rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-20124 
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-20125 
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T21:00:00.000Z
CVE-2018-20126 
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T21:00:00.000Z
CVE-2018-20127 
An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T08:00:00.000Z
CVE-2018-20128 
An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pathname followed by a crafted substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T08:00:00.000Z
CVE-2018-20129 
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the filename=1.jpg.p*hp value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T08:00:00.000Z
CVE-2018-20131 
The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a regular user would not have access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T01:00:00.000Z
CVE-2018-20133 
ymlref allows code injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-20135 
Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of applications through a man-in-the-middle attack. An attacker may trick Galaxy Apps into using an arbitrary hostname for which the attacker can provide a valid SSL certificate, and emulate the API of the app store to modify existing apps at installation time. The specific flaw involves an HTTP method to obtain the load-balanced hostname that enforces SSL only after obtaining a hostname from the load balancer, and a missing app signature validation in the application XML. An attacker can exploit this vulnerability to achieve Remote Code Execution on the device. The Samsung ID is SVE-2018-12071.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T15:45:01.000Z
CVE-2018-20136 
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T18:00:00.000Z
CVE-2018-20137 
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T18:00:00.000Z
CVE-2018-20138 
PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T18:00:00.000Z
CVE-2018-20140 
Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T20:00:25.000Z
CVE-2018-20141 
AbanteCart 1.2.12 has reflected cross-site scripting (XSS) via the sort parameter, as demonstrated by a /apparel--accessories?sort= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T20:04:05.000Z
CVE-2018-20144 
GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-28T14:53:12.000Z
CVE-2018-20145 
Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-13T20:00:00.000Z
CVE-2018-20146 
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-21T03:00:00.000Z
CVE-2018-20147 
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T20:00:00.000Z
CVE-2018-20148 
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T20:00:00.000Z
CVE-2018-20149 
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T20:00:00.000Z
CVE-2018-20150 
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T20:00:00.000Z
CVE-2018-20151 
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T20:00:00.000Z
CVE-2018-20152 
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T20:00:00.000Z
CVE-2018-20153 
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T20:00:00.000Z
CVE-2018-20154 
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T22:00:00.000Z
CVE-2018-20155 
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T22:00:00.000Z
CVE-2018-20156 
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T22:00:00.000Z
CVE-2018-20157 
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-14T23:00:00.000Z
CVE-2018-20159 
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin, and extracted to the main directory. In order for the ".zip" file to be accepted, it must also contain a package.json file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-15T05:00:00.000Z
CVE-2018-20160 
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T21:12:00.000Z
CVE-2018-20161 
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the Wi-Fi network. (Access to live video from the app also becomes unavailable.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-15T06:00:00.000Z
CVE-2018-20162 
Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super' CLI access privileges to bypass a restricted shell and execute arbitrary commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T20:15:59.000Z
CVE-2018-20164 
An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T14:00:00.000Z
CVE-2018-20165 
Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-22T19:26:07.000Z
CVE-2018-20166 
A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed case, such as the .pHp extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-20167 
Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T05:00:00.000Z
CVE-2018-20168 
Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service ("physical address not valid" panic) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T05:00:00.000Z
CVE-2018-20169 
An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T06:00:00.000Z
CVE-2018-20170 
OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T06:00:00.000Z
CVE-2018-20171 
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T15:00:00.000Z
CVE-2018-20172 
An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T15:00:00.000Z
CVE-2018-20173 
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T08:00:00.000Z
CVE-2018-20174 
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20175 
rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20176 
rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20177 
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20178 
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20179 
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20180 
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process() and results in memory corruption and probably even a remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20181 
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20182 
rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2018-20184 
In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.c, which allows attackers to cause a denial of service via a crafted image file, because the number of rows or columns can exceed the pixel-dimension restrictions of the TGA specification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T17:00:00.000Z
CVE-2018-20185 
In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T17:00:00.000Z
CVE-2018-20186 
An issue was discovered in Bento4 1.5.1-627. AP4_Sample::ReadData in Core/Ap4Sample.cpp allows attackers to trigger an attempted excessive memory allocation, related to AP4_DataBuffer::SetDataSize and AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T17:00:00.000Z
CVE-2018-20187 
A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation, not ECDSA signatures or ECDH key agreement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-08T19:00:00.000Z
CVE-2018-20188 
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T19:00:00.000Z
CVE-2018-20189 
In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib file that is crafted to appear with direct pixel values and also colormapping (which is not available beyond 8-bits/sample), and therefore lacks indexes initialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T20:00:00.000Z
CVE-2018-20190 
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T20:00:00.000Z
CVE-2018-20191 
hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-20193 
Certain Secure Access SA Series SSL VPN products (originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC) allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 (build 9627) 4.2 Release (build 7631). This occurs because appropriate controls are not performed. Specifically, it is possible for a readonly user to change the administrator user password by making a local copy of the /dana-admin/user/update.cgi page, changing the "user" value, and saving the changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-21T23:00:00.000Z
CVE-2018-20194 
There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because limiting the additional noise energy level is mishandled for the G_max <= G case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-18T01:00:00.000Z
CVE-2018-20195 
A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-18T01:00:00.000Z
CVE-2018-20196 
There is a stack-based buffer overflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because the S_M array is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-18T01:00:00.000Z
CVE-2018-20197 
There is a stack-based buffer underflow in the third instance of the calculate_gain function in libfaad/sbr_hfadj.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impact because limiting the additional noise energy level is mishandled for the G_max > G case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-18T01:00:00.000Z
CVE-2018-20198 
A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-18T01:00:00.000Z