rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-18344 
Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension.
Problem types: description: Inappropriate implementation
Affected products: vendor: n/a
product: n/a
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18345 
Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18346 
Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18347 
Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18348 
Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18349 
Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18350 
Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18351 
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18352 
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18353 
Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18354 
Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external programs via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18355 
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18356 
An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18357 
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18358 
Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18359 
Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2018-12-11T15:00:00.000Z
CVE-2018-18361 
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html allows XSS via the name parameter, as demonstrated by a value beginning with home_content and containing a crafted SRC attribute of an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-15T15:00:00.000Z
CVE-2018-18362 
Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
Problem types: description: Cross Site Scripting
Affected products: vendor: Symantec Corporation
product: Norton Password Manager
Published: 2018-12-06T19:00:00.000Z
CVE-2018-18363 
Norton App Lock prior to 1.4.0.445 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access.
Problem types: description: App lock bypass
Affected products: vendor: Symantec Corporation
product: Norton App Lock
Published: 2019-01-24T20:00:00.000Z
CVE-2018-18364 
Symantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL hijacking vulnerability, which is a type of issue whereby a potential attacker attempts to execute unexpected code on your machine. This occurs via placement of a potentially foreign file (DLL) that the attacker then attempts to run via a linked application.
Problem types: description: DLL Hijack
Affected products: vendor: Symantec Corporation
product: Ghost Solution Suite (GSS)
Published: 2019-02-08T17:00:00.000Z
CVE-2018-18365 
Norton Password Manager may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic.
Problem types: description: Address Spoof
Affected products: vendor: n/a
product: Norton Password Manager
Published: 2019-04-09T19:04:35.000Z
CVE-2018-18366 
Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be susceptible to a kernel memory disclosure, which is a type of issue where a specially crafted IRP request can cause the driver to return uninitialized memory.
Problem types: description: Kernel memory disclosure
Affected products: vendor: Symantec Corporation
product: Norton Security
vendor: Symantec Corporation
product: SEP (Windows client)
vendor: Symantec Corporation
product: SEP SBE
vendor: Symantec Corporation
product: SEP Cloud
Published: 2019-04-25T19:13:05.000Z
CVE-2018-18367 
Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead.
Problem types: description: DLL Preloading
Affected products: vendor: Symantec Corporation
product: Symantec Endpoint Protection Manager
Published: 2019-04-25T19:22:17.000Z
CVE-2018-18368 
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection Manager (SEPM)
Published: 2019-11-15T16:58:10.000Z
CVE-2018-18369 
Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead.
Problem types: description: DLL Preloading
Affected products: vendor: Symantec Corporation
product: Norton Security
vendor: Symantec Corporation
product: Symantec Endpoint Protection Small Business Edition
Published: 2019-04-25T16:55:04.000Z
CVE-2018-18370 
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
Problem types: description: Cross-site-scripting (XSS)
Affected products: vendor: Symantec Corporation
product: Symantec Advanced Secure Gateway (ASG)
vendor: Symantec Corporation
product: Symantec ProxySG
Published: 2019-08-29T22:13:35.000Z
CVE-2018-18371 
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
Problem types: description: Information disclosure
Affected products: vendor: Symantec Corporation
product: Symantec Advanced Secure Gateway (ASG)
vendor: Symantec Corporation
product: Symantec ProxySG
Published: 2019-08-29T22:14:58.000Z
CVE-2018-18372 
A Stored XSS vulnerability has been discovered in KAASoft Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T14:00:00.000Z
CVE-2018-18373 
In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T14:00:00.000Z
CVE-2018-18374 
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T01:00:00.000Z
CVE-2018-18375 
goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T01:00:00.000Z
CVE-2018-18376 
goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T01:00:00.000Z
CVE-2018-18377 
goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T01:00:00.000Z
CVE-2018-18379 
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T11:28:17.000Z
CVE-2018-18380 
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T20:00:00.000Z
CVE-2018-18381 
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T07:00:00.000Z
CVE-2018-18382 
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T07:00:00.000Z
CVE-2018-18384 
Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T15:00:00.000Z
CVE-2018-18385 
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T15:00:00.000Z
CVE-2018-18386 
drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T20:00:00.000Z
CVE-2018-18387 
playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-29T18:00:00.000Z
CVE-2018-18388 
eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary commands by sending a carefully crafted payload to TCP port 2222.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-18389 
Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T18:00:00.000Z
CVE-2018-18390 
User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
Problem types: description: User Enumeration
Affected products: vendor: Moxa
product: ThingsPro IIoT Gateway and Device Management Software Solutions
Published: 2018-10-19T14:00:00.000Z
CVE-2018-18391 
User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
Problem types: description: User Privilege Escalation
Affected products: vendor: Moxa
product: ThingsPro IIoT Gateway and Device Management Software Solutions
Published: 2018-10-19T14:00:00.000Z
CVE-2018-18392 
Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
Problem types: description: Privilege Escalation via Broken Access Control
Affected products: vendor: Moxa
product: ThingsPro IIoT Gateway and Device Management Software Solutions
Published: 2018-10-19T14:00:00.000Z
CVE-2018-18393 
Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
Problem types: description: Password Management Issue
Affected products: vendor: Moxa
product: ThingsPro IIoT Gateway and Device Management Software Solutions
Published: 2018-10-19T14:00:00.000Z
CVE-2018-18394 
Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
Problem types: description: Sensitive Information Stored in Clear Text
Affected products: vendor: Moxa
product: ThingsPro IIoT Gateway and Device Management Software Solutions
Published: 2018-10-19T14:00:00.000Z
CVE-2018-18395 
Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
Problem types: description: Hidden Token Access
Affected products: vendor: Moxa
product: ThingsPro IIoT Gateway and Device Management Software Solutions
Published: 2018-10-19T14:00:00.000Z
CVE-2018-18396 
Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
Problem types: description: Remote Code Execution
Affected products: vendor: Moxa
product: ThingsPro IIoT Gateway and Device Management Software Solutions
Published: 2018-10-19T14:00:00.000Z
CVE-2018-18397 
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-12T07:00:00.000Z
CVE-2018-18398 
Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T22:00:00.000Z
CVE-2018-18399 
SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-18405 
jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-22T17:56:57.000Z
CVE-2018-18406 
An issue was discovered in Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final). The Audit Report module is affected by a blind XXE vulnerability when a new Best Practices Report is saved using a special payload inside the xml input field. The XXE vulnerability is blind since the response doesn't directly display a requested file, but rather returns it inside the name data field when the report is saved. An attacker is able to view restricted operating system files. This issue affects all types of users: administrators or normal users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T16:00:37.000Z
CVE-2018-18407 
A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T04:00:00.000Z
CVE-2018-18408 
A use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function post_args() at tcpbridge.c, causing a denial of service or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T04:00:00.000Z
CVE-2018-18409 
A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an address_histogram call or a get_histogram call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T04:00:00.000Z
CVE-2018-18416 
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/settings/update URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T22:00:00.000Z
CVE-2018-18417 
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T22:00:00.000Z
CVE-2018-18419 
Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filename to the /account URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T22:00:00.000Z
CVE-2018-18420 
Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-19T22:00:00.000Z
CVE-2018-18422 
UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/a_adminx.php?x=a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-17T04:00:00.000Z