rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-5503 
OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
Problem types: description: Information Disclosure
Affected products: vendor: NetApp
product: OnCommand Workflow Automation
Published: 2019-09-10T15:50:41.000Z
CVE-2019-5504 
ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions.
Problem types: description: Remote Command Execution
Affected products: vendor: n/a
product: ONTAP Select Deploy administration utility
Published: 2019-09-24T19:53:30.000Z
CVE-2019-5505 
ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: ONTAP Select Deploy administration utility
Published: 2019-09-24T19:56:11.000Z
CVE-2019-5506 
Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to impersonation via man-in-the-middle attacks.
Problem types: description: Sensitive Information Disclosure
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2019-10-09T18:20:00.000Z
CVE-2019-5507 
SnapManager for Oracle prior to version 3.4.2P1 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information.
Problem types: description: Sensitive Information Disclosure
Affected products: vendor: n/a
product: SnapManager for Oracle
Published: 2019-10-09T18:26:25.000Z
CVE-2019-5508 
Clustered Data ONTAP versions 9.2 through 9.4 are susceptible to a vulnerability which allows an attacker to use l2ping to cause a Denial of Service (DoS).
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2019-10-25T18:02:25.000Z
CVE-2019-5509 
ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when successfully exploited could allow an unauthenticated remote attacker to enable and use a privileged user account.
Problem types: description: Remote Code Injection
Affected products: vendor: NetApp
product: ONTAP Select Deploy administration utility
Published: 2019-11-21T15:33:19.000Z
CVE-2019-5511 
VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle paths appropriately. Successful exploitation of this issue may allow the path to the VMX executable, on a Windows host, to be hijacked by a non-administrator leading to elevation of privilege.
Problem types: description: Elevation of privilege vulnerability
Affected products: vendor: n/a
product: VMware Workstation
Published: 2019-04-09T19:29:46.000Z
CVE-2019-5512 
VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle COM classes appropriately. Successful exploitation of this issue may allow hijacking of COM classes used by the VMX process, on a Windows host, leading to elevation of privilege.
Problem types: description: Elevation of privilege vulnerability
Affected products: vendor: n/a
product: VMware Workstation
Published: 2019-04-09T19:29:56.000Z
CVE-2019-5513 
VMware Horizon Connection Server (7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8) contains an information disclosure vulnerability. Successful exploitation of this issue may allow disclosure of internal domain names, the Connection Server’s internal name, or the gateway’s internal IP address.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: n/a
product: VMware Horizon Connection Server
Published: 2019-04-09T19:30:44.000Z
CVE-2019-5514 
VMware VMware Fusion (11.x before 11.0.3) contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines.
Problem types: description: Unauthenticated APIs Security vulnerability
Affected products: vendor: VMware
product: VMware Fusion
Published: 2019-04-01T20:21:11.000Z
CVE-2019-5515 
VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) and Fusion (11.x before 11.0.3, 10.x before 10.1.6) updates address an out-of-bounds write vulnerability in the e1000 and e1000e virtual network adapters. Exploitation of this issue may lead to code execution on the host from the guest but it is more likely to result in a denial of service of the guest.
Problem types: description: Out-of-bounds write vulnerability
Affected products: vendor: VMware
product: VMware Workstation and Fusion
Published: 2019-04-02T14:19:30.000Z
CVE-2019-5516 
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds vulnerability with the vertex shader functionality. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. The workaround for this issue involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.
Problem types: description: Vertex shader out-of-bounds read vulnerability
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2019-04-15T16:57:27.000Z
CVE-2019-5517 
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain multiple out-of-bounds read vulnerabilities in the shader translator. Exploitation of these issues requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of these issues may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. The workaround for these issues involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.
Problem types: description: Multiple Out-of-bounds read vulnerabilities
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2019-04-15T17:20:08.000Z
CVE-2019-5518 
VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain an out-of-bounds read/write vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to a virtual machine with a virtual USB controller present. This issue may allow a guest to execute code on the host.
Problem types: description: Out-of-bounds read/write vulnerability
Affected products: vendor: VMware
product: VMware ESXi, Workstation, Fusion
Published: 2019-04-01T20:39:57.000Z
CVE-2019-5519 
VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain a Time-of-check Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to a virtual machine with a virtual USB controller present. This issue may allow a guest to execute code on the host.
