rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-3724 
general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: general-file-server node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3725 
hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: hekto node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3726 
crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: crud-file-server node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3727 
626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: 626 node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3728 
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Problem types: cwe_id: CWE-471
description: Modification of Assumed-Immutable Data (MAID) (CWE-471)
Affected products: vendor: hapi
product: hoek node module
Published: 2018-03-30T19:00:00.000Z
CVE-2018-3729 
localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: localhost-now node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3730 
mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: mcstatic node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3731 
public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: public node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3732 
resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: resolve-path node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3733 
crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: crud-file-server node module
Published: 2018-05-29T20:00:00.000Z
CVE-2018-3734 
stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: stattic node module
Published: 2018-05-29T20:00:00.000Z
CVE-2018-3735 
bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: bracket-template node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3737 
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling (CWE-770)
Affected products: vendor: HackerOne
product: sshpk node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3738 
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling (CWE-770)
Affected products: vendor: HackerOne
product: protobufjs node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3739 
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: https-proxy-agent node module
Published: 2018-06-07T02:00:00.000Z
CVE-2018-3740 
A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: Ryan Grove
product: sanitize (ruby gem)
Published: 2018-03-30T19:00:00.000Z
CVE-2018-3741 
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: Rails
product: rails-html-sanitizer
Published: 2018-03-30T19:00:00.000Z
CVE-2018-3743 
Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.
Problem types: cwe_id: CWE-601
description: Open Redirect (CWE-601)
Affected products: vendor: HackerOne
product: hekto
Published: 2018-06-01T17:00:00.000Z
CVE-2018-3744 
The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.
Problem types: cwe_id: CWE-35
description: Path Traversal: '.../...//' (CWE-35)
Affected products: vendor: HackerOne
product: html-pages node module
Published: 2018-05-29T20:00:00.000Z
CVE-2018-3745 
atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: HackerOne
product: atob node module
Published: 2018-05-29T20:00:00.000Z
CVE-2018-3746 
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: HackerOne
product: pdfinfojs
Published: 2018-06-01T17:00:00.000Z
CVE-2018-3747 
The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-3748 
There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in <a> element) allows to execute JavaScript code against any user who opens a directory listing containing such crafted file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-3749 
The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-3750 
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-3751 
The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-3752 
The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-3753 
The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-3754 
Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user input sanitization. This may allow an attacker to run arbitrary SQL queries when fetching data from database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2018-3755 
XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: HackerOne
product: sexstatic
Published: 2018-06-01T17:00:00.000Z
CVE-2018-3756 
Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or block multiple times, each with a random nonce, and have other validating nodes accept them as separate valid signatures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T19:00:00.000Z
CVE-2018-3757 
Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T19:00:00.000Z
CVE-2018-3758 
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: express-cart
Published: 2018-06-07T21:00:00.000Z
CVE-2018-3759 
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
Problem types: cwe_id: CWE-362
description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
Affected products: vendor: HackerOne
product: private_address_check ruby gem
Published: 2018-06-13T15:00:00.000Z
CVE-2018-3760 
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: Sprockets
Published: 2018-06-26T19:00:00.000Z
CVE-2018-3761 
Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2018-07-05T16:00:00.000Z
CVE-2018-3762 
Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2018-07-05T16:00:00.000Z
CVE-2018-3763 
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: Nextcloud
product: Nextcloud Calendar application
Published: 2018-07-05T16:00:00.000Z
CVE-2018-3764 
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: Nextcloud
product: Nextcloud Contacts application
Published: 2018-07-05T16:00:00.000Z
CVE-2018-3766 
Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: https://github.com/jtrussell
product: buttle
Published: 2018-07-05T16:00:00.000Z
CVE-2018-3767 
`memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: https://github.com/memcachier
product: memjs
Published: 2018-07-05T16:00:00.000Z
CVE-2018-3769 
ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: Ruby Grape
product: ruby-grape ruby gem
Published: 2018-07-05T16:00:00.000Z
CVE-2018-3770 
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: markdown-pdf
Published: 2018-07-20T22:00:00.000Z
CVE-2018-3771 
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: statics-server
Published: 2018-07-20T22:00:00.000Z
CVE-2018-3772 
Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: https://github.com/vvo
product: whereis
Published: 2018-07-30T18:00:00.000Z
CVE-2018-3773 
There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: https://github.com/microlinkhq
product: metascraper
Published: 2018-07-30T18:00:00.000Z
CVE-2018-3774 
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Problem types: cwe_id: CWE-425
description: Forced Browsing (CWE-425)
Affected products: vendor: HackerOne
product: url-parse
Published: 2018-08-12T22:00:00.000Z
CVE-2018-3775 
Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: HackerOne
product: Nextcloud Server
Published: 2018-08-12T22:00:00.000Z
CVE-2018-3776 
Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: HackerOne
product: Nextcloud Server
Published: 2018-08-12T22:00:00.000Z
CVE-2018-3777 
Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: https://github.com/restforce
product: restforce ruby gem
Published: 2018-08-03T20:00:00.000Z
CVE-2018-3778 
Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: HackerOne
product: aedes
Published: 2018-08-08T20:00:00.000Z
CVE-2018-3779 
active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: HackerOne
product: active-support ruby gem
Published: 2018-08-10T21:00:00.000Z
CVE-2018-3780 
A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: NextCloud
product: nextcloud/server
Published: 2018-08-13T19:00:00.000Z
CVE-2018-3781 
A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: NextCloud
product: nextcloud/talk
Published: 2018-08-13T19:00:00.000Z
CVE-2018-3783 
A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: https://github.com/JasonEtco
product: flintcms
Published: 2018-08-17T13:00:00.000Z
CVE-2018-3784 
A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: https://github.com/hunterloftis
product: cryo
Published: 2018-08-17T13:00:00.000Z
CVE-2018-3785 
A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
Problem types: cwe_id: CWE-78
description: OS Command Injection (CWE-78)
Affected products: vendor: https://github.com/stevemao
product: git-dummy-commit
Published: 2018-08-17T13:00:00.000Z
CVE-2018-3786 
A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: Egg
product: egg-scripts
Published: 2018-08-24T20:00:00.000Z
CVE-2018-3787 
Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: simplehttpserver
Published: 2018-08-31T16:00:00.000Z
CVE-2018-3809 
Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-01T19:00:00.000Z
CVE-2018-3810 
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-01T06:00:00.000Z
CVE-2018-3811 
SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-01T06:00:00.000Z
CVE-2018-3813 
getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USER_ID and AVI_USER_PASSWORD fields via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-01T20:00:00.000Z