rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-3707 WS-MAN Authentication Bypass Vulnerability
Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted input data to the WS-MAN interface.
Problem types: description: WS-MAN Authentication Bypass Vulnerability
Affected products: vendor: Dell EMC
product: iDRAC
Published: 2019-04-26T18:22:09.049Z
CVE-2019-3708 Cross-Site Scripting Vulnerability in OVA file upload feature
IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user.
Problem types: description: Cross-Site Scripting Vulnerability
Affected products: vendor: Dell EMC
product: Dell EMC IsilonSD Management Server
Credits: lang: en
value: Dell EMC would like to thank Jarrod Farncomb for reporting this vulnerability.
Published: 2019-04-17T13:32:35.525Z
CVE-2019-3709 Cross-Site Scripting Vulnerability while registering vCenter servers
IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user.
Problem types: description: Cross-Site Scripting Vulnerability
Affected products: vendor: Dell EMC
product: Dell EMC IsilonSD Management Server
Credits: lang: en
value: Dell EMC would like to thank Jarrod Farncomb for reporting this vulnerability.
Published: 2019-04-17T13:32:35.568Z
CVE-2019-3710 DSA-2019-034: Dell EMC Networking OS10 Undocumented Default Cryptographic Key Vulnerability
Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to intercept communications or operate the system with elevated privileges.
Problem types: description: Undocumented Default Cryptographic Key
Affected products: vendor: Dell EMC
product: Dell EMC Networking OS10
Published: 2019-03-28T17:58:38.000Z
CVE-2019-3711 DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability
RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks.
Problem types: description: insecure credential management
Affected products: vendor: Dell
product: RSA Authentication Manager
Published: 2019-03-13T22:00:00.000Z
CVE-2019-3712 DSA-2019-039: Dell Wyse Device Agent Buffer Overflow Vulnerability
Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on the system with privileges of the FTP client by sending specially crafted input data to the affected system. The FTP code that contained the vulnerability has been removed.
Problem types: description: buffer overflow vulnerability
Affected products: vendor: Dell
product: Wyse Device Agent
vendor: Dell
product: Wyse ThinLinux HAgent
Credits: lang: en
value: Dell would like to thank Jason Larsen of IOActive for reporting this vulnerability.
Published: 2019-03-07T19:00:00.000Z
CVE-2019-3715 Information Exposure Vulnerability
RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks.
Problem types: description: Information Exposure Vulnerability
Affected products: vendor: Dell
product: RSA Archer
Published: 2019-03-13T22:00:00.000Z
CVE-2019-3716 Information Exposure Vulnerability
RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed password to use it in further attacks.
Problem types: description: Information Exposure Vulnerability
Affected products: vendor: Dell
product: RSA Archer
Published: 2019-03-13T22:00:00.000Z
CVE-2019-3717 
Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system during platform boot. Refer to https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en for versions affected by this vulnerability.
Problem types: description: Improper Access Control
Affected products: vendor: Dell
product: Dell Client Commercial and Consumer platforms
Published: 2019-08-05T16:38:20.346Z
CVE-2019-3718 
Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.
Problem types: description: Improper Origin Validation
Affected products: vendor: Dell
product: SupportAssist Client
Credits: lang: en
value: Dell would like to thank John C. Hennessy-ReCar for reporting CVE-2019-3718.
Published: 2019-04-18T19:58:22.877Z
CVE-2019-3719 
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.
Problem types: description: Remote Code Execution Vulnerability
Affected products: vendor: Dell
product: SupportAssist Client
Credits: lang: en
value: Dell would like to thank Bill Demirkapi for reporting CVE-2019-3719.
Published: 2019-04-18T19:58:22.916Z
CVE-2019-3720 Directory Traversal Vulnerability
Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain a Directory Traversal Vulnerability. A remote authenticated malicious user with admin privileges could potentially exploit this vulnerability to gain unauthorized access to the file system by exploiting insufficient sanitization of input parameters.