Problem types: description: Time-of-check Time-of-use (TOCTOU) vulnerability
Affected products: vendor: VMware
product: VMware ESXi, Workstation, Fusion
Published: 2019-04-01T20:39:47.000Z
CVE-2019-5520 
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds read vulnerability. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead to information disclosure.The workaround for this issue involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2019-04-15T17:12:06.000Z
CVE-2019-5521 
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6) and Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain an out-of-bounds read vulnerability in the pixel shader functionality. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on the host. Exploitation of this issue require an attacker to have access to a virtual machine with 3D graphics enabled. It is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.
Problem types: description: Out of bounds read vulnerability
Affected products: vendor: VMware
product: VMware ESXi
vendor: VMware
product: VMware Workstation
vendor: VMware
product: VMware Fusion
Published: 2019-09-20T18:00:52.000Z
CVE-2019-5522 
VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guest machines. This issue is present in versions 10.2.x and 10.3.x prior to 10.3.10. A local attacker with non-administrative access to a Windows guest with VMware Tools installed may be able to leak kernel information or create a denial of service attack on the same Windows guest machine.
Problem types: description: Out of bounds read vulnerability
Affected products: vendor: VMware
product: VMware Tools for Windows
Published: 2019-06-06T19:00:03.000Z
CVE-2019-5523 
VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session.
Problem types: description: Remote Session Hijack vulnerability
Affected products: vendor: VMware
product: VMware vCloud Director for Service Providers (vCD)
Published: 2019-04-01T17:11:35.000Z
CVE-2019-5524 
VMware Workstation (14.x before 14.1.6) and Fusion (10.x before 10.1.6) contain an out-of-bounds write vulnerability in the e1000 virtual network adapter. This issue may allow a guest to execute code on the host.
Problem types: description: Out-of-bounds write vulnerability
Affected products: vendor: VMware
product: VMware Workstation, VMware Fusion
Published: 2019-04-02T14:08:48.000Z
CVE-2019-5525 
VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) backend. A malicious user with normal user privileges on the guest machine may exploit this issue in conjunction with other issues to execute code on the Linux host where Workstation is installed.
Problem types: description: Use-after-free vulnerability
Affected products: vendor: VMware
product: VMware Workstation
Published: 2019-06-06T19:00:44.000Z
CVE-2019-5526 
VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a windows host where Workstation is installed.
Problem types: description: DLL hijacking vulnerability
Affected products: vendor: n/a
product: VMware Workstation
Published: 2019-05-15T15:18:12.000Z
CVE-2019-5527 
ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.5.
Problem types: description: Use-after-free vulnerability
Affected products: vendor: n/a
product: ESXi, Workstation, Fusion, VMRC and Horizon Client
Published: 2019-10-10T16:28:46.000Z
CVE-2019-5528 
VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process. Patch ESXi650-201907201-UG for this issue is available.
Problem types: description: Partial DoS
Affected products: vendor: VMware
product: ESXi
Published: 2019-07-11T20:15:02.000Z
CVE-2019-5530 
Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authenticode signature.
Problem types: description: Authenticode signature bypass
Affected products: vendor: n/a
product: InstallBuilder
Published: 2019-08-29T00:53:03.000Z
CVE-2019-5531 
VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: VMware
product: VMware vSphere ESXi
vendor: VMware
product: VMware vCenter Server
Published: 2019-09-18T21:42:17.000Z
CVE-2019-5532 
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging of credentials in plain-text for virtual machines deployed through OVF. A malicious user with access to the log files containing vCenter OVF-properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine).
Problem types: description: Information disclosure vulnerability
Affected products: vendor: VMware
product: vCenter Server
Published: 2019-09-18T20:32:36.000Z
CVE-2019-5533 
In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail address if present but no other personal data. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 4.3.
Problem types: description: Information disclosure  vulnerability
Affected products: vendor: VMware
product: SD-WAN by VeloCloud
Published: 2019-10-28T22:14:46.000Z
CVE-2019-5534 
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to query the vAppConfig properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine).
