rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-9049 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002833.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2018-9050 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100202d.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2018-9051 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002021.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2018-9052 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100283c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2018-9053 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf10026cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2018-9054 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100284c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2018-9055 
JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T04:00:00.000Z
CVE-2018-9056 
Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on the directional branch predictor, as demonstrated by a pattern history table (PHT), aka BranchScope.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T17:00:00.000Z
CVE-2018-9057 
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T18:00:00.000Z
CVE-2018-9058 
In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T21:00:00.000Z
CVE-2018-9059 
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious login request to forum.ghp.  NOTE: this may overlap CVE-2014-3791.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-20T21:00:00.000Z
CVE-2018-9062 BIOS Modules Unprotected by Intel Boot Guard Vulnerable to Physical Attack
In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.
Problem types: description: Elevation of privilege
Affected products: vendor: Lenovo Group Ltd.
product: some Lenovo ThinkPads
Published: 2018-07-19T19:00:00.000Z
CVE-2018-9063 
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.
Problem types: description: Buffer overflow
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo System Update
Published: 2018-05-04T16:00:00.000Z
CVE-2018-9064 
In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo xClarity Administrator
Published: 2018-07-30T15:00:00.000Z
CVE-2018-9065 
In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo xClarity Administrator
Published: 2018-07-30T15:00:00.000Z
CVE-2018-9066 
In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA's underlying operating system.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo xClarity Administrator
Published: 2018-07-30T15:00:00.000Z
CVE-2018-9067 
The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could have led to exposure of approximately 400 email addresses and 8,500 IMEI.
Problem types: description: Exposure and modification of private app data
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Help Android application
Published: 2018-07-13T16:00:00.000Z
CVE-2018-9068 
The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI.
Problem types: description: Information disclosure
Affected products: vendor: Lenovo Group Ltd.
product: System x IMM2
vendor: IBM Corporation
product: System x IMM2
Published: 2018-07-26T19:00:00.000Z
CVE-2018-9069 BIOS Write Protection Race Condition
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group LTD
product: IdeaPad
Published: 2018-10-02T14:00:00.000Z
CVE-2018-9070 
For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo.
Problem types: description: Root access of the device
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Smart Assistant
Published: 2018-07-13T16:00:00.000Z
CVE-2018-9071 CMM Security Vulnerability
Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.
Problem types: description: Information Disclosure
Affected products: vendor: Lenovo
product: Chassis Management Module (CMM)
Published: 2018-11-16T14:00:00.000Z
CVE-2018-9072 LXCI for VMware
In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: LXCI for VMware
Published: 2018-11-30T14:00:00.000Z
CVE-2018-9073 CMM Security Vulnerability
Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.
Problem types: description: Hardcoded Encryption Key
Affected products: vendor: Lenovo
product: Chassis Management Module (CMM)
Published: 2018-11-16T14:00:00.000Z
CVE-2018-9074 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user.
Problem types: description: Path traversal
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9075 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "``" characters in the client:password parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.
Problem types: description: Arbitrary Command Execution
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9076 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.
Problem types: description: Arbitrary Command Execution
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9077 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the share : name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.
Problem types: description: Arbitrary Command Execution
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9078 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.
Problem types: description: SVG
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9079 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device.
Problem types: description: Arbitrary code execution
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9080 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.
Problem types: description: Session fixation
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9081 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9082 Iomega and LenovoEMC NAS Web UI Vulnerabilities
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account
Problem types: description: Password change does not require existing password
Affected products: vendor: Lenovo Group LTD
product: Iomega StorCenter
vendor: Lenovo Group LTD
product: LenovoEMC
vendor: Lenovo Group LTD
product: EZ Media and Backup Center
Published: 2018-09-28T20:00:00.000Z
CVE-2018-9083 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-9084 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: ThinkSystem SMM
Published: 2018-11-27T14:00:00.000Z
CVE-2018-9085 Missing System x Flash Memory Write Protection Lock Bit
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.
Problem types: description: Denial of service
Affected products: vendor: Lenovo
product: System x UEFI
vendor: IBM
product: System x UEFI
Published: 2018-11-16T14:00:00.000Z
CVE-2018-9086 Legacy Server BMC Remote Command Injection
In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Lenovo
product: ThinkServer BMC
Published: 2018-11-16T14:00:00.000Z
CVE-2018-9090 
CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured by Tectonic administrators. An attacker can insert an XSS payload into the dashboards.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-24T13:38:56.000Z
CVE-2018-9091 
A critical vulnerability in the KEMP LoadMaster Operating System (LMOS) 6.0.44 through 7.2.41.2 and Long Term Support (LTS) LMOS before 7.1.35.5 related to Session Management could allow an unauthenticated, remote attacker to bypass security protections, gain system privileges, and execute elevated commands such as ls, ps, cat, etc., thereby compromising the system. Through this remote execution, in certain cases, exposure of sensitive system data such as certificates, private keys, and other information may be possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-25T19:00:00.000Z
CVE-2018-9092 
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T22:00:00.000Z
CVE-2018-9101 
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the launch_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T20:00:00.000Z
CVE-2018-9102 
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the signin interface. A successful exploit could allow an attacker to extract sensitive information from the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T20:00:00.000Z
CVE-2018-9103 
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T20:00:00.000Z
CVE-2018-9104 
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the api.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T20:00:00.000Z
CVE-2018-9105 
NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately this XPC service is not protected, which allows arbitrary applications to connect and send it XPC messages. An attacker can send a crafted XPC message to the privileged helper tool requesting it make a new OpenVPN connection. Because he or she controls the contents of the XPC message, the attacker can specify the location of the openvpn executable, which could point to something malicious they control located on disk. Without validation of the openvpn executable, this will give the attacker code execution in the context of the privileged helper tool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T23:00:00.000Z
CVE-2018-9106 
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T04:00:00.000Z
CVE-2018-9107 
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T04:00:00.000Z
CVE-2018-9108 
CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T04:00:00.000Z
CVE-2018-9109 
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T06:00:00.000Z
CVE-2018-9110 
Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T14:00:00.000Z