rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-3414 
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front end does not process the returned result from the interface properly, the malicious script may be executed and the user cookie or other important information may be stolen.
Problem types: description: Cross-Site Scripting
Affected products: vendor: ZTE
product: OTCP
Published: 2019-07-22T18:27:21.000Z
CVE-2019-3415 
ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. Due to path traversal,users can download any files.
Problem types: description: Other
Affected products: vendor: ZTE
product: MW
Published: 2019-07-11T20:50:03.000Z
CVE-2019-3416 
All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability. Due to input validation, unauthorized users can take advantage of this vulnerability to control the user terminal system.
Problem types: description: input validation
Affected products: vendor: ZTE
product: ZXV10 B860A
Published: 2019-09-23T13:55:01.000Z
CVE-2019-3417 
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by command injection vulnerability. Due to insufficient parameter validation check, an authorized user can exploit this vulnerability to take control of user router system.
Problem types: description: Command Injection
Affected products: vendor: ZTE
product: ZXHN F670
Published: 2019-08-15T14:43:40.000Z
CVE-2019-3418 
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). Due to incomplete input validation, an authorized user can exploit this vulnerability to execute malicious scripts.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: ZTE
product: ZXHN F670
Published: 2019-08-15T14:44:35.000Z
CVE-2019-3419 
A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP. An attacker could exploit this vulnerability to build a link to the device and send specific packets to cause a denial of service.
Problem types: description: Resource Management Error
Affected products: vendor: ZTE Corporation
product: ZXMP M721 DX
Published: 2019-10-31T15:22:19.000Z
CVE-2019-3420 
All versions up to V2.5.0_EG1T5_TED of ZTE ZXHN H108N product are impacted by an information leak vulnerability. An attacker could exploit the vulnerability to obtain sensitive information and perform unauthorized operations.
Problem types: description: information leak
Affected products: vendor: n/a
product: ZXHN H108N
Published: 2019-11-13T22:29:36.000Z
CVE-2019-3421 
The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system.
Problem types: description: Command Injection
Affected products: vendor: ZTE Corporation
product: ZX297520V3
Published: 2019-10-31T15:27:46.000Z
CVE-2019-3422 
The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security.
Problem types: description: information disclosure
Affected products: vendor: ZTE
product: MF910S
Published: 2019-11-07T19:18:52.000Z
CVE-2019-3423 
permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can construct a URL for directory traversal and access to other unauthorized files or resources.
Problem types: description: Permission and Access Control
Affected products: vendor: ZTE Corporation
product: C520V21
Published: 2019-11-18T18:19:44.000Z
CVE-2019-3424 
authentication issues vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can automatically obtain access to web services from the authorized browser of the same computer and perform operations.
Problem types: description: Authentication Issues
Affected products: vendor: ZTE Corporation
product: C520V21
Published: 2019-11-18T18:20:23.000Z
CVE-2019-3425 
The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker could exploit this vulnerability to directly reset or change passwords of other accounts.
Problem types: description: permission and access control
Affected products: vendor: ZTE Corporation
product: ZXUPN-9000E
Published: 2019-11-08T18:28:27.000Z
CVE-2019-3426 
The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit this vulnerability for unauthorized operations.
Problem types: description: input validation
Affected products: vendor: ZTE Corporation
product: ZXUPN-9000E
Published: 2019-11-08T18:29:03.000Z
CVE-2019-3427 
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malicious code into the management page, resulting in users’ information leakage.
Problem types: description: code injection
Affected products: vendor: ZTE
product: ZXCDN IAMWEB
Published: 2019-11-22T15:49:20.000Z
CVE-2019-3428 
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users’ information leakage.
Problem types: description: configuration error
Affected products: vendor: ZTE
product: ZXCDN IAMWEB
Published: 2019-11-22T15:49:50.000Z
CVE-2019-3429 
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could obtain log file information without authorization, causing the disclosure of sensitive information.
Problem types: description: file reading vulnerability
Affected products: vendor: ZTE
product: ZXCLOUD GoldenData VAP
Published: 2019-12-23T18:09:15.000Z
CVE-2019-3430 
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have an information disclosure vulnerability. Attackers could use this vulnerability to collect data information and damage the system.
Problem types: description: information disclosure
Affected products: vendor: ZTE
product: ZXCLOUD GoldenData VAP
Published: 2019-12-23T18:09:41.000Z
CVE-2019-3431 
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers could sniff unencrypted account and password through the network for front-end system access.
