rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1000077 
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000078 
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000079 
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000080 
Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins as being a normal user. This attack appear to be exploitable via By knowing how the requisition is made, and sending it as a normal user, the server, in response, downloads the plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000081 
Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter ..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000082 
Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server. that can result in Code execution on the server . This attack appear to be exploitable via Being a CSRF, victim interaction is needed, when the victim access the infected trigger of the CSRF any code that match the victim privledges on the server can be executed..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000083 
Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server. This attack appear to be exploitable via By sending a malformed JSON, the tool responds with a traceback error that leaks a path of the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000084 
WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layout tab) that can result in low privilege user can steal the cookie of admin user and compromise the admin account. This attack appear to be exploitable via Need to enter the Javascript code into Layout Name .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000085 
ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000086 
NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript code execution. This attack appear to be exploitable via Attacker gains full javascript access to pages with Pym.js embeds when user visits an attacker crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000087 
WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files' Tab that can result in Session Hijacking, Spread Worms,Control the browser remotely. . This attack appear to be exploitable via Attacker can execute the JavaScript into the "Create New File" and "Create New Directory" input box from 'files'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000088 
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000089 
Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000090 
textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000091 
KadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that can result in Control of program execution flow, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000092 
CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000093 
CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewallet RPC daemons will process any commands sent to them, resulting in remote command execution and a takeover of the cryptocurrency wallet if an attacker can trick an application such as a web browser into connecting and sending a command for example. This attack appears to be exploitable via a victim visiting a webpage hosting malicious content that trigger such behavior.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T15:00:00.000Z
CVE-2018-1000094 
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T01:00:00.000Z
CVE-2018-1000095 
oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the name/description of VMs portion of the web admin application. This vulnerability appears to have been fixed in version 4.2.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T01:00:00.000Z
CVE-2018-1000096 
brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the user to man-in-the-middle attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T01:00:00.000Z
CVE-2018-1000097 
Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T01:00:00.000Z
CVE-2018-1000098 
Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T01:00:00.000Z
CVE-2018-1000099 
Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T01:00:00.000Z
CVE-2018-1000100 
GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks being modified, this could lead to RCE. This attack appear to be exploitable via an attacker supplied MP4 file that when run by the victim may result in RCE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T17:00:00.000Z
CVE-2018-1000101 
Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination (CWE-170) vulnerability in mingw-w64-crt (libc)->(v)snprintf that can result in The bug may be used to corrupt subsequent string functions. This attack appear to be exploitable via Depending on the usage, worst case: network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-06T17:00:00.000Z
CVE-2018-1000104 
A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured keystore and private key passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000105 
An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000106 
An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000107 
An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, JobOwnerJobProperty.java, and OwnerNodeProperty.java that allow an attacker with Job/Configure or Computer/Configure permission and without Ownership related permissions to override ownership metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000108 
A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attacker to craft links to Jenkins URLs that run arbitrary JavaScript in the user's browser when accessed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000109 
An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java that allow an attacker to obtain credential IDs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000110 
An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000111 
An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network access to obtain a list of nodes and users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000112 
An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000113 
A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000114 
An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T13:00:00.000Z
CVE-2018-1000115 
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-05T14:00:00.000Z
CVE-2018-1000116 
NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-07T14:00:00.000Z
CVE-2018-1000117 
Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-07T14:00:00.000Z
CVE-2018-1000118 
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-07T14:00:00.000Z
CVE-2018-1000119 
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-07T14:00:00.000Z
CVE-2018-1000120 
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T18:00:00.000Z
CVE-2018-1000121 
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T18:00:00.000Z
CVE-2018-1000122 
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T18:00:00.000Z
CVE-2018-1000123 
Ionic Team Cordova plugin iOS Keychain version before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf contains an Information Exposure Through Log Files (CWE-532) vulnerability in CDVKeychain.m that can result in login, password and other sensitive data leakage. This attack appear to be exploitable via Attacker must have access to victim's iOS logs. This vulnerability appears to have been fixed in after commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T21:00:00.000Z
CVE-2018-1000124 
I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter form_import_textarea.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T21:00:00.000Z
CVE-2018-1000125 
inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack appear to be exploitable via an attacker crafting a token with a valid header and body and then requests it to be validated. This vulnerability appears to have been fixed in 1.3.0 and later or after commit 0d94dcef0133d699f21d217e922564adbb83a227.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T21:00:00.000Z
CVE-2018-1000126 
Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T21:00:00.000Z
CVE-2018-1000127 
memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-13T21:00:00.000Z
CVE-2018-1000129 
An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T13:00:00.000Z
CVE-2018-1000130 
A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T13:00:00.000Z
CVE-2018-1000131 
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T13:00:00.000Z
CVE-2018-1000132 
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T13:00:00.000Z