rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-15836 
In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T21:00:00.000Z
CVE-2018-15839 
D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T17:00:00.000Z
CVE-2018-15840 
TP-Link TL-WR840N devices allow remote attackers to cause a denial of service (networking outage) via fragmented packets, as demonstrated by an "nmap -f" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T17:09:43.000Z
CVE-2018-15842 
WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15843 
GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15844 
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15845 
There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15846 
An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15847 
An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15848 
An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15849 
An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15850 
An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15851 
An issue was discovered in Flexo CMS v0.1.6. There is a CSRF vulnerability that can add an administrator via /admin/user/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15852 
Technicolor TC7200.20 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by macof. NOTE: Technicolor denies that the described behavior is a vulnerability and states that Wi-Fi traffic is slowed or stopped only while the devices are exposed to a MAC flooding attack. This has been confirmed through testing against official up-to-date versions
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15853 
Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15854 
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15855 
Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15856 
An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15857 
An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15858 
Unchecked NULL pointer usage when handling invalid aliases in CopyKeyAliasesToKeymap in xkbcomp/keycodes.c in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15859 
Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15861 
Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15862 
Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15863 
Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15864 
Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T21:00:00.000Z
CVE-2018-15865 
The Pulse Secure Desktop (macOS) has a Privilege Escalation Vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T23:00:00.000Z
CVE-2018-15868 
SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arbitrary SQL commands via the wcr_machineid cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-21T13:01:13.000Z
CVE-2018-15869 
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T00:00:00.000Z
CVE-2018-15870 
An invalid memory address dereference was discovered in decompileGETVARIABLE in libming 0.4.8 before 2018-03-12. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T19:00:00.000Z
CVE-2018-15871 
An invalid memory address dereference was discovered in decompileSingleArgBuiltInFunctionCall in libming 0.4.8 before 2018-03-12. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T19:00:00.000Z
CVE-2018-15873 
A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T19:00:00.000Z
CVE-2018-15874 
Cross-site scripting (XSS) vulnerability on D-Link DIR-615 routers 20.07 allows an attacker to inject JavaScript into the "Status -> Active Client Table" page via the hostname field in a DHCP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T19:00:00.000Z
CVE-2018-15875 
Cross-site scripting (XSS) vulnerability on D-Link DIR-615 routers 20.07 allows attackers to inject JavaScript into the router's admin UPnP page via the description field in an AddPortMapping UPnP SOAP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-25T19:00:00.000Z
CVE-2018-15876 
An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished by automation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-26T07:00:00.000Z
CVE-2018-15877 
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-26T07:00:00.000Z
CVE-2018-15880 
An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T03:00:00.000Z
CVE-2018-15881 
An issue was discovered in Joomla! before 3.8.12. Inadequate checks regarding disabled fields can lead to an ACL violation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T03:00:00.000Z
CVE-2018-15882 
An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T03:00:00.000Z
CVE-2018-15884 
RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T19:00:00.000Z
CVE-2018-15885 
Ovation FindMe 1.4-1083-1 is intended to support transmission of network traffic from covert video recorders but does not properly disrupt binary analysis for discovering the product's capabilities or purpose. This makes it easier for adversaries to detect the covert operation. Specifically, the product uses a compression technique to prevent the identification of certain libraries in the software by obfuscation. The software relies on a TLS callback and an additional executable file to enable these libraries and their access to certain websites. The unpacked software can be exploited by several different types of documented techniques.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-26T21:00:00.000Z
CVE-2018-15886 
Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=edit_snippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a <?php substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-10T13:00:00.000Z
CVE-2018-15887 
Main_Analysis_Content.asp in ASUS DSL-N12E_C1 1.1.2.3_345 is prone to Authenticated Remote Command Execution, which allows a remote attacker to execute arbitrary OS commands via service parameters, such as shell metacharacters in the destIP parameter of a cmdMethod=ping request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T15:00:00.000Z
CVE-2018-15888 
An issue was discovered in ASPCMS 2.5.6. When registering ordinary users in the addUser function of the /member/reg.asp page, they can be registered with the super administrators GroupID directly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-26T21:00:00.000Z
CVE-2018-15890 
An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T17:00:53.000Z
CVE-2018-15891 
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T16:35:57.000Z
CVE-2018-15892 
FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T16:29:38.000Z
CVE-2018-15893 
A SQL injection was discovered in /coreframe/app/admin/copyfrom.php in WUZHI CMS 4.1.0 via the index.php?m=core&f=copyfrom&v=listing keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T04:00:00.000Z
CVE-2018-15894 
A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyValue parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T04:00:00.000Z
CVE-2018-15895 
An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14858.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T04:00:00.000Z
CVE-2018-15896 
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T21:00:00.000Z
CVE-2018-15897 
PHP Scripts Mall Website Seller Script 2.0.5 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, Company Name, or Fax field, as demonstrated by crossPwn.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T21:00:00.000Z
CVE-2018-15898 
The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate, which might allow man-in-the-middle attackers to obtain interaction data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-11T21:00:00.000Z
CVE-2018-15899 
An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T04:00:00.000Z
CVE-2018-15901 
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T19:00:00.000Z
CVE-2018-15903 
The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies from high privilege accounts and hijack these, enabling them to hijack the elevated session and perform actions in their security context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-08T17:00:00.000Z
CVE-2018-15904 
A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.1.2-P4 mishandles the configured rules for blocking SQL injection attacks, aka A10-2017-0008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T14:00:00.000Z
CVE-2018-15906 
SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T21:34:13.000Z
CVE-2018-15907 
Technicolor (formerly RCA) TC8305C devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by macof. NOTE: this might overlap CVE-2018-15852 and CVE-2018-16310. NOTE: Technicolor denies that the described behavior is a vulnerability and states that Wi-Fi traffic is slowed or stopped only while the devices are exposed to a MAC flooding attack. This has been confirmed through testing against official up-to-date versions
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T19:00:00.000Z
CVE-2018-15908 
In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T17:00:00.000Z
CVE-2018-15909 
In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T17:00:00.000Z
CVE-2018-15910 
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-27T17:00:00.000Z
CVE-2018-15911 
In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T04:00:00.000Z
CVE-2018-15912 
An issue was discovered in manjaro-update-system.sh in manjaro-system 20180716-1 on Manjaro Linux. A local attacker can install or remove arbitrary packages and package repositories potentially containing hooks with arbitrary code, which will automatically be run as root, or remove packages vital to the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T19:00:00.000Z
CVE-2018-15913 
An issue was discovered in Cloudera Manager 5.x through 5.15.0. One type of page in Cloudera Manager uses a 'returnUrl' parameter to redirect the user to another page in Cloudera Manager once a wizard is completed. The validity of this parameter was not checked. As a result, the user could be automatically redirected to an attacker's external site or perform a malicious JavaScript function that results in cross-site scripting (XSS). This was fixed by not allowing any value in the returnUrl parameter with patterns such as http://, https://, //, or javascript. The only exceptions to this rule are the SAML Login/Logout URLs, which remain supported since they are explicitly configured and they are not passed via the returnUrl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T18:04:56.000Z
CVE-2018-15917 
Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-15918 
An issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the application without permissions to read and modify sensitive information from the database used by the application via the startdate or enddate parameter to leaves/validate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-15919 
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-28T08:00:00.000Z
CVE-2018-15920 
Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2018-10-12T18:00:00.000Z
CVE-2018-15922 
Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Problem types: description: Out-of-bounds read
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2018-10-12T18:00:00.000Z