Problem types: description: Directory Traversal Vulnerability
Affected products: vendor: Dell EMC
product: Open Manage System Administrator
Credits: lang: en
value: Dell EMC would like to thank Harrison Neal for reporting this issue.
Published: 2019-04-25T20:17:37.154Z
CVE-2019-3721 Improper Range Header Processing Vulnerability
Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated attacker may send crafted requests with overlapping ranges to cause the application to compress each of the requested bytes, resulting in a crash due to excessive memory consumption and preventing users from accessing the system.
Problem types: description: Improper Range Header Vulnerability
Affected products: vendor: Dell EMC
product: Open Manage System Administrator
Credits: lang: en
value: Dell EMC would like to thank Murat Aydemir of Biznet Billisim A.S. for reporting this issue.
Published: 2019-04-25T20:17:37.195Z
CVE-2019-3722 XML External Entity (XXE) Injection Vulnerability
Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary server system files by supplying specially crafted document type definitions (DTDs) in an XML request.
Problem types: description: XML External Entity (XXE) Injection Vulnerability
Affected products: vendor: Dell EMC
product: OpenManage Server Administrator
Published: 2019-06-06T19:13:51.076Z
CVE-2019-3723 Web Parameter Tampering Vulnerability
Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauthenticated attacker could potentially manipulate parameters of web requests to OMSA to create arbitrary files with empty content or delete the contents of any existing file, due to improper input parameter validation
Problem types: description: Web Parameter Tampering Vulnerability
Affected products: vendor: Dell EMC
product: OpenManage Server Administrator
Published: 2019-06-06T19:14:38.463Z
CVE-2019-3724 Authorization Bypass VulnerabilityRSA Netwitness Platform
RSA Netwitness Platform versions prior to 11.2.1.1 is vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially exploit this vulnerability to gain access to administrative information including credentials.
Problem types: description: Authorization Bypass Vulnerability
Affected products: vendor: RSA
product: RSA Netwitness Platform
Credits: lang: en
value: RSA would like to thank Mantas Juškauskas for reporting CVE-2019-3724.
Published: 2019-05-15T15:45:11.690Z
CVE-2019-3725 Command Injection vulnerability
RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability due to missing input validation in the product. A remote unauthenticated malicious user could exploit this vulnerability to execute arbitrary commands on the server.
Problem types: description: Command Injection vulnerability
Affected products: vendor: RSA
product: RSA Netwitness Platform
vendor: RSA
product: RSA Security Analytics
Credits: lang: en
value: RSA would like to thank Nikolay Klendar for reporting CVE-2019-3725
Published: 2019-05-15T15:45:11.741Z
CVE-2019-3726 
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework file versions prior to 103.4.6.69 used in Dell EMC Servers. Dell Update Package (DUP) Framework file versions prior to 3.8.3.67 used in Dell Client Platforms. The vulnerability is limited to the DUP framework during the time window when a DUP is being executed by an administrator. During this time window, a locally authenticated low privilege malicious user potentially could exploit this vulnerability by tricking an administrator into running a trusted binary, causing it to load a malicious DLL and allowing the attacker to execute arbitrary code on the victim system. The vulnerability does not affect the actual binary payload that the DUP delivers.
Problem types: description: Uncontrolled Search Path Vulnerability
Affected products: vendor: Dell EMC
product: Dell EMC Servers: Networking and Fibre Channel Drivers: Dell Update Package (DUP) Framework file
vendor: Dell EMC
product: Dell EMC Servers: all other Drivers, BIOS and Firmware: Dell Update Package (DUP) Framework file
vendor: Dell
product: Dell Client Platforms: Dell Update Packages (DUP) Framework file
Credits: lang: en
value: Dell would like to thank Pierre-Alexandre Braeken, Silas Cutler, and Eran Shimony for reporting this issue.
