rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-14327 
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:24:22.000Z
CVE-2019-14328 
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T13:27:39.000Z
CVE-2019-14329 
An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can modify the parameter name to contain JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T13:46:07.000Z
CVE-2019-14330 
An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T13:46:15.000Z
CVE-2019-14331 
An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T13:46:22.000Z
CVE-2019-14332 
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is use of weak ciphers for SSH such as diffie-hellman-group1-sha1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T12:22:40.000Z
CVE-2019-14333 
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T12:26:27.000Z
CVE-2019-14334 
An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private Key extraction through an insecure sslcert-get.cgi HTTP command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T12:27:36.000Z
CVE-2019-14335 
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of the AP via the admin.cgi?action=%s URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T13:05:48.000Z
CVE-2019-14336 
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T12:30:38.000Z
CVE-2019-14337 
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command line interface, as demonstrated by the `/bin/sh -c wget` sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T12:31:42.000Z
CVE-2019-14338 
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T12:32:40.000Z
CVE-2019-14339 
The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data data access. This allows an attacker's malicious application to obtain sensitive information including factory passwords for the administrator web interface and WPA2-PSK key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-05T19:40:42.000Z
CVE-2019-14343 
TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-15T13:00:01.000Z
CVE-2019-14344 
TemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-13T15:59:46.000Z
CVE-2019-14345 
TemaTres 3.0 allows remote unprivileged users to create an administrator account
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-15T13:03:59.000Z
CVE-2019-14346 
Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T14:23:59.000Z
CVE-2019-14347 
Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add, as demonstrated by a Python PoC script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T16:34:23.000Z
CVE-2019-14348 
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T15:00:09.000Z
CVE-2019-14349 
EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user opens a page of any profile with this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T15:26:51.000Z
CVE-2019-14350 
EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T15:26:58.000Z
CVE-2019-14351 
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T15:27:05.000Z
CVE-2019-14352 
In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists, as demonstrated by jw/web/userview/crm_community/crm_userview_sales/_/account_new with the Account ID or Account Name field. NOTE: the vendor disputes the relevance of this finding because CSV is not the intended export format for spreadsheet applications
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T16:40:59.000Z
CVE-2019-14353 
On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: this CVE applies exclusively to the Trezor One, and does not refer to any issues with OLED displays on other devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-08T18:52:43.000Z
CVE-2019-14354 
On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-10T15:07:20.000Z
CVE-2019-14355 
On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover secret data shown on the display. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is "insignificant risk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-10T15:41:57.000Z
CVE-2019-14356 
On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: At Coinkite, we’ve already mitigated it, even though we feel strongly that it is not a legitimate issue. In our opinion, it is both unproven (might not even work) and also completely impractical—even if it could be made to work perfectly
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T17:59:42.000Z
CVE-2019-14357 
On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that an attack is not "realistically implementable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-10T15:54:57.000Z
CVE-2019-14358 
On Archos Safe-T devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-02T16:26:43.000Z
CVE-2019-14359 
On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover a data value. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is no security impact: the only potentially leaked information is the number of characters in the PIN
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T22:31:34.000Z
CVE-2019-14360 
On Hyundai Pay Kasse HK-1000 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-02T16:27:28.000Z
CVE-2019-14362 
Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T17:26:06.000Z
CVE-2019-14363 
A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.18_1.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T17:33:19.000Z
CVE-2019-14364 
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T17:43:35.000Z
CVE-2019-14365 
The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T20:47:16.000Z
CVE-2019-14366 
WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T20:47:12.000Z
CVE-2019-14367 
Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T20:47:07.000Z
CVE-2019-14368 
Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetadata() in rafimage.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T18:43:40.000Z
CVE-2019-14369 
Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T00:00:00.000Z
CVE-2019-14370 
In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T00:00:00.000Z
CVE-2019-14371 
An issue was discovered in Libav 12.3. There is an infinite loop in the function mov_probe in the file libavformat/mov.c, related to offset and tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T18:44:03.000Z
CVE-2019-14372 
In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T18:44:12.000Z
CVE-2019-14373 
An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a heap-based buffer over-read in libpng via a crafted flif file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-28T18:44:19.000Z
CVE-2019-14378 
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T10:05:22.000Z
CVE-2019-14379 
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T11:42:42.000Z
CVE-2019-14380 
libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T18:35:28.000Z
CVE-2019-14381 
libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:41:13.000Z
CVE-2019-14382 
DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T18:34:51.000Z
CVE-2019-14383 
J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T18:33:58.000Z
CVE-2019-14386 
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:38:21.000Z
CVE-2019-14387 
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:43:16.000Z
CVE-2019-14388 
cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:45:33.000Z
CVE-2019-14389 
cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:46:37.000Z
CVE-2019-14390 
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:47:44.000Z
CVE-2019-14391 
cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T12:48:47.000Z
CVE-2019-14392 
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:00:46.000Z
CVE-2019-14393 
cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:02:23.000Z
CVE-2019-14394 
cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:03:11.000Z
CVE-2019-14395 
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:03:56.000Z
CVE-2019-14396 
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:04:49.000Z
CVE-2019-14397 
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:05:33.000Z
CVE-2019-14398 
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:06:14.000Z
CVE-2019-14399 
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:07:06.000Z
CVE-2019-14400 
cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-30T14:08:06.000Z