rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-16902 
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T10:56:35.000Z
CVE-2019-16903 
Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T10:56:46.000Z
CVE-2019-16904 
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable when viewing the change history of the item or tapping on the item.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T11:06:33.000Z
CVE-2019-16905 
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-09T00:00:00.000Z
CVE-2019-16906 
An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with a modified username, a different user's notifications can be read without authentication/authorization. These notifications are then no longer displayed to the normal user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T21:36:56.000Z
CVE-2019-16907 
An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T21:43:35.000Z
CVE-2019-16908 
An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects without authentication/authorization via the plugins/servlet/nfj/ProjectFilter?searchQuery= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-01T11:30:06.000Z
CVE-2019-16909 
An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects (with authentication as a Jira user, but without authorization for specific projects) via the plugins/servlet/nfj/NotificationSettings URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-01T11:36:50.000Z
CVE-2019-16910 
Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T00:00:00.000Z
CVE-2019-16913 
PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: (F)" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as LocalSystem. This allows any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a Trojan horse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T21:47:19.000Z
CVE-2019-16914 
An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T17:38:53.000Z
CVE-2019-16915 
An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a basename call) for a pathname to file_get_contents or file_put_contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T17:38:42.000Z
CVE-2019-16917 
WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. The uid and domain parameters are used, unsanitized, in a SQL query constructed in the buildSearchWhereClause function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T17:42:46.000Z
CVE-2019-16919 
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper project permissions and project scope on the API request to create a new robot account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-18T11:59:57.000Z
CVE-2019-16920 
Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T11:34:12.000Z
CVE-2019-16921 
In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which might allow attackers to obtain sensitive information from kernel stack memory, aka CID-df7e40425813.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T12:07:23.000Z
CVE-2019-16922 
SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T15:12:33.000Z
CVE-2019-16923 
kkcms 1.3 has jx.php?url= XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T16:51:24.000Z
CVE-2019-16924 
The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers (after sniffing the network) to take control of the lock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T17:05:28.000Z
CVE-2019-16925 
Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full access
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T23:32:28.000Z
CVE-2019-16926 
Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full access
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T23:31:04.000Z
CVE-2019-16927 
Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc, a different vulnerability than CVE-2019-9877.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T19:57:04.000Z
CVE-2019-16928 
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-27T20:07:12.000Z
CVE-2019-16929 
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:06:31.000Z
CVE-2019-16930 
Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during deserialization of note plaintexts. This affects anyone who has disclosed their zaddr to a third party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-28T21:07:07.000Z
CVE-2019-16931 
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T18:34:45.000Z
CVE-2019-16932 
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-30T15:08:55.000Z
CVE-2019-16935 
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-28T01:33:02.000Z
CVE-2019-16941 
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-28T15:49:09.000Z
CVE-2019-16942 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T16:04:26.000Z
CVE-2019-16943 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T16:06:23.000Z
CVE-2019-16948 
An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network (as opposed to what general web traffic would see on the product's host). The response from open ports is different than from closed ports. The product does not allow one to change the protocol: anything except http(s) will throw an error; however, it is the type of error that allows one to determine if a port is open or not.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T17:01:22.000Z
CVE-2019-16949 
An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat (where the user enters in their name and e-mail address). This POST request can be modified to change the message as well as the end recipient of the message. The e-mail address will have the same domain name and user as the product allotted. This can be used in phishing campaigns against users on the same domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T17:37:36.000Z
CVE-2019-16950 
An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T18:12:39.000Z
CVE-2019-16951 
A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amount of information sent in the request from this product to the attacker: it reveals information the public should not have. This includes pathnames and internal ip addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T18:47:22.000Z
CVE-2019-16954 
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T16:53:20.000Z
CVE-2019-16955 
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:55:56.000Z
CVE-2019-16956 
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-04T07:56:50.000Z
CVE-2019-16957 
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T08:53:24.000Z
CVE-2019-16958 
Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-01T17:57:13.000Z
CVE-2019-16959 
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-21T15:13:21.000Z
CVE-2019-16960 
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-04T08:00:34.000Z
CVE-2019-16961 
SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-15T13:28:14.000Z
CVE-2019-16962 
Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-06T16:55:08.000Z
CVE-2019-16964 
app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated attackers (with at least the permission call_center_queue_add or call_center_queue_edit) to execute any commands on the host as www-data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T18:15:03.000Z
CVE-2019-16965 
resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T18:45:21.000Z
CVE-2019-16966 
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T18:57:44.000Z
CVE-2019-16967 
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\admin\modules\manager\views\form.php), an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via GET request to /config.php?type=tool&display=manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T19:10:13.000Z
CVE-2019-16968 
An issue was discovered in FusionPBX up to 4.5.7. In the file app\conference_controls\conference_control_details.php, an unsanitized id variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T19:30:38.000Z
CVE-2019-16969 
In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T20:37:59.000Z
CVE-2019-16970 
In FusionPBX up to 4.5.7, the file app\sip_status\sip_status.php uses an unsanitized "savemsg" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T19:52:22.000Z
CVE-2019-16971 
In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized "contact_uuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T21:16:56.000Z
CVE-2019-16972 
In FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T21:36:48.000Z
CVE-2019-16973 
In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T21:41:45.000Z
CVE-2019-16974 
In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T20:45:13.000Z
CVE-2019-16975 
In FusionPBX up to 4.5.7, the file app\contacts\contact_notes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T15:53:03.000Z
CVE-2019-16976 
In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T14:34:44.000Z
CVE-2019-16977 
In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:27:28.000Z
CVE-2019-16978 
In FusionPBX up to v4.5.7, the file app\devices\device_settings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T14:01:34.000Z
CVE-2019-16979 
In FusionPBX up to v4.5.7, the file app\contacts\contact_urls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T14:15:09.000Z
CVE-2019-16980 
In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T14:10:02.000Z
CVE-2019-16981 
In FusionPBX up to v4.5.7, the file app\conference_profiles\conference_profile_params.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T15:16:15.000Z
CVE-2019-16982 
In FusionPBX up to v4.5.7, the file app\access_controls\access_control_nodes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T15:11:57.000Z
CVE-2019-16983 
In FusionPBX up to v4.5.7, the file resources\paging.php has a paging function (called by several pages of the interface), which uses an unsanitized "param" variable constructed partially from the URL args and reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T15:20:03.000Z
CVE-2019-16984 
In FusionPBX up to v4.5.7, the file app\recordings\recording_play.php uses an unsanitized "filename" variable coming from the URL, which is base64 decoded and reflected in HTML, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T15:23:34.000Z