Problem types: description: encryption problems
Affected products: vendor: ZTE
product: ZXCLOUD GoldenData VAP
Published: 2019-12-23T18:10:06.000Z
CVE-2019-3459 
A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.
Problem types: description: information leak
Affected products: vendor: Linux
product: Linux
Published: 2019-04-11T15:53:35.000Z
CVE-2019-3460 
A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.
Problem types: description: information leak
Affected products: vendor: Linux
product: Linux
Published: 2019-04-11T16:00:20.000Z
CVE-2019-3461 
Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via rename() could potentially lead to a file being placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on the same physical filesystem. Fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14.
Problem types: description: Local privilege escalation
Affected products: vendor: Debian GNU/Linux
product: tmpreaper
Published: 2019-02-04T18:00:00.000Z
CVE-2019-3462 
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
Problem types: description: Remote code execution in apt
Affected products: vendor: Debian GNU/Linux
product: apt as used in Debian Stretch and Ubuntu
Published: 2019-01-28T21:00:00.000Z
CVE-2019-3463 
Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
Problem types: description: Incomplete sanitization of passed arguments
Affected products: vendor: Debian GNU/Linux
product: rssh
Published: 2019-02-06T19:00:00.000Z
CVE-2019-3464 
Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
Problem types: description: Incomplete sanitization of environment variable
Affected products: vendor: Debian GNU/Linux
product: rssh
Published: 2019-02-06T19:00:00.000Z
CVE-2019-3465 
Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.
Problem types: description: Improper Verification of Cryptographic Signature
Affected products: vendor: n/a
product: Rob Richards XmlSecLibs
Published: 2019-11-07T19:12:33.000Z
CVE-2019-3466 
The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.
Problem types: description: Insufficient drop of privileges
Affected products: vendor: n/a
product: postgresql-common (Debian-specific Postgres management tools)
Published: 2019-11-20T17:16:16.000Z
CVE-2019-3467 
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.
Problem types: description: too permissive access control settings
Affected products: vendor: Debian
product: Debian Edu
Published: 2019-12-23T18:04:11.000Z
CVE-2019-3474 Path traversal vulnerability in Filr web application
A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
Problem types: cwe_id: CWE-22
description: Path traversal [CWE-22]
Affected products: vendor: Micro Focus
product: Filr
Credits: lang: en
value: This vulnerability was discovered and researched by Matias Choren from SecureAuth.
Published: 2019-02-20T22:00:00.000Z
CVE-2019-3475 Local privilege escalation in Filr famtd
A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
Problem types: cwe_id: CWE-264
description: Privileges, and Access Control [CWE-264]
Affected products: vendor: Micro Focus
product: Filr
Credits: lang: en
value: This vulnerability was discovered and researched by Matias Choren from SecureAuth.
Published: 2019-02-20T22:00:00.000Z
CVE-2019-3476 
Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbitrary code execution.
Problem types: description: Remote Arbitrary Code Execution
Affected products: vendor: n/a
product: Micro Focus Data Protector
Published: 2019-03-25T16:07:28.000Z
CVE-2019-3477 
Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.
Problem types: description: open redirect.
Affected products: vendor: Micro Focus
product: Solutions Business Manager
Published: 2019-06-07T16:17:00.000Z
CVE-2019-3479 
Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: ArcSight Logger
Published: 2019-03-25T16:01:14.000Z
CVE-2019-3480 
Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.
Problem types: description: stored/reflected XSS
Affected products: vendor: n/a
product: ArcSight Logger
Published: 2019-03-25T16:03:37.000Z
CVE-2019-3481 
Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.
Problem types: description: XML External Entity Parsing
Affected products: vendor: n/a
product: ArcSight Logger
Published: 2019-03-25T16:04:29.000Z
CVE-2019-3482 
Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.
Problem types: description: directory traversal
Affected products: vendor: n/a
product: ArcSight Logger
Published: 2019-03-25T16:05:03.000Z
CVE-2019-3483 
Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.
Problem types: description: information leakage
Affected products: vendor: n/a
product: ArcSight Logger
Published: 2019-03-25T16:05:48.000Z
CVE-2019-3484 
Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: ArcSight Logger
Published: 2019-03-25T16:06:24.000Z
CVE-2019-3485 ArcSight Logger stored cross site script issue in version prior to 6.7.1
Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1
Problem types: description: stored cross site script
Affected products: vendor: Micro Focus
product: ArcSight Logger
Credits: lang: en
value: Special thanks to ING Tech Poland for responsibly disclosing this vulnerability.
