rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-9859 
The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7. This vulnerability can be used for persistent privilege escalation if it's available to create an executable file with System privilege by other vulnerable applications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-15T21:00:00.000Z
CVE-2018-9860 
An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will subsequently fail and the connection will be closed. This could be used for denial of service. No information leak occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-12T05:00:00.000Z
CVE-2018-9861 
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-19T17:00:00.000Z
CVE-2018-9862 
util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd line, and then issuing a "docker exec" command with that value in the -u argument, a similar issue to CVE-2016-3697.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-09T16:00:00.000Z
CVE-2018-9864 
The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-09T17:00:00.000Z
CVE-2018-9866 
A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow remote user to execute arbitrary code. This vulnerability affected GMS version 8.1 and earlier.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: SonicWall
product: Global Management System (GMS)
Published: 2018-08-03T20:00:00.000Z
CVE-2018-9867 
In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: SonicWall
product: SonicOS
vendor: SonicWall
product: SonicOSv
Published: 2019-02-19T21:00:00.000Z
CVE-2018-9918 
libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service (stack exhaustion), related to the QPDFObjectHandle and QPDF_Dictionary classes, because nesting in direct objects is not restricted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T18:00:00.000Z
CVE-2018-9919 
A web-accessible backdoor, with resultant SSRF, exists in Tp-shop 2.0.5 through 2.0.8, which allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution, because /vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php writes data from the "down_url" URL into the "bddlj" local file if the attacker knows the backdoor "jmmy" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T21:00:00.000Z
CVE-2018-9920 
Server side request forgery exists in the runtime application in K2 smartforms 4.6.11 via a modified hostname in an https://*/Identity/STS/Forms/Scripts URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T13:00:00.000Z
CVE-2018-9921 
In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-23T18:00:00.000Z
CVE-2018-9922 
An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.php pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T06:00:00.000Z
CVE-2018-9923 
An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPHP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T06:00:00.000Z
CVE-2018-9924 
An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T06:00:00.000Z
CVE-2018-9925 
An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T06:00:00.000Z
CVE-2018-9926 
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T06:00:00.000Z
CVE-2018-9927 
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T06:00:00.000Z
CVE-2018-9928 
Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T06:00:00.000Z
CVE-2018-9934 
The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T07:00:00.000Z
CVE-2018-9935 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5312.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9936 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of field elements. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5370.
Problem types: cwe_id: CWE-704
description: CWE-704-Incorrect Type Conversion or Cast
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9937 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of subform elements. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5371.
Problem types: cwe_id: CWE-704
description: CWE-704-Incorrect Type Conversion or Cast
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9938 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the absPageSpan method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5372.
Problem types: cwe_id: CWE-704
description: CWE-704-Incorrect Type Conversion or Cast
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9939 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of layout elements. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5373.
Problem types: cwe_id: CWE-704
description: CWE-704-Incorrect Type Conversion or Cast
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9940 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the layout sheet attribute. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5374.
Problem types: cwe_id: CWE-704
description: CWE-704-Incorrect Type Conversion or Cast
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9941 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the record append method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5375.
Problem types: cwe_id: CWE-704
description: CWE-704-Incorrect Type Conversion or Cast
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9942 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the record remove method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5376.
Problem types: cwe_id: CWE-704
description: CWE-704-Incorrect Type Conversion or Cast
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9943 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the openList method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5377.
Problem types: cwe_id: CWE-704
description: CWE-704-Incorrect Type Conversion or Cast
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9944 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addLink method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5379.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9945 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5382.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9946 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the setTimeOut method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5471.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9947 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5472.
Problem types: cwe_id: CWE-122
description: CWE-122-Heap-based Buffer Overflow
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9948 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of typed arrays. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5380.
Problem types: cwe_id: CWE-824
description: CWE-824-Access of Uninitialized Pointer
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9949 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIFF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5473.
Problem types: cwe_id: CWE-122
description: CWE-122-Heap-based Buffer Overflow
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9950 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF documents. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5413.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9951 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CPDF_Object objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5414.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9952 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA Button elements. When setting the formattedValue attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5527.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9953 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA resolveNodes method of Button elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5528.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9954 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA Button elements. When setting the y attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5529.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9955 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA resolveNode method of Button elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5531.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z
CVE-2018-9956 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA Button elements. When setting the title attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5617.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2018-05-17T15:00:00.000Z