rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-5850 
Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:55.000Z
CVE-2019-5851 
Use after free in WebAudio in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5852 
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5853 
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5854 
Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5855 
Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5856 
Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5857 
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5858 
Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbitrary code via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5859 
Insufficient filtering in URI schemes in Google Chrome on Windows prior to 76.0.3809.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5860 
Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5861 
Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5862 
Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5864 
Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5865 
Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5866 
Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds memory access
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5867 
Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5868 
Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5869 
Use after free in Blink in Google Chrome prior to 76.0.3809.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5870 
Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5871 
Heap buffer overflow in Skia in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:56.000Z
CVE-2019-5872 
Use after free in Mojo in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:57.000Z
CVE-2019-5873 
Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:57.000Z
CVE-2019-5874 
Insufficient filtering in URI schemes in Google Chrome on Windows prior to 77.0.3865.75 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:57.000Z
CVE-2019-5875 
Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:57.000Z
CVE-2019-5876 
Use after free in media in Google Chrome on Android prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:57.000Z
CVE-2019-5877 
Out of bounds memory access in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds memory access
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:57.000Z
CVE-2019-5878 
Use after free in V8 in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:58.000Z
CVE-2019-5879 
Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:58.000Z
CVE-2019-5880 
Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:58.000Z
CVE-2019-5881 
Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2019-11-25T14:22:58.000Z
CVE-2019-5882 
Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T22:00:00.000Z
CVE-2019-5883 
An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T15:30:47.000Z
CVE-2019-5884 
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-10T06:00:00.000Z
CVE-2019-5885 
Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-19T17:59:29.000Z
CVE-2019-5886 
An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-10T14:00:00.000Z
CVE-2019-5887 
An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling by the rmdir method. Attackers can delete arbitrary files by using "../" directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-10T14:00:00.000Z
CVE-2019-5888 
Multiple XSS vulnerabilities were discovered in OverIT Geocall 6.3 before build 2:346977.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-01T15:13:51.000Z
CVE-2019-5889 
An log-management directory traversal issue was discovered in OverIT Geocall 6.3 before build 2:346977.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-01T15:16:27.000Z
CVE-2019-5890 
An issue was discovered in OverIT Geocall 6.3 before build 2:346977. Weak authentication and session management allows an authenticated user to obtain access to the Administrative control panel and execute administrative functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-01T15:19:15.000Z
CVE-2019-5891 
An issue was discovered in OverIT Geocall 6.3 before build 2:346977. An unauthenticated servlet allows an attacker to obtain a cookie of an authenticated user, and login to the web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-01T15:23:39.000Z
CVE-2019-5892 
bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABLE_BGP_VNC is used for Virtual Network Control, allows remote attackers to cause a denial of service (peering session flap) via attribute 255 in a BGP UPDATE packet. This occurred during Disco in January 2019 because FRR does not implement RFC 7606, and therefore the packets with 255 were considered invalid VNC data and the BGP session was closed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-10T17:00:00.000Z
CVE-2019-5893 
Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-10T17:00:00.000Z
CVE-2019-5909 
License Manager Service of YOKOGAWA products (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.00), ProSafe-RS (R3.01.00 - R4.04.00), PRM (R4.01.00 - R4.02.00), B/M9000 VP(R7.01.01 - R8.02.03)) allows remote attackers to bypass access restriction to send malicious files to the PC where License Manager Service runs via unspecified vectors.
