rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1000415 
A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.jelly, RebuildAction/ListSubversionTagsParameterValue.jelly, RebuildAction/MavenMetadataParameterValue.jelly, RebuildAction/NodeParameterValue.jelly, RebuildAction/PasswordParameterValue.jelly, RebuildAction/RandomStringParameterValue.jelly, RebuildAction/RunParameterValue.jelly, RebuildAction/StringParameterValue.jelly, RebuildAction/TextParameterValue.jelly, RebuildAction/ValidatingStringParameterValue.jelly that allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000416 
A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000417 
A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000418 
An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000419 
An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000420 
An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000421 
An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000422 
An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and connection settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000423 
An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000424 
An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000425 
An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000426 
A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2018-1000500 
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000501 
Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000502 
MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. This attack appear to be exploitable via Must have access to admin panel. This vulnerability appears to have been fixed in 1.8.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000503 
MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000504 
Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerability appears to have been fixed in 2.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000505 
Tooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in could allow anybody to duplicate posts. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000506 
Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must follow a link. This vulnerability appears to have been fixed in 1.2.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000507 
WP User Groups version 2.0.0 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in allows anybody to modify user groups and types. This attack appear to be exploitable via Admin must click on link. This vulnerability appears to have been fixed in 2.1.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000508 
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000509 
Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin to execute arbitrary code in some circumstances. This attack appear to be exploitable via Attacker must have access to admin account. This vulnerability appears to have been fixed in 2.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000510 
WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause denial of service. This attack appear to be exploitable via Can be triggered intentionally (or unintentionally via CSRF) by any logged in user. This vulnerability appears to have been fixed in 1.24.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000511 
WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000512 
Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000513 
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000514 
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000515 
ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that can result in Attacker can read any file in the server or use smbrelay attack to access to server..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000516 
The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting (XSS) attacks. In this form of attack, a malicious person can create a URL which, when opened by a Galaxy user or administrator, would allow the malicious user to execute arbitrary Javascript. that can result in Arbitrary JavaScript code execution. This attack appear to be exploitable via The victim must interact with component on page witch contains injected JavaScript code.. This vulnerability appears to have been fixed in v14.10.1, v15.01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000517 
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000518 
aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000519 
aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000520 
ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate a TLS-ECDH-RSA-* ciphersuite. Any of the peers can then provide an ECDSA-signed certificate, when only an RSA-signed one should be accepted..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000521 
BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privileged(Developer) users.. This attack appear to be exploitable via no. This vulnerability appears to have been fixed in after commit b652cfdc14d0670c81ac4401ad5a04376745c279.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000523 
topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523 that can result in Injection of arbitrary bytes to the terminal, including terminal escape code sequences. This attack appear to be exploitable via The victim must open a todo.txt with at least one specially crafted line..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000524 
miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result in remote denial of service. This attack appear to be exploitable via the victim must load a specially-crafted map which calls SetLayerSize in its entry script. This vulnerability appears to have been fixed in 5.0.3, 5.1.5, 5.2.10 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000525 
openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Specially crafted GET request variable containing serialised PHP object. This vulnerability appears to have been fixed in after commit 097eae0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000526 
Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000527 
Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability appears to have been fixed in after commit c1e62e6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000528 
GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000529 
Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000531 
inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header using 'none' as algorithm and a body to requests it be validated. This vulnerability was fixed after commit abb0d479389a2509f939452a6767dc424bb5e6ba.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000532 
beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibit execution of arbitrary programs by other users, allowing DoS. This attack appear to be exploitable via The system must allow local users to run beep.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000533 
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000534 
Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here https://github.com/laurent22/joplin/commit/494e235e18659574f836f84fcf9f4d4fcdcfcf89 that can result in executing unauthorized code within the rights in which the application is running. This attack appear to be exploitable via Victim synchronizing notes from the cloud services or other note-keeping services which contain malicious code. This vulnerability appears to have been fixed in 1.0.90 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000535 
lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Possible to read files on the server. This attack appear to be exploitable via GET parameter. This vulnerability appears to have been fixed in after commit 254765e.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000536 
Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine, within the rights of the running application. This attack appear to be exploitable via Victim is synchronizing data from the redis server which contains malicious key value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000537 
Marlin Firmware Marlin version 1.1.x and earlier contains a Buffer Overflow vulnerability in cardreader.cpp (Depending on branch/version) that can result in Arbitrary code execution. This attack appear to be exploitable via Crafted G-Code instruction/file is sent to the printer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000538 
Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vulnerability in write-to-RAM that can result in Denial of Service. This attack appear to be exploitable via Sending V4-(pre)signed requests with large bodies . This vulnerability appears to have been fixed in after commit 9c8b7306f55f2c8c0a5c7cea9a8db9d34be8faa7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000539 
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z
CVE-2018-1000540 
LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when viewing the XML file in the browser that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T16:00:00.000Z