Problem types: description: Information disclosure vulnerability
Affected products: vendor: VMware
product: vCenter Server
Published: 2019-09-18T20:32:33.000Z
CVE-2019-5535 
VMware Workstation and Fusion contain a network denial-of-service vulnerability due to improper handling of certain IPv6 packets. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.7.
Problem types: description: Network denial-of-service vulnerability
Affected products: vendor: n/a
product: VMware Workstation and Fusion
Published: 2019-10-10T16:29:16.000Z
CVE-2019-5536 
VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before 11.5.0) contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. Exploitation of this issue require an attacker to have access to a virtual machine with 3D graphics enabled. It is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.
Problem types: description: Denial-of-service vulnerability
Affected products: vendor: n/a
product: VMware ESXi, Workstation and Fusion
Published: 2019-10-28T15:56:36.000Z
CVE-2019-5537 
Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over FTPS and HTTPS. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a backup target may be able to intercept sensitive data in transit during File-Based Backup and Restore operations.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server Appliance
Published: 2019-10-28T15:04:08.000Z
CVE-2019-5538 
Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over SCP. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a backup target may be able to intercept sensitive data in transit during File-Based Backup and Restore operations.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server Appliance
Published: 2019-10-28T15:52:37.000Z
CVE-2019-5539 
VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking vulnerability due to insecure loading of a DLL by Cortado Thinprint. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a Windows machine where Workstation or View Agent is installed.
Problem types: description: DLL hijacking vulnerability via Cortado Thinprint
Affected products: vendor: VMware
product: VMware Workstation
vendor: VMware
product: Horizon View Agent
Published: 2019-12-23T19:20:50.000Z
CVE-2019-5540 
VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an information disclosure vulnerability in vmnetdhcp. Successful exploitation of this issue may allow an attacker on a guest VM to disclose sensitive information by leaking memory from the host process.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: VMware
product: Workstation and Fusion
Published: 2019-11-20T15:10:59.000Z
CVE-2019-5541 
VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds write vulnerability in the e1000e virtual network adapter. Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition on their own VM.
Problem types: description: Out-of-bounds write vulnerability
Affected products: vendor: VMware
product: Workstation and Fusion
Published: 2019-11-20T15:11:28.000Z
CVE-2019-5542 
VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain a denial-of-service vulnerability in the RPC handler. Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on their own VM.
Problem types: description: Denial-of-service vulnerability
Affected products: vendor: VMware
product: Workstation and Fusion
Published: 2019-11-20T15:11:57.000Z
CVE-2019-5543 
For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15.x before 15.5.2) the folder containing configuration files for the VMware USB arbitration service was found to be writable by all users. A local user on the system where the software is installed may exploit this issue to run commands as any user.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: VMware
product: VMware Horizon Client for Windows
vendor: VMware
product: VMware Remote Console for Windows
vendor: VMware
product: VMware Workstation for Windows
Published: 2020-03-16T17:24:55.000Z
CVE-2019-5544 
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
Problem types: description: Heap Overwrite
Affected products: vendor: n/a
product: ESXi and Horizon DaaS
Published: 2019-12-06T15:54:18.000Z
CVE-2019-5585 
An improper access control vulnerability in FortiClientMac before 6.0.5 may allow an attacker to affect the application's performance via modifying the contents of a file used by several FortiClientMac processes.
Problem types: description: Denial of service
Affected products: vendor: Fortinet
product: FortiClientMac
Published: 2019-04-09T20:57:14.000Z
CVE-2019-5586 
A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiOS
Published: 2019-06-04T21:39:52.000Z
CVE-2019-5587 
Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious programs into the installing image by reassembling the image through specific methods.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiOS
Published: 2019-06-04T21:35:03.000Z
CVE-2019-5588 
A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiOS
Published: 2019-06-04T21:43:15.000Z
CVE-2019-5589 
An Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6) may allow an unauthenticated, remote attacker with control over the directory in which FortiClientOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious .dll files in that directory.
Problem types: description: Unauthorized code execution
Affected products: vendor: Fortinet
product: Fortinet FortiClient for Windows
Published: 2019-05-28T21:42:19.000Z