Problem types: description: Authentication Bypass by Assumed-Immutable Data
Affected products: vendor: Yokogawa Electric Corporation
product: License Manager Service of YOKOGAWA products
Published: 2019-02-13T18:00:00.000Z
CVE-2019-5910 
Directory traversal vulnerability in HOUSE GATE App for iOS 1.7.8 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: HOUSE GATE inc.
product: HOUSE GATE App for iOS
Published: 2019-02-13T18:00:00.000Z
CVE-2019-5911 
Untrusted search path vulnerability in the installer of UNLHA32.DLL (UNLHA32.DLL for Win32 Ver 2.67.1.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Micco
product: The installer of UNLHA32.DLL
Published: 2019-02-13T18:00:00.000Z
CVE-2019-5912 
Untrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Micco
product: The installer of UNARJ32.DLL
Published: 2019-02-13T18:00:00.000Z
CVE-2019-5913 
Untrusted search path vulnerability in the installer of LHMelting (LHMelting for Win32 Ver 1.65.3.6 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Micco
product: The installer of LHMelting
Published: 2019-02-13T18:00:00.000Z
CVE-2019-5914 
V20 PRO L-01J software version L01J20c and L01J20d has a NULL pointer exception flaw that can be used by an attacker to cause the device to crash on the same network range via a specially crafted access point.
Problem types: description: Null Pointer Exception
Affected products: vendor: NTT DOCOMO, INC.
product: V20 PRO L-01J
Published: 2019-02-13T18:00:00.000Z
CVE-2019-5915 
Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
Problem types: description: Open Redirect
Affected products: vendor: OpenAM Consortium
product: OpenAM (Open Source Edition)
Published: 2019-02-13T18:00:00.000Z
CVE-2019-5916 
Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Government Edition Patch 7 and earlier, Ver 2.8 Patch 6 and earlier, Ver 2.8c Patch 5 and earlier, Ver 2.9 Patch 4 and earlier) allows remote attackers to execute EL expression on the server via unspecified vectors.
Problem types: description: Improper Input Validation
Affected products: vendor: D-CIRCLE inc.
product: POWER EGG
Published: 2019-02-13T18:00:00.000Z
CVE-2019-5917 
azure-umqtt-c (available through GitHub prior to 2017 October 6) allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: Denial-of-service (DoS)
Affected products: vendor: Microsoft
product: azure-umqtt-c
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5918 
Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
Problem types: description: XML external entities (XXE)
Affected products: vendor: TIS Inc.
product: Nablarch 5
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5919 
An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.
Problem types: description: An incomplete cryptography
Affected products: vendor: TIS Inc.
product: Nablarch 5
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5920 
Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.
Problem types: description: Cross-site request forgery
Affected products: vendor: nCrafts
product: FormCraft
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5921 
Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Microsoft
product: Windows 7
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5922 
Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Microsoft
product: The installer of Microsoft Teams
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5923 
Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: iChain, Inc.
product: iChain Insurance Wallet App for iOS
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5924 
Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.
Problem types: description: Cross-site request forgery
Affected products: vendor: RedNao
product: Smart Forms
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5925 
Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3.1.1 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Security Roots Ltd
product: Dradis Community Edition and Dradis Professional Edition
Published: 2019-03-12T21:00:00.000Z
CVE-2019-5926 
Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Project Kinaga
product: KinagaCMS
Published: 2019-03-27T13:17:58.000Z
CVE-2019-5927 
Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: PERSOL CAREER CO., LTD.
product: 'an' App for iOS
Published: 2019-03-27T13:17:58.000Z
CVE-2019-5928 
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Customize Item function.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2019-05-17T15:25:54.000Z
CVE-2019-5929 
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application 'Memo'.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2019-05-17T15:25:54.000Z
CVE-2019-5930 
Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2019-05-17T15:25:54.000Z
CVE-2019-5931 
Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors.
Problem types: description: Improper Input Validation
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2019-05-17T15:25:54.000Z
CVE-2019-5932 
Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2019-05-17T15:25:54.000Z
CVE-2019-5933 
Cybozu Garoon 4.0.0 to 4.10.0 allows remote authenticated attackers to bypass access restriction to view the Bulletin Board without view privileges via the application 'Bulletin'.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2019-05-17T15:25:55.000Z
CVE-2019-5934 
SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search function of application 'logging'.
Problem types: description: SQL Injection
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2019-05-17T15:25:55.000Z
CVE-2019-5935 
Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access privileges via the Item function of User Information.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2019-05-17T15:25:55.000Z