rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-5632 Hickory Smart Lock Insecure Storage on Android
An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.
Problem types: cwe_id: CWE-922
description: CWE-922: Insecure Storage of Sensitive Information
Affected products: vendor: Belwith Products, LLC
product: Hickory Smart
Credits: lang: en
value: This issue was discovered and reported by Deral Heiland of Rapid7. It has been disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2019-08-22T13:51:36.900Z
CVE-2019-5633 Hickory Smart Lock Insecure Storage on iOS
An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for iOS, version 01.01.07 and prior versions.
Problem types: cwe_id: CWE-922
description: CWE-922: Insecure Storage of Sensitive Information
Affected products: vendor: Belwith Products, LLC
product: Hickory Smart
Credits: lang: en
value: This issue was discovered and reported by Deral Heiland of Rapid7. It has been disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2019-08-22T13:51:36.974Z
CVE-2019-5634 Hickory Smart Lock Insecure Logging on Android
An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) from the mobile application are logged in a debug log on the Android device at HickorySmartLog/Logs/SRDeviceLog.txt. This information was found stored in the Android device's default USB or SDcard storage paths and is accessible without rooting the device. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.
Problem types: cwe_id: CWE-532
description: CWE-532: Inclusion of Sensitive Information in Log Files
Affected products: vendor: Belwith Products, LLC
product: Hickory Smart
Credits: lang: en
value: This issue was discovered and reported by Deral Heiland of Rapid7. It has been disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2019-08-22T13:51:37.034Z
CVE-2019-5635 Hickory Smart Lock Cleartext Password
A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals that the Hickory Smart Ethernet Bridge device communicates over the network to an MQTT broker without using encryption. This exposed the default username and password used to authenticate to the MQTT broker. This issue affects Hickory Smart Ethernet Bridge, model number H077646. The firmware does not appear to contain versioning information.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Belwith Products, LLC
product: Hickory Smart Ethernet Bridge
Credits: lang: en
value: This issue was discovered and reported by Deral Heiland of Rapid7. It has been disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2019-08-22T13:51:37.081Z
CVE-2019-5636 Beckhoff TwinCAT Discovery Service Denial of Service
When a Beckhoff TwinCAT Runtime receives a malformed UDP packet, the ADS Discovery Service shuts down. Note that the TwinCAT devices are still performing as normal. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior).
Problem types: cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
Affected products: vendor: Beckhoff
product: TwinCAT 2
vendor: Beckhoff
product: TwinCAT 3.1
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: This issue was discovered, and reported to Rapid7, by Andreas Galauner at Rapid7. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2019-11-21T19:16:12.913Z
CVE-2019-5637 Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service
When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior).
Problem types: cwe_id: CWE-369
description: CWE-369 Divide By Zero
Affected products: vendor: Beckhoff
product: TwinCAT 2
vendor: Beckhoff
product: TwinCAT 3.1
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered, and reported to Rapid7, by Andreas Galauner at Rapid7. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2019-11-21T19:16:13.344Z
CVE-2019-5638 Rapid7 Nexpose Insufficient Session Management
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Rapid7
product: Nexpose
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: This issue was discovered, and reported to Rapid7, by independent researcher Ashutosh Barot. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2019-08-21T19:36:25.675Z
CVE-2019-5640 Rapid7 Nexpose Information Disclosure after logout
Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous user
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Rapid7
product: Nexpose
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Ashutosh Barot
Published: 2021-11-22T16:35:10.539Z
CVE-2019-5641 Rapid7 InsightVM Information Disclosure after Logout
Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in the last webpage visited by previous user
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Rapid7
product: InsightVM
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Ashutosh Barot reported this vulnerability to Rapid7
Published: 2022-09-21T14:45:14.786Z
CVE-2019-5642 MAGICK
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Rapid7
product: Metasploit Pro
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This issue was discovered and reported to Rapid7 by Rodney Beele. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2019-11-06T18:30:42.787Z
CVE-2019-5643 C4G BLIS Improper Access Control
Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may enumerate the user names and facility names in use on a particular installation.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Computing For Good
product: Basic Laboratory Information System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability was first discovered privately and reported internally by C4G BLIS team member Aditi Shah in December 2018. Jacob Robles of Rapid7 rediscovered and reported these issues in March of 2019 per Rapid7's vulnerability disclosure policy (https://www.rapid7.com/security/disclosure/).