Published: 2019-07-24T15:30:12.893Z
CVE-2019-3486 ArcSight Security Management Center stored cross site script issue in version prior to 2.9.1
Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1
Problem types: description: stored cross site script
Affected products: vendor: Micro Focus
product: Arcsight Security Management Center
Credits: lang: en
value: Special thanks to ING Tech Poland for responsibly disclosing this vulnerability.
Published: 2019-07-25T14:30:16.486Z
CVE-2019-3489 
An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to arbitrary locations on the Content Manager server.
Problem types: description: Remote upload content to arbitrary locations
Affected products: vendor: Micro Focus
product: Micro Focus Content Manager
Published: 2019-04-01T19:12:43.000Z
CVE-2019-3490 
A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and OES2018SP1. Older versions may be affected but were not tested as they are out of support.
Problem types: description: DOM based XSS
Affected products: vendor: OES
product: Netstorage component of Open Enterprise Server
Published: 2019-05-02T16:46:37.000Z
CVE-2019-3493 
A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20, 9.21, 10.00, 10.10, 10.20, 10.30, 10.40, 10.50, 2018.05, 2018.08, 2018.11, and Micro Focus Network Operations Management (NOM) all versions. The vulnerability could be remotely exploited to Remote Code Execution.
Problem types: description: Remote Code Execution
Affected products: vendor: Micro Focus
product: Micro Focus Network Automation and Micro Focus Network Operations Management (NOM)
Published: 2019-04-29T15:47:08.000Z
CVE-2019-3494 
Simply-Blog through 2019-01-01 has SQL Injection via the admin/deleteCategories.php delete parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-01T15:00:00.000Z
CVE-2019-3495 
An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. network/mesh/edit-nds.php is vulnerable to arbitrary file upload, allowing an attacker to upload .php files and execute code on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T17:14:33.000Z
CVE-2019-3496 
An issue was discovered on Wifi-soft UniBox controller 3.x devices. The tools/controller/diagnostic_tools_controller Diagnostic Tools Controller is vulnerable to Remote Command Execution, allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T17:35:55.000Z
CVE-2019-3497 
An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diagnostic Tools component is vulnerable to Remote Command Execution, allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authentication for accessing this component can be bypassed by using Hard coded credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T17:40:31.000Z
CVE-2019-3498 
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T22:00:00.000Z
CVE-2019-3500 
aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T07:00:00.000Z
CVE-2019-3501 
The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T13:00:00.000Z
CVE-2019-3552 
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Problem types: cwe_id: CWE-834
description: Excessive Iteration (CWE-834)
Affected products: vendor: Facebook
product: Facebook Thrift
Published: 2019-05-06T15:15:02.000Z
CVE-2019-3553 
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling (CWE-770)
Affected products: vendor: Facebook
product: Facebook Thrift
Published: 2020-03-10T20:30:21.000Z
CVE-2019-3554 
Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: Facebook
product: Wangle
Published: 2019-01-15T22:00:00.000Z
CVE-2019-3556 
HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory (CWE-22)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-10-26T20:05:10.000Z
CVE-2019-3557 
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Facebook
product: HHVM
Published: 2019-01-15T22:00:00.000Z
CVE-2019-3558 
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Problem types: cwe_id: CWE-834
description: Excessive Iteration (CWE-834)
Affected products: vendor: Facebook
product: Facebook Thrift
Published: 2019-05-06T15:15:02.000Z
CVE-2019-3559 
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Problem types: cwe_id: CWE-834
description: Excessive Iteration (CWE-834)
Affected products: vendor: Facebook
product: Facebook Thrift
Published: 2019-05-06T15:15:02.000Z
CVE-2019-3560 
An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on user input. This issue affected versions of fizz prior to v2019.03.04.00.
Problem types: cwe_id: CWE-835
description: Loop with Unreachable Exit Condition (CWE-835)
Affected products: vendor: Facebook
product: fizz
Published: 2019-04-29T00:00:00.000Z
CVE-2019-3561 
Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM (4.0.3, 3.30.4, and 3.27.7 and below).
Problem types: cwe_id: CWE-119
description: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Affected products: vendor: Facebook
product: HHVM
Published: 2019-04-29T15:32:45.000Z