rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-18929 
The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username and password can leverage it to gain administrator-level access on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-29T19:33:33.000Z
CVE-2018-18930 
The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. An authenticated attacker can upload a crafted ZIP file (based on an exported backup of existing "Bulletins") containing a malicious file. When uploaded, the system only checks for the presence of the needed files within the ZIP and, as long as the malicious file is named properly, will extract all contained files to a new directory on the system, named with a random GUID. The attacker can determine this GUID by previewing an image from the uploaded Bulletin within the web UI. Once the GUID is determined, the attacker can navigate to the malicious file and execute it. In testing, an ASPX web shell was uploaded, allowing for remote-code execution in the context of a restricted IIS user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-29T19:35:20.000Z
CVE-2018-18931 
An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permissions on the C:\TRMS\Services directory, an attacker who has gained access to the system can elevate their privileges from a restricted account to full SYSTEM by replacing the Carousel.Service.exe file with a custom malicious executable. This service is independent of the associated IIS web site, which means that this service can be manipulated by an attacker without losing access to vulnerabilities in the web interface (which would potentially be used in conjunction with this attack, to control the service). Once the attacker has replaced Carousel.Service.exe, the server can be restarted using the command "shutdown -r -t 0" from a web shell, causing the system to reboot and launching the malicious Carousel.Service.exe as SYSTEM on startup. If this malicious Carousel.Service.exe is configured to launch a reverse shell back to the attacker, then upon reboot the attacker will have a fully privileged remote command-line environment to manipulate the system further.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-29T19:36:40.000Z
CVE-2018-18933 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader!safe_vsnprintf+0x00000000002c4330" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18934 
An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code (that is extracted and can be executed). This can also be exploited via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18935 
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18936 
An issue was discovered in PopojiCMS v2.0.1. admin_library.php allows remote attackers to delete arbitrary files via directory traversal in the po-admin/route.php?mod=library&act=delete id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18937 
An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in ClientDataSet_getValues in client/ied_connection.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18938 
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18939 
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18940 
servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=[XSS] in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.  NOTE: this product is discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-31T19:00:00.000Z
CVE-2018-18941 
In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password in the vgn/ccb/user/mgmt/user/edit/0,1628,0,00.html?uid=admin HTML source code, and then creating a privileged user account.  NOTE: this product is discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-31T19:00:00.000Z
CVE-2018-18942 
In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18943 
An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T08:00:00.000Z
CVE-2018-18944 
Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T13:04:25.000Z
CVE-2018-18949 
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T09:00:00.000Z
CVE-2018-18950 
KindEditor through 4.1.11 has a path traversal vulnerability in php/upload_json.php. Anyone can browse a file or directory in the kindeditor/attached/ folder via the path parameter without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T09:00:00.000Z
CVE-2018-18952 
JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T09:00:00.000Z
CVE-2018-18954 
The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T20:00:00.000Z
CVE-2018-18955 
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-16T20:00:00.000Z
CVE-2018-18956 
The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segfault and daemon crash) via crafted input to the SMTP parser, as exploited in the wild in November 2018.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T21:00:00.000Z
CVE-2018-18957 
An issue has been found in libIEC61850 v1.3. It is a stack-based buffer overflow in prepareGooseBuffer in goose/goose_publisher.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-05T22:00:00.000Z
CVE-2018-18958 
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T20:01:30.000Z
CVE-2018-18959 
An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longer functions until a reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-24T17:00:00.000Z
CVE-2018-18960 
An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP to find certain devices on the network, but the default version is v2c, allowing an amplification attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-24T17:00:00.000Z
CVE-2018-18963 
Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-06T05:00:00.000Z
CVE-2018-18964 
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several extensions in which contained HTML can be executed, such as the svg extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-06T04:00:00.000Z
CVE-2018-18965 
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-06T04:00:00.000Z
CVE-2018-18966 
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-06T04:00:00.000Z
CVE-2018-18975 
An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backend servers because of a weak certificate-pinning implementation, leading to disclosure of medical information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-06T19:09:02.000Z
CVE-2018-18976 
An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-06T19:12:22.000Z
CVE-2018-18977 
An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. An attacker may reverse engineer the codebase to extract sensitive data that contributes to the disclosure of medical information of patients utilizing the Ascensia platform. This occurs because of weak obfuscation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-06T19:14:58.000Z
CVE-2018-18978 
An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the encryption key is necessary for deciphering communications between this application and the backend server. This, in combination with retrieving any user's encrypted data from the Ascensia cloud through another vulnerability, allows an attacker to obtain and modify any patient's medical information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-06T19:18:26.000Z
CVE-2018-18979 
An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded initialization vector. Extraction of the initialization vector is necessary for deciphering communications between this application and the backend server. This, in combination with retrieving any user's encrypted data from the Ascensia cloud through another vulnerability, allows an attacker to obtain and modify any patient's medical information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-06T19:19:20.000Z
CVE-2018-18980 
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-06T04:00:00.000Z
CVE-2018-18981 
In Rockwell Automation FactoryTalk Services Platform 2.90 and earlier, a remote unauthenticated attacker could send numerous crafted packets to service ports resulting in memory consumption that could lead to a partial or complete denial-of-service condition to the affected services.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Rockwell
product: Rockwell Automation FactoryTalk Services Platform v2.90 and earlier
Published: 2019-01-24T21:00:00.000Z
CVE-2018-18982 
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.
