30.000Z
CVE-2019-12600 
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T17:35:06.000Z
CVE-2019-12601 
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T17:33:14.000Z
CVE-2019-12611 
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the miniupnpd component to crash or to trigger a device reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T18:55:04.000Z
CVE-2019-12612 
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T16:02:53.000Z
CVE-2019-12614 
An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T21:58:24.000Z
CVE-2019-12615 
An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T21:58:42.000Z
CVE-2019-12616 
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T04:27:12.000Z
CVE-2019-12617 
In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T11:57:18.000Z
CVE-2019-12618 
HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T16:49:04.000Z
CVE-2019-12619 Cisco SD-WAN Solution SQL Injection Vulnerability
A vulnerability in the web interface for Cisco SD-WAN Solution vManage could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affecting the integrity of the data.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Cisco
product: Cisco SD-WAN Solution
Published: 2020-01-26T04:25:19.231Z
CVE-2019-12620 Cisco HyperFlex Software Counter Value Injection Vulnerability
A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to inject arbitrary values on an affected device. The vulnerability is due to insufficient authentication for the statistics collection service. An attacker could exploit this vulnerability by sending properly formatted data values to the statistics collection service of an affected device. A successful exploit could allow the attacker to cause the web interface statistics view to present invalid data to users.
Problem types: cwe_id: CWE-345
description: CWE-345
Affected products: vendor: Cisco
product: Cisco HyperFlex HX-Series
Published: 2019-09-18T16:15:18.927Z
CVE-2019-12621 Cisco HyperFlex Static SSL Key Vulnerability
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.
Problem types: cwe_id: CWE-320
description: CWE-320
Affected products: vendor: Cisco
product: Cisco HyperFlex HX-Series
Published: 2019-08-21T18:00:28.606Z