rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-5369 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:45:55.000Z
CVE-2019-5370 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:46:24.000Z
CVE-2019-5371 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:46:49.000Z
CVE-2019-5372 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:47:20.000Z
CVE-2019-5373 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:47:44.000Z
CVE-2019-5374 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:48:09.000Z
CVE-2019-5375 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:48:38.000Z
CVE-2019-5376 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:49:07.000Z
CVE-2019-5377 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:49:36.000Z
CVE-2019-5378 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:50:04.000Z
CVE-2019-5379 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:50:38.000Z
CVE-2019-5380 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:51:11.000Z
CVE-2019-5381 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:51:39.000Z
CVE-2019-5382 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:51:59.000Z
CVE-2019-5383 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:52:26.000Z
CVE-2019-5384 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:52:51.000Z
CVE-2019-5385 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:53:16.000Z
CVE-2019-5386 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:53:49.000Z
CVE-2019-5387 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:54:34.000Z
CVE-2019-5388 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:55:01.000Z
CVE-2019-5389 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:55:25.000Z
CVE-2019-5390 
A remote command injection vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote command injection vulnerability
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:55:52.000Z
CVE-2019-5391 
A stack buffer overflow vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote stack buffer overflow
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:56:20.000Z
CVE-2019-5392 
A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: Disclosure of Information
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:08:55.000Z
CVE-2019-5393 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: HPE Intelligent Management Center (IMC) PLAT
Published: 2019-06-05T14:08:09.000Z
CVE-2019-5394 
The HPE Nonstop Maintenance Entity family of products are vulnerable to local disclosure of information, such as system layout and configuration.
Problem types: description: Local Disclosure of Information
Affected products: vendor: n/a
product: HPE NonStop Maintanence Entity
Published: 2019-06-05T17:46:14.000Z
CVE-2019-5395 
A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
Problem types: description: remote arbitrary file upload
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR Service Processor
Published: 2019-08-09T16:57:09.000Z
CVE-2019-5396 
A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
Problem types: description: remote authentication bypass
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR Service Processor
Published: 2019-08-09T17:00:34.000Z
CVE-2019-5397 
A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
Problem types: description: remote  bypass of security restrictions
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR Service Processor
Published: 2019-08-09T17:01:49.000Z
CVE-2019-5398 
A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
Problem types: description: remote multiple multiple cross-site
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR Service Processor
Published: 2019-08-09T17:03:35.000Z
CVE-2019-5399 
A remote gain authorized access vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
Problem types: description: remote gain authorized access
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR Service Processor
Published: 2019-08-09T17:04:54.000Z
CVE-2019-5400 
A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
Problem types: description: remote session reuse
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR Service Processor
Published: 2019-08-09T17:05:56.000Z
CVE-2019-5401 
A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields (management URL, location, contact). But admin privileges are required to configure these fields thereby reducing the likelihood of exploit. HPE Aruba has provided firmware updates to resolve the vulnerability in HP 2910-48G al Switch. Please update to W.15.14.0017.
Problem types: description: remote arbitrary command execution
Affected products: vendor: HP
product: HP 2910-48G al Switch
Published: 2019-08-01T21:21:06.000Z
CVE-2019-5402 
A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
Problem types: description: remote authorization bypass
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR StoreServ Management and Core Software Media
Published: 2019-08-09T17:28:00.000Z
CVE-2019-5403 
A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
Problem types: description: remote multiple cross-site scripting
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR StoreServ Management and Core Software Media
Published: 2019-08-09T17:29:20.000Z
CVE-2019-5404 
A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
Problem types: description: remote script injection
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR StoreServ Management and Core Software Media
Published: 2019-08-09T17:30:13.000Z
CVE-2019-5405 
A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
Problem types: description: remote authorization bypass
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR StoreServ Management and Core Software Media
Published: 2019-08-09T17:31:33.000Z
CVE-2019-5406 
A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
Problem types: description: remote session reuse
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR StoreServ Management and Core Software Media
Published: 2019-08-09T17:38:16.000Z
CVE-2019-5407 
A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
Problem types: description: remote information disclosure
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE 3PAR StoreServ Management and Core Software Media
Published: 2019-08-09T17:39:35.000Z
CVE-2019-5408 
Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed by Device Manager server. This problem is due to a vulnerability in Device Manager GUI. The following products are affected. DevMgr version 7.0.0-00 to earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machine as DevMgr. The resolution is to upgrade to the fixed version as described below or later version of DevMgr 8.6.2-02 or later. RepMgr and TSMgr will be corrected by upgrading DevMgr.
