rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-11560 
A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotely run arbitrary code by sending a special RTSP over HTTP packet. The vulnerability was found in many cameras using hisilicon's hardware and software, as demonstrated by TENVIS cameras 1.3.3.3, 1.2.7.2, 1.2.1.4, 7.1.20.1.2, and 13.1.1.1.7.2; FDT FD7902 11.3.14.1.3 and 10.3.14.1.3; FOSCAM cameras 3.2.1.1.1_0815 and 3.2.2.2.1_0815; and Dericam cameras V11.3.8.1.12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T15:08:35.000Z
CVE-2019-11561 
The Chuango 433 MHz burglar-alarm product line is vulnerable to a Denial of Service attack. When the condition is triggered, the OV2 base station is unable to process sensor states and effectively prevents the alarm from setting off, as demonstrated by Chuango branded products, and non-Chuango branded products such as the Eminent EM8617 OV2 Wifi Alarm System.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-08T15:57:10.000Z
CVE-2019-11564 
A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index.php POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-08T15:45:53.000Z
CVE-2019-11565 
Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-27T13:15:49.000Z
CVE-2019-11567 
An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $_GET['del'], as demonstrated by an admin/page/system/nav.php?del= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-27T13:57:51.000Z
CVE-2019-11568 
An issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by an admin/page/system/nav.php request with PHP code in a .php file with the application/octet-stream content type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-27T13:58:04.000Z
CVE-2019-11569 
Veeam ONE Reporter 9.5.0.3201 allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-06T19:47:22.000Z
CVE-2019-11574 
An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T22:08:06.000Z
CVE-2019-11576 
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-28T01:40:48.000Z
CVE-2019-11577 
dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-28T15:22:10.000Z
CVE-2019-11578 
auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-28T15:22:24.000Z
CVE-2019-11579 
dhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflow with DHO_OPTSOVERLOADED.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-28T15:22:37.000Z
CVE-2019-11580 
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
Problem types: description: Leftover Debug Code
Affected products: vendor: Atlassian
product: Crowd
Published: 2019-06-03T13:43:48.001Z
CVE-2019-11581 
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
Problem types: description: Template injection
Affected products: vendor: Atlassian
product: Jira Server and Data Center
Published: 2019-08-09T19:30:59.317Z
CVE-2019-11582 
An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a crafted URI.
Problem types: description: Argument Injection
Affected products: vendor: Atlassian
product: Sourcetree for Windows
Published: 2019-06-14T13:54:38.881Z
CVE-2019-11583 
The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by "Epic Name".
Problem types: description: Denial of Service
Affected products: vendor: Atlassian
product: Jira
Published: 2019-06-26T15:13:17.712Z
CVE-2019-11584 
The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.476Z
CVE-2019-11585 
The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.
Problem types: description: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.527Z
CVE-2019-11586 
The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability.
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.573Z
CVE-2019-11587 
Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.620Z
CVE-2019-11588 
The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability.
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.662Z
CVE-2019-11589 
The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability.
Problem types: description: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.709Z
CVE-2019-11590 
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T13:46:30.000Z
CVE-2019-11591 
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T13:46:46.000Z
CVE-2019-11592 
WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or the offset parameter to admin/edituser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T13:47:24.000Z
CVE-2019-11593 
In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T14:30:34.000Z
CVE-2019-11594 
In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T14:30:50.000Z
CVE-2019-11595 
In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T14:31:21.000Z
CVE-2019-11596 
In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T14:46:55.000Z
CVE-2019-11597 
In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T15:05:54.000Z
CVE-2019-11598 
In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T15:06:08.000Z
CVE-2019-11599 
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T17:07:18.000Z
CVE-2019-11600 
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T19:57:47.000Z
CVE-2019-11601 Path traversal in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software
A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: Philip Kazmeier
Published: 2019-08-21T19:09:01.029Z
CVE-2019-11602 Leakage of stack traces in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software
Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: Philip Kazmeier
Published: 2019-08-21T19:21:38.452Z
CVE-2019-11603 Path traversal in ProSyst mBS SDK and Bosch IoT Gateway Software
A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the http root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: Philip Kazmeier
Published: 2019-08-21T19:29:23.032Z
CVE-2019-11604 
An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code into the context of the same page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T16:04:52.000Z
CVE-2019-11605 
An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Information Disclosure. A small number of GitLab API endpoints would disclose project information when using a read_user scoped token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T18:22:03.000Z
CVE-2019-11606 
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copyfile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:38:13.000Z
CVE-2019-11607 
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copydir.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:38:25.000Z
CVE-2019-11608 
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/renamefile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information or make the server unserviceable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:38:46.000Z
CVE-2019-11609 
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/movefile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information or make the server unserviceable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:38:57.000Z
CVE-2019-11610 
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/downloaddir.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:39:17.000Z
CVE-2019-11611 
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:39:26.000Z
CVE-2019-11612 
doorGets 7.0 has an arbitrary file deletion vulnerability in /fileman/php/deletefile.php. A remote unauthenticated attacker can exploit this vulnerability to delete arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:39:39.000Z
CVE-2019-11613 
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/contactView.php. A remote normal registered user could exploit the vulnerability to obtain database sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:39:49.000Z
CVE-2019-11614 
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/commentView.php. A remote unauthorized attacker could exploit the vulnerability to obtain database sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:40:01.000Z
CVE-2019-11615 
/fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability. A remote normal registered user can use this vulnerability to upload backdoor files to control the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:40:14.000Z
CVE-2019-11616 
doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:40:23.000Z
CVE-2019-11617 
doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Analytics code" modification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:40:35.000Z
CVE-2019-11618 
doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creation and modification of articles via an H0XZlT44FcN1j9LTdFc5XRXhlF30UaGe1g3cZY6i1K9 access_token in a uri=blog&action=index&controller=blog action to /api/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:40:45.000Z
CVE-2019-11619 
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics. A remote background administrator privilege user (or a user with permission to manage configuration analytics) could exploit the vulnerability to obtain database sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:40:54.000Z
CVE-2019-11620 
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_add_titre.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:41:04.000Z
CVE-2019-11621 
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user (or a user with permission to manage network configuration) could exploit the vulnerability to obtain database sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:41:15.000Z
CVE-2019-11622 
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_edit_titre.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:41:23.000Z
CVE-2019-11623 
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user (or a user with permission to manage configuration siteweb) could exploit the vulnerability to obtain database sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:41:31.000Z
CVE-2019-11624 
doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote background administrator privilege user can exploit this vulnerability to delete arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:41:40.000Z
CVE-2019-11625 
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php. A remote background administrator privilege user (or a user with permission to manage emailing) could exploit the vulnerability to obtain database sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:41:49.000Z
CVE-2019-11626 
routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T19:42:20.000Z
CVE-2019-11627 
gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-30T22:49:10.000Z
CVE-2019-11628 
An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-01T02:07:47.000Z
CVE-2019-11629 
Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T17:23:56.000Z