Published: 2019-09-24T15:31:31.400Z
CVE-2019-3727 OS command injection vulnerability
Dell EMC RecoverPoint versions prior to 5.1.3 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an OS command injection vulnerability in the installation feature of Boxmgmt CLI. A malicious boxmgmt user may potentially be able to execute arbitrary commands as root.
Problem types: description: OS command injection vulnerability
Affected products: vendor: Dell EMC
product: RecoverPoint
Credits: lang: en
value: Dell EMC would like to thank Paul Taylor (@bao7uo) for reporting these vulnerabilities.
Published: 2019-05-15T15:45:11.817Z
CVE-2019-3728 
RSA BSAFE Crypto-C Micro Edition versions from 4.0.0.0 before 4.0.5.4 and from 4.1.0 before 4.1.4, RSA BSAFE Micro Edition Suite versions from 4.0.0 before 4.0.13 and from 4.1.0 before 4.4 and RSA Crypto-C versions from 6.0.0 through 6.4.* are vulnerable to an out-of-bounds read vulnerability when processing DSA signature. A malicious remote user could potentially exploit this vulnerability to cause a crash in the library of the affected system.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Dell
product: RSA BSAFE Crypto-C Micro Edition
default_status: unaffected
vendor: Dell
product: RSA BSAFE Micro Edition Suite
default_status: unaffected
vendor: Dell
product: RSA Crypto-C
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2019-09-30T21:48:40.164Z
CVE-2019-3729 
RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulnerability when parsing ECDSA signature. A malicious user with adjacent network access could potentially exploit this vulnerability to cause a crash in the library of the affected system.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Dell
product: RSA BSAFE MES
Published: 2019-09-30T21:48:40.208Z
CVE-2019-3730 
RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an Error Message vulnerability, also known as a “padding oracle attack vulnerability”. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.
Problem types: cwe_id: CWE-649
description: CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
Affected products: vendor: Dell
product: RSA BSAFE MES
Published: 2019-09-30T21:48:40.255Z
CVE-2019-3731 
RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.
Problem types: cwe_id: CWE-310
description: CWE-310: Cryptographic Issues
Affected products: vendor: Dell
product: RSA BSAFE Crypto-C Micro Edition
vendor: Dell
product: RSA BSAFE MES
Published: 2019-09-30T21:48:40.294Z
CVE-2019-3732 
RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 (in 4.0.x) and versions prior to 4.1.3.3 (in 4.1.x), and RSA Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) versions prior to 4.1.6.1 (in 4.1.x) and versions prior to 4.3.3 (4.2.x and 4.3.x) are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.
Problem types: cwe_id: CWE-385
description: CWE-385: Covert Timing Channel
Affected products: vendor: Dell
product: RSA BSAFE Crypto-C Micro Edition
vendor: Dell
product: RSA BSAFE MES
Published: 2019-09-30T21:48:40.337Z
CVE-2019-3733 
RSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three (3) different Improper Clearing of Heap Memory Before Release vulnerability, also known as 'Heap Inspection vulnerability'. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.
Problem types: cwe_id: CWE-316
description: CWE-316: Cleartext Storage of Sensitive Information in Memory
Affected products: vendor: Dell
product: RSA BSAFE Crypto-C Micro Edition
vendor: Dell
product: RSA BSAFE MES
Published: 2019-09-30T21:48:40.378Z
CVE-2019-3734 
Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authenticated Unisphere Operator could potentially exploit this vulnerability to edit quota configuration of other users.
Problem types: description: Improper Authorization Vulnerability
Affected products: vendor: DELL EMC
product: Unity
Published: 2019-07-18T15:47:00.111Z
CVE-2019-3735 
Dell SupportAssist for Business PCs version 2.0 and Dell SupportAssist for Home PCs version 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, and 3.2.1 contain an Improper Privilege Management Vulnerability. A malicious local user can exploit this vulnerability by inheriting a system thread using a leaked thread handle to gain system privileges on the affected machine.