Problem types: cwe_id: CWE-89
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
Affected products: vendor: n/a
product: NUUO CMS
Published: 2018-11-27T21:00:00.000Z
CVE-2018-18983 
VT-Designer Version 2.1.7.31 is vulnerable by the program reading the contents of a file (which is already in memory) into another heap-based buffer, which may cause the program to crash or allow remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-30T18:00:00.000Z
CVE-2018-18984 Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers Missing Encryption of Sensitive Data
Medtronic CareLink and Encore Programmers

 do not encrypt or do not sufficiently encrypt sensitive 
PII and PHI information while at rest .
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: Medtronic
product: CareLink 9790 Programmer
default_status: unaffected
vendor: Medtronic
product: CareLink 2090 Programmer
default_status: unaffected
vendor: Medtronic
product: 29901 Encore Programmer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Researchers Billy Rios and Jonathan Butts of Whitescope LLC reported this vulnerability
Published: 2018-12-14T15:00:00.000Z
CVE-2018-18985 
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: Tridium
product: Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4
Published: 2019-01-29T16:00:00.000Z
CVE-2018-18986 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows the opening of a specially crafted report format file that may cause an out of bounds read, which may cause a system crash, allow data exfiltration, or remote code execution.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: LCDS
product: LCDS Laquis SCADA
Published: 2019-02-05T18:00:00.000Z
CVE-2018-18987 
VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without first checking for validity, allowing attacker supplied input to be written to known memory locations. This may cause the program to crash or allow remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-30T18:00:00.000Z
CVE-2018-18988 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code execution, data exfiltration, or cause a system crash.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: ICS-CERT
product: LCDS Laquis SCADA
Published: 2019-02-01T17:00:00.000Z
CVE-2018-18989 
In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: n/a
product: CX-One (CX-Programmer and CX-Server)
Published: 2018-12-04T22:00:00.000Z
CVE-2018-18990 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerability to disclose sensitive information under the context of the web server process.
Problem types: cwe_id: CWE-23
description: RELATIVE PATH TRAVERSAL CWE-23
Affected products: vendor: ICS-CERT
product: LCDS Laquis SCADA
Published: 2019-02-05T18:00:00.000Z
CVE-2018-18991 
Reflected cross-site scripting (non-persistent) in SCADA WebServer (Versions prior to 2.03.0001) could allow an attacker to send a crafted URL that contains JavaScript, which can be reflected off the web application to the victim's browser.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: SCADA WebServer
Published: 2018-12-04T21:00:00.000Z
CVE-2018-18992 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server.
Problem types: cwe_id: CWE-74
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS IN OUTPUT USED BY A DOWNSTREAM COMPONENT ('INJECTION') CWE-74
Affected products: vendor: ICS-CERT
product: LCDS Laquis SCADA
Published: 2019-02-05T18:00:00.000Z
CVE-2018-18993 
Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior). When processing project files, the application allows input data to exceed the buffer. An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the application.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: CX-One (CX-Programmer and CX-Server)
Published: 2018-12-04T22:00:00.000Z
CVE-2018-18994 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause a system crash or allow data exfiltration.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: LCDS Laquis
product: LCDS Laquis SCADA
Published: 2019-03-27T17:38:14.000Z
CVE-2018-18995 
Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing configuration settings such as IP addresses.
Problem types: cwe_id: CWE-306
description: Missing Authentication for Critical Function CWE-306
Affected products: vendor: n/a
product: ABB GATE-E1 and GATE-E2
Published: 2019-01-03T22:00:00.000Z
CVE-2018-18996 
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the server.
Problem types: cwe_id: CWE-74
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS IN OUTPUT USED BY A DOWNSTREAM COMPONENT ('INJECTION') CWE-74
Affected products: vendor: ICS-CERT
product: LCDS Laquis SCADA
Published: 2019-02-05T18:00:00.000Z
CVE-2018-18997 
Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrative web interface to insert an HTML/Javascript payload into any of the device properties, which may allow an attacker to display/execute the payload in a visitor browser.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-Site Scripting') CWE-79
Affected products: vendor: n/a
product: ABB GATE-E1 and GATE-E2
Published: 2019-01-03T22:00:00.000Z
CVE-2018-18998 
LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: ICS-CERT
product: LCDS Laquis SCADA
Published: 2019-02-05T18:00:00.000Z
CVE-2018-18999 
WebAccess/SCADA, WebAccess/SCADA Version 8.3.2 installed on Windows 2008 R2 SP1. Lack of proper validation of user supplied input may allow an attacker to cause the overflow of a buffer on the stack.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: WebAccess/SCADA
Published: 2018-12-19T18:00:00.000Z