Published: 2019-11-06T18:30:43.187Z
CVE-2019-5644 C4G BLIS Improper Access Control
Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Computing For Good
product: Basic Laboratory Information System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was first discovered privately and reported internally by C4G BLIS team member Aditi Shah in December 2018. Jacob Robles of Rapid7 rediscovered and reported these issues in March of 2019 per Rapid7's vulnerability disclosure policy (https://www.rapid7.com/security/disclosure/).
Published: 2019-11-06T18:30:43.639Z
CVE-2019-5645 Rapid7 Metasploit HTTP Handler Denial of Service
By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Rapid7
product: Metasploit Framework
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This issue was reported by Jose Garduno of Dreamlab Technologies, AG
Published: 2020-09-01T14:35:12.880Z
CVE-2019-5647 Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration
The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Rapid7
product: AppSpider
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2020-01-22T18:00:22.724Z
CVE-2019-5648 LDAP Credential Exposure in Barracuda Load Balancer ADC
Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. These steps can be used by any authenticated administrative user to expose the LDAP credentials configured in the LDAP connector over the network.
Problem types: cwe_id: CWE-522
description: Insufficiently Protected Credentials (CWE-522)
Affected products: vendor: Barracuda
product: Load Balancer ADC
Credits: lang: en
value: This issue was discovered by Steve Campbell (@lpha3ch0). It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/).
Published: 2020-03-12T13:00:16.318Z
CVE-2019-5665 
NVIDIA Windows GPU Display driver contains a vulnerability in the 3D vision component in which the stereo service software, when opening a file, does not check for hard links. This behavior may lead to code execution, denial of service or escalation of privileges.
Problem types: description: code execution, denial of service, escalation of privileges
Affected products: vendor: Nvidia Corporation
product: NVIDIA GPU Graphics Driver
Published: 2019-02-27T23:00:00.000Z
CVE-2019-5666 
NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) create context command DDI DxgkDdiCreateContext in which the product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array, which may lead to denial of service or escalation of privileges.
Problem types: description: denial of service or escalation of privileges
Affected products: vendor: Nvidia Corporation
product: NVIDIA GPU Graphics Driver
Published: 2019-02-27T23:00:00.000Z
CVE-2019-5667 
NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSetRootPageTable in which the application dereferences a pointer that it expects to be valid, but is NULL, which may lead to code execution, denial of service or escalation of privileges.
Problem types: description: code execution, denial of service or escalation of privileges
Affected products: vendor: Nvidia Corporation
product: NVIDIA GPU Graphics Driver
Published: 2019-02-27T23:00:00.000Z
CVE-2019-5668 
NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSubmitCommandVirtual in which the application dereferences a pointer that it expects to be valid, but is NULL, which may lead to denial of service or escalation of privileges.
Problem types: description: denial of service or escalation of privileges
Affected products: vendor: Nvidia Corporation
product: NVIDIA GPU Graphics Driver
Published: 2019-02-27T23:00:00.000Z
CVE-2019-5669 
NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape in which the software uses a sequential operation to read from or write to a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer, which may lead to denial of service or escalation of privileges.
Problem types: description: denial of service or escalation of privileges
Affected products: vendor: Nvidia Corporation
product: NVIDIA GPU Graphics Driver
Published: 2019-02-27T23:00:00.000Z
CVE-2019-5670 
NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape in which the software uses a sequential operation to read from or write to a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer which may lead to denial of service, escalation of privileges, code execution or information disclosure.
Problem types: description: denial of service, escalation of privileges, code execution or information disclosure
Affected products: vendor: Nvidia Corporation
product: NVIDIA GPU Graphics Driver
Published: 2019-02-27T23:00:00.000Z
CVE-2019-5671 
NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the software does not release a resource after its effective lifetime has ended, which may lead to denial of service.