Problem types: description: Improper Privilege Management Vulnerability
Affected products: vendor: Dell
product: Dell SupportAssist for Business PCs
vendor: Dell
product: Dell SupportAssist for Home PCs
Credits: lang: en
value: Dell would like to thank Bill Demirkapi for reporting this vulnerability.
Published: 2019-06-20T21:43:26.331Z
CVE-2019-3736 
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malicious user with root privileges may potentially use a support tool to decrypt encrypted passwords stored locally on the system to use it to access other components using the privileges of the compromised user.
Problem types: cwe_id: CWE-257
description: CWE-257: Storing Passwords in a Recoverable Format
Affected products: vendor: Dell
product: Integrated Data Protection Appliance
Published: 2019-09-27T20:19:45.429Z
CVE-2019-3737 Dell EMC Avamar Security Update for ADMe Web UI Vulnerability
Dell EMC Avamar ADMe Web Interface 1.0.50 and 1.0.51 are affected by an LFI vulnerability which may allow a malicious user to download arbitrary files from the affected system by sending a specially crafted request to the Web Interface application.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Dell EMC
product: Avamar
Credits: lang: en
value: Dell EMC would like to thank Ken Pyle from DFDR Consulting for reporting this vulnerability.
Published: 2019-06-19T22:28:07.263Z
CVE-2019-3738 
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
Problem types: cwe_id: CWE-325
description: CWE-325: Missing Required Cryptographic Step
Affected products: vendor: Dell
product: RSA BSAFE Crypto-J
Published: 2019-09-18T22:23:10.057Z
CVE-2019-3739 
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
Problem types: cwe_id: CWE-310
description: CWE-310: Cryptographic Issues
Affected products: vendor: Dell
product: RSA BSAFE Crypto-J
Published: 2019-09-18T22:23:10.098Z
CVE-2019-3740 
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
Problem types: cwe_id: CWE-310
description: CWE-310: Cryptographic Issues
Affected products: vendor: Dell
product: RSA BSAFE Crypto-J
Published: 2019-09-18T22:23:10.138Z
CVE-2019-3741 
Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s (including the admin privilege user) password is stored in a plain text in Unity Data Collection bundle (logs files for troubleshooting). A local authenticated attacker with access to the Data Collection bundle may use the exposed password to gain access with the privileges of the compromised user.
Problem types: description: Plain-text Password Storage Vulnerability
Affected products: vendor: DELL EMC
product: Unity
Published: 2019-07-18T15:47:00.171Z
CVE-2019-3742 
Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: Dell
product: Dell Digital Delivery
vendor: Dell
product: Alienware Digital Delivery
Credits: lang: en
value: Dell would like to thank Alexander Bolshev, Security Consultant, IOActive and Enrique Nissim, Senior Security Consultant, IOActive for reporting these vulnerabilities.
Published: 2019-08-09T19:12:42.990Z
CVE-2019-3744 
Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: Dell
product: Dell Digital Delivery
vendor: Dell
product: Alienware Digital Delivery
Credits: lang: en
value: Dell would like to thank Alexander Bolshev, Security Consultant, IOActive and Enrique Nissim, Senior Security Consultant, IOActive for reporting these vulnerabilities.
Published: 2019-08-09T19:13:37.161Z
CVE-2019-3745 
The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the product by an administrator. A local authenticated low privileged user potentially could exploit this vulnerability by staging a malicious DLL in the search path of the installer prior to its execution by a local administrator. This would cause loading of the malicious DLL, which would allow the attacker to execute arbitrary code in the context of an administrator.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: Dell
product: Dell Encryption Enterprise
vendor: Dell
product: Dell Endpoint Security Suite Enterprise
Published: 2019-10-07T18:21:30.854Z
CVE-2019-3746 
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Dell
product: Integrated Data Protection Appliance
Published: 2019-09-27T20:20:39.666Z