Problem types: description: remote access restriction bypass; remote access restriction bypass
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HP XP7 CVAE
Published: 2019-08-09T17:49:26.000Z
CVE-2019-5413 
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: morgan
Published: 2019-03-17T19:36:35.000Z
CVE-2019-5414 
If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: kill-port
Published: 2019-03-17T19:42:05.000Z
CVE-2019-5415 
A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to.
Problem types: cwe_id: CWE-548
description: Information Exposure Through Directory Listing (CWE-548)
Affected products: vendor: n/a
product: serve
Published: 2019-03-17T19:28:37.000Z
CVE-2019-5416 
A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remote server.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: localhost-now
Published: 2019-03-17T19:34:59.000Z
CVE-2019-5417 
A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server.
Problem types: description: Directory Traversal (Local File Inclusion)
Affected products: vendor: n/a
product: serve
Published: 2019-03-17T19:24:24.000Z
CVE-2019-5418 
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: Rails
product: https://github.com/rails/rails
Published: 2019-03-27T13:38:58.000Z
CVE-2019-5419 
There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: Rails
product: https://github.com/rails/rails
Published: 2019-03-27T13:43:19.000Z
CVE-2019-5420 
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: Rails
product: https://github.com/rails/rails
Published: 2019-03-27T13:48:13.000Z
CVE-2019-5421 
Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later.
Problem types: cwe_id: CWE-367
description: Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected products: vendor: Plataformatec
product: Devise ruby gem
Published: 2019-04-03T14:21:37.000Z
CVE-2019-5422 
XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: Npm, Inc.
product: buttle
Published: 2019-04-03T14:21:40.000Z
CVE-2019-5423 
Path traversal vulnerability in http-live-simulator npm package version 1.0.5 allows arbitrary path to be accessed on the file system by a remote attacker.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: Npm, Inc.
product: http-live-simulator
Published: 2019-04-03T14:21:42.000Z
CVE-2019-5424 
In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute shell commands under the root user.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: Ubiquiti Networks
product: EdgeMAX
Published: 2019-04-10T17:31:24.000Z
CVE-2019-5425 
In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interface, which allow them to escalate privileges to root.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: Ubiquiti Networks
product: EdgeMAX
Published: 2019-04-10T17:50:53.000Z
CVE-2019-5426 
In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities. Remote attackers without credentials can exploit this bug to access local services or forward traffic through the device if SSH is enabled in the system settings.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: Ubiquiti Networks
product: EdgeMAX
Published: 2019-04-10T17:53:05.000Z
CVE-2019-5427 
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
Problem types: cwe_id: CWE-776
description: XML Entity Expansion (CWE-776)
Affected products: vendor: n/a
product: c3p0
Published: 2019-04-22T20:52:56.000Z
CVE-2019-5429 
Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory.
Problem types: cwe_id: CWE-426
description: Untrusted Search Path (CWE-426)
Affected products: vendor: FileZilla
product: FileZilla
Published: 2019-04-29T14:13:02.000Z
CVE-2019-5430 
In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without the user consent, requiring the attacker to lure an authenticated user to access on attacker controlled page.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: UniFi Video Server
Published: 2019-05-06T16:53:50.000Z
CVE-2019-5431 
This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: Twitter Kit for iOS
Published: 2019-05-06T16:47:30.000Z
CVE-2019-5432 
A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.
Problem types: cwe_id: CWE-126
description: Buffer Over-read (CWE-126)
Affected products: vendor: n/a
product: mqtt-packet
Published: 2019-05-06T16:48:23.000Z
CVE-2019-5433 
A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0.
Problem types: cwe_id: CWE-601
description: Open Redirect (CWE-601)
Affected products: vendor: n/a
product: Revive Adserver
Published: 2019-05-06T16:51:54.000Z
CVE-2019-5434 
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data (CWE-502)
Affected products: vendor: n/a
product: Revive Adserver
Published: 2019-05-06T16:53:33.000Z
CVE-2019-5435 
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
Problem types: cwe_id: CWE-131
description: Incorrect Calculation of Buffer Size (CWE-131)
Affected products: vendor: curl
product: curl
Published: 2019-05-28T18:44:01.000Z
CVE-2019-5436 
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
Problem types: cwe_id: CWE-122
description: Heap Overflow (CWE-122)
Affected products: vendor: curl
product: curl
Published: 2019-05-28T18:47:32.000Z