Problem types: description: denial of service
Affected products: vendor: Nvidia Corporation
product: NVIDIA GPU Graphics Driver
Published: 2019-02-27T23:00:00.000Z
CVE-2019-5672 
NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the sample rootfs are not replaced by unique host keys after sample rootsfs generation and flashing, which may lead to information disclosure.
Problem types: description: Information disclosure
Affected products: vendor: NVIDIA
product: Jetson TX1 and TX2
Published: 2019-04-11T16:37:26.000Z
CVE-2019-5673 
NVIDIA Jetson TX2 contains a vulnerability in the kernel driver (on all versions prior to R28.3) where the ARM System Memory Management Unit (SMMU) improperly checks for a fault condition, causing transactions to be discarded, which may lead to denial of service.
Problem types: description: Denial of service
Affected products: vendor: NVIDIA
product: Jetson TX2
Published: 2019-04-11T16:38:55.000Z
CVE-2019-5674 
NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled. When an attacker has access to the system and creates a hard link, the software does not check for hard link attacks. This behavior may lead to code execution, denial of service, or escalation of privileges.
Problem types: description: code execution, denial of service, or escalation of privileges
Affected products: vendor: NVIDIA Corporation
product: GeForce Experience
Published: 2019-03-28T14:09:11.000Z
CVE-2019-5675 
NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes, which may lead to denial of service, escalation of privileges, or information disclosure.
Problem types: description: denial of service, escalation of privileges, or information disclosure
Affected products: vendor: NVIDIA
product: NVIDIA GPU Display Driver
Published: 2019-05-10T20:18:16.000Z
CVE-2019-5676 
NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly loads Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), leading to escalation of privileges through code execution.
Problem types: description: escalation of privileges, code execution
Affected products: vendor: NVIDIA
product: NVIDIA GPU Display Driver
Published: 2019-05-10T20:21:18.000Z
CVE-2019-5677 
NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DeviceIoControl where the software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer, which may lead to denial of service.
Problem types: description: denial of service
Affected products: vendor: NVIDIA
product: NVIDIA GPU Display Driver
Published: 2019-05-10T20:22:11.000Z
CVE-2019-5678 
NVIDIA GeForce Experience versions prior to 3.19 contains a vulnerability in the Web Helper component, in which an attacker with local system access can craft input that may not be properly validated. Such an attack may lead to code execution, denial of service or information disclosure.
Problem types: description: code execution, denial of service, information disclosure
Affected products: vendor: NVIDIA
product: NVIDIA GeForce Experience
Published: 2019-05-31T21:12:01.000Z
CVE-2019-5679 
NVIDIA Shield TV Experience prior to v8.0, NVIDIA Tegra bootloader contains a vulnerability in nvtboot where the Trusted OS image is improperly authenticated, which may lead to code execution, denial of service, escalation of privileges, and information disclosure, code execution, denial of service, or escalation of privileges
Problem types: description: code execution, denial of service, information disclosure
Affected products: vendor: NVIDIA
product: SHIELD TV
Published: 2019-08-06T20:00:40.000Z
CVE-2019-5680 
In NVIDIA Jetson TX1 L4T R32 version branch prior to R32.2, Tegra bootloader contains a vulnerability in nvtboot in which the nvtboot-cpu image is loaded without the load address first being validated, which may lead to code execution, denial of service, or escalation of privileges.
Problem types: description: code execution/denial of service/escalation of privileges
Affected products: vendor: NVIDIA
product: NVIDIA Jetson TX1
Published: 2019-07-19T19:57:04.000Z
CVE-2019-5681 
NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the custom NVIDIA API used in the mount system service where user data could be overridden, which may lead to code execution, denial of service, or information disclosure.
Problem types: description: code execution, denial of service, information disclosure, escalation of privileges
Affected products: vendor: NVIDIA
product: SHIELD TV
Published: 2019-08-06T20:00:43.000Z
CVE-2019-5682 
NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the NVIDIA Games App where it improperly exports an Activity but does not properly restrict which applications can launch the Activity, which may lead to code execution or denial of service.
Problem types: description: code execution, denial of service
Affected products: vendor: NVIDIA
product: SHIELD TV
Published: 2019-08-06T20:00:46.000Z