rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-20326 
A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T21:33:36.000Z
CVE-2019-20327 
Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is a setuid executable allowing execution of Perl scripts with root privileges.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-16T14:27:55.000Z
CVE-2019-20329 
OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-02T23:51:00.000Z
CVE-2019-20330 
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-03T03:35:52.000Z
CVE-2019-20334 
In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-04T06:43:42.000Z
CVE-2019-20336 
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-05T21:06:57.000Z
CVE-2019-20337 
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-05T21:06:40.000Z
CVE-2019-20343 
The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can specify an arbitrary program in an executable element (and can also specify arbitrary command-line arguments in an arguments element).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T13:46:30.000Z
CVE-2019-20348 
OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to interrupt the boot sequence in order to execute arbitrary commands with root privileges and conduct further attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T20:31:13.000Z
CVE-2019-20352 
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T05:05:20.000Z
CVE-2019-20354 
The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T05:53:46.000Z
CVE-2019-20357 
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.
Problem types: description: Persistent Arbitrary Code Execution
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2020-01-17T23:45:25.000Z
CVE-2019-20358 
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed. Another attack vector similar to CVE-2019-9491 was idenitfied and resolved in version 1.62.0.1228 of the tool.
Problem types: description: Arbitrary RCE
Affected products: vendor: Trend Micro
product: Trend Micro Anti-Threat Toolkit (ATTK)
Published: 2020-01-30T21:10:14.000Z
CVE-2019-20360 
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T05:03:09.000Z
CVE-2019-20361 
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T05:03:21.000Z
CVE-2019-20362 
In Teradici PCoIP Agent before 19.08.1 and PCoIP Client before 19.08.3, an unquoted service path can cause execution of %PROGRAMFILES(X86)%\Teradici\PCoIP.exe instead of the intended pcoip_vchan_printing_svc.exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T14:05:15.000Z
CVE-2019-20363 
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T16:27:50.000Z
CVE-2019-20364 
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T16:27:41.000Z
CVE-2019-20365 
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T16:27:14.000Z
CVE-2019-20366 
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T16:26:28.000Z
CVE-2019-20367 
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T16:50:03.000Z
CVE-2019-20372 
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T20:05:38.000Z
CVE-2019-20373 
LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T22:27:55.000Z
CVE-2019-20374 
A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T22:40:29.000Z
CVE-2019-20375 
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T04:52:20.000Z
CVE-2019-20376 
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to elogd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T04:52:05.000Z
CVE-2019-20377 
TopList before 2019-09-03 allows XSS via a title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-11T03:01:10.000Z
CVE-2019-20378 
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-11T03:01:00.000Z
CVE-2019-20379 
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-11T03:00:51.000Z
CVE-2019-20381 
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-20T05:21:28.000Z
CVE-2019-20382 
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T18:27:21.000Z
CVE-2019-20383 
ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-13T22:51:07.000Z
CVE-2019-20384 
Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-20T23:52:47.000Z
CVE-2019-20385 
The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/* content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T00:37:02.000Z
CVE-2019-20386 
An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T05:12:30.000Z
CVE-2019-20387 
repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T22:54:05.000Z
CVE-2019-20388 
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T22:53:50.000Z
CVE-2019-20389 
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T17:02:59.000Z
CVE-2019-20390 
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T17:07:56.000Z
CVE-2019-20391 
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T00:00:00.000Z
CVE-2019-20392 
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T00:00:00.000Z
CVE-2019-20393 
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T00:00:00.000Z
CVE-2019-20394 
A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T00:00:00.000Z
CVE-2019-20395 
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T00:00:00.000Z
CVE-2019-20396 
A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T00:00:00.000Z
CVE-2019-20397 
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T00:00:00.000Z
CVE-2019-20398 
A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T00:00:00.000Z
CVE-2019-20399 
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-22T23:12:33.000Z
CVE-2019-20400 
The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability.
Problem types: description: DLL Hijacking
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-02-06T03:10:26.194Z
CVE-2019-20401 
Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities.
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-02-06T03:10:26.692Z
CVE-2019-20402 
Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-02-06T03:10:27.208Z
CVE-2019-20403 
The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-02-06T03:10:27.629Z
CVE-2019-20404 
The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-02-06T03:10:28.034Z
CVE-2019-20405 
The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability.
Problem types: description: Cross Site Scripting (CSRF)
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-02-06T03:10:28.440Z
CVE-2019-20406 
The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.
Problem types: description: DLL Hijacking
Affected products: vendor: Atlassian
product: Confluence Data Center
Published: 2020-02-06T03:10:28.891Z
CVE-2019-20407 
The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Software
Published: 2020-03-17T03:10:12.407Z
CVE-2019-20408 
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.
Problem types: description: Server Side Request Forgery (SSRF)
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-07-01T01:35:24.899Z
CVE-2019-20409 
The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.
Problem types: description: Remote Code Execution
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-06-23T05:55:10.632Z
CVE-2019-20410 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 before 8.4.2.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-06-29T05:20:11.941Z
CVE-2019-20411 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-06-29T05:30:13.060Z
CVE-2019-20412 
The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types; Status Types. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
Problem types: description: Information Disclosure
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-06-29T05:50:11.692Z
CVE-2019-20413 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the UserPickerBrowser.jspa page. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
Problem types: description: Denial of Service
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-06-29T06:05:15.549Z
CVE-2019-20414 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Navigator Basic Search. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-06-29T06:15:12.355Z
CVE-2019-20415 
Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.3, and from version 8.0.0 before 8.1.0.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-06-30T02:50:11.721Z
CVE-2019-20416 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-06-30T03:00:15.866Z
CVE-2019-20418 
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. The affected versions are before version 8.8.0.
Problem types: description: Application Denial of Service
Affected products: vendor: Atlassian
product: Jira Server
Published: 2020-07-03T01:05:13.223Z