rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-9189 
Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T17:20:09.000Z
CVE-2019-9191 
The ETSI Enterprise Transport Security (ETS, formerly known as eTLS) protocol does not provide per-session forward secrecy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T18:00:00.000Z
CVE-2019-9192 
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T18:00:00.000Z
CVE-2019-9193 
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-01T00:00:00.000Z
CVE-2019-9194 
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T19:00:00.000Z
CVE-2019-9195 
util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T19:00:00.000Z
CVE-2019-9196 
The Face authentication component in Aware mobile liveness 2.2.1 sdk 2.2.0 for Knomi allows a Biometrical Liveness authentication bypass via parameter tampering of the /knomi/analyze security_level field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-15T19:52:22.000Z
CVE-2019-9197 
The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T16:30:02.000Z
CVE-2019-9199 
PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T00:00:00.000Z
CVE-2019-9200 
A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T23:00:00.000Z
CVE-2019-9201 
Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2019-02-26T23:00:00.000Z
CVE-2019-9202 
Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-28T18:48:12.000Z
CVE-2019-9203 
Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-28T18:41:04.000Z
CVE-2019-9204 
SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-28T18:33:34.000Z
CVE-2019-9206 
PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This product is discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T16:23:23.000Z
CVE-2019-9207 
PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter. NOTE: This product is discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T16:23:27.000Z
CVE-2019-9208 
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-28T04:00:00.000Z
CVE-2019-9209 
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-28T04:00:00.000Z
CVE-2019-9210 
In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-27T14:00:00.000Z
CVE-2019-9211 
There is a reachable assertion abort in the function write_long_string_missing_values() in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0 that will lead to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-27T17:00:00.000Z
CVE-2019-9212 
SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. NOTE: The vendor doesn’t consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-27T17:00:00.000Z
CVE-2019-9213 
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T22:00:00.000Z
CVE-2019-9214 
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-28T04:00:00.000Z
CVE-2019-9215 
In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-28T04:00:00.000Z
CVE-2019-9217 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. Its User Interface has a Misrepresentation of Critical Information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T16:46:24.000Z
CVE-2019-9218 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 1 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T15:59:30.000Z
CVE-2019-9219 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 2 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T16:43:48.000Z
CVE-2019-9220 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T16:52:23.000Z
CVE-2019-9221 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 3 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T16:06:53.000Z
CVE-2019-9222 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T16:48:38.000Z
CVE-2019-9223 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T16:50:14.000Z
CVE-2019-9224 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 4 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T16:39:21.000Z
CVE-2019-9225 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 5 of 5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T16:41:57.000Z
CVE-2019-9226 
An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the opt[base][BG_SITE_NAME] parameter to the bg_console/index.php?m=opt&c=request URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-28T14:00:00.000Z
CVE-2019-9227 
An issue was discovered in baigo CMS 2.1.1. There is a vulnerability that allows remote attackers to execute arbitrary code. A BG_SITE_NAME parameter with malicious code can be written into the opt_base.inc.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-28T14:00:00.000Z
CVE-2019-9228 
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062. The (1) management SSH and (2) management TELNET features allow remote attackers to cause a denial of service (connection slot exhaustion) via 5 unauthenticated connection attempts, because the maximum number of unauthenticated clients that can be configured is 5. NOTE: the vendor's position is that this is a "design choice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T22:45:35.000Z
CVE-2019-9229 
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can authenticate with the default 1234 password that cannot be changed, and can execute malicious and unauthorized actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T23:05:22.000Z
CVE-2019-9230 
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting (XSS) vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T14:44:41.000Z
CVE-2019-9231 
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site Request Forgery (CSRF) vulnerability in the management web interface allows remote attackers to execute malicious and unauthorized actions, because CSRFProtection=1 is not a default and is not documented.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T15:22:11.000Z
CVE-2019-9232 
In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:12.000Z
CVE-2019-9233 
In wpa_supplicant_8, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122529021
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:12.000Z
CVE-2019-9234 
In wpa_supplicant_8, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122465453
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:12.000Z
CVE-2019-9235 
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122323053
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:12.000Z
CVE-2019-9236 
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122322613
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:12.000Z
CVE-2019-9237 
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-121325979
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9238 
In the NFC stack, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-121267042
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9239 
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-121263487
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9240 
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-121150966
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9241 
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-121036603
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9242 
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-121035878
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9243 
In wpa_supplicant_8, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120905706
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9244 
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120865977
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9245 
In the Android kernel in the f2fs driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-06T21:49:54.000Z
CVE-2019-9246 
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120428637
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9247 
In AAC Codec, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120426166
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9248 
In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2019-09-06T21:43:22.000Z
CVE-2019-9249 
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120255805
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9250 
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120276962
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9251 
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120274615
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9252 
In libavc there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-73339042
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9253 
In KeyStore, there is a possible storage of symmetric keys in the TEE instead of the strongbox due to a missing strongbox flag. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109769728
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2019-09-27T18:05:13.000Z
CVE-2019-9254 
In readArgumentList of zygote.java in Android 10, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2019-09-05T21:42:03.000Z