rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-18318 
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server can cause a Denial-of-Service condition by sending specifically crafted objects via RMI. This vulnerability is independent from CVE-2019-18317 and CVE-2019-18319. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: SPPA-T3000 Application Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18319 
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could cause a Denial-of-Service condition by sending specifically crafted objects via RMI. This vulnerability is independent from CVE-2019-18317 and CVE-2019-18318. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: SPPA-T3000 Application Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18320 
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could be able to upload arbitrary files without authentication. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: SPPA-T3000 Application Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18321 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to read and write arbitrary files on the local file system by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18322. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18322 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to read and write arbitrary files on the local file system by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18321. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18323 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18324, CVE-2019-18325, CVE-2019-18326, CVE-2019-18327, CVE-2019-18328, CVE-2019-18329, and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18324 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323, CVE-2019-18325, CVE-2019-18326, CVE-2019-18327, CVE-2019-18328, CVE-2019-18329, and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18325 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323, CVE-2019-18324, CVE-2019-18326, CVE-2019-18327, CVE-2019-18328, CVE-2019-18329, and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18326 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323, CVE-2019-18324, CVE-2019-18325, CVE-2019-18327, CVE-2019-18328, CVE-2019-18329, and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18327 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323, CVE-2019-18324, CVE-2019-18325, CVE-2019-18326, CVE-2019-18328, CVE-2019-18329, and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18328 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323, CVE-2019-18324, CVE-2019-18325, CVE-2019-18326, CVE-2019-18327, CVE-2019-18329, and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18329 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323, CVE-2019-18324, CVE-2019-18325, CVE-2019-18326, CVE-2019-18327, CVE-2019-18328, and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18330 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323, CVE-2019-18324, CVE-2019-18325, CVE-2019-18326, CVE-2019-18327, CVE-2019-18328, and CVE-2019-18329. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SPPA-T3000 MS3000 Migration Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18331 
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain access to path and filenames on the server by sending specifically crafted packets to 1099/tcp. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SPPA-T3000 Application Server
Published: 2019-12-12T19:08:48.000Z
CVE-2019-18332 
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain access to directory listings of the server by sending specifically crafted packets to 80/tcp, 8095/tcp or 8080/tcp. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SPPA-T3000 Application Server
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18333 
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain access to filenames on the server by sending specifically crafted packets to 8090/tcp. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SPPA-T3000 Application Server
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18334 
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could be able to enumerate valid user names by sending specifically crafted packets to 8090/tcp. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SPPA-T3000 Application Server
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18335 
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could be able to gain access to logs and configuration files by sending specifically crafted packets to 80/tcp. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SPPA-T3000 Application Server
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18336 
A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC TDC CP51M1 (All versions < V1.1.8), SIMATIC TDC CPU555 (All versions < V1.1.1), SINUMERIK 840D sl (All versions < V4.8.6), SINUMERIK 840D sl (All versions < V4.94). Specially crafted packets sent to port 102/tcp (Profinet) could cause the affected device to go into defect mode. A restart is required in order to recover the system. Successful exploitation requires an attacker to have network access to port 102/tcp, with no authentication. No user interation is required. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Siemens AG
product: SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants)
vendor: Siemens AG
product: SIMATIC TDC CP51M1
vendor: Siemens AG
product: SIMATIC TDC CPU555
vendor: Siemens AG
product: SINUMERIK 840D sl
vendor: Siemens AG
product: SINUMERIK 840D sl
Published: 2020-03-10T19:16:17.000Z
CVE-2019-18337 
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an authentication bypass
vulnerability in its XML-based communication protocol as provided by default
on ports 5444/tcp and 5440/tcp.

A remote attacker with network access to the CCS server could
exploit this vulnerability to read the CCS users database, including
the passwords of all users in obfuscated cleartext.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: Control Center Server (CCS)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18338 
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains a directory traversal
vulnerability in its XML-based communication protocol as provided by default
on ports 5444/tcp and 5440/tcp.

An authenticated remote attacker with network access to the CCS server
could exploit this vulnerability to list arbitrary directories
or read files outside of the CCS application context.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Siemens
product: Control Center Server (CCS)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:F/RL:U/RC:C
baseScore: 7.7
baseSeverity: HIGH
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18339 
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port 5401/tcp) of the SiVMS/SiNVR Video Server
contains an authentication bypass vulnerability, even when properly
configured with enforced authentication.

A remote attacker with network access to the Video Server could 
exploit this vulnerability to read the SiVMS/SiNVR users database, including
the passwords of all users in obfuscated cleartext.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: SiNVR/SiVMS Video Server
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18340 
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0). Both the SiVMS/SiNVR Video Server and the Control Center Server (CCS) store
user and device passwords by applying weak cryptography.

A local attacker could exploit this vulnerability to extract
the passwords from the user database and/or the device configuration files
to conduct further attacks.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Siemens
product: Control Center Server (CCS)
default_status: unknown
vendor: Siemens
product: Control Center Server (CCS)
default_status: unknown
vendor: Siemens
product: SiNVR/SiVMS Video Server
default_status: unknown
vendor: Siemens
product: SiNVR/SiVMS Video Server
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:C
baseScore: 5.5
baseSeverity: MEDIUM
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18341 
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server
(CCS) contains an authentication bypass vulnerability.

A remote attacker with network access to the CCS server could
exploit this vulnerability to read data from the EDIR directory
(for example, the list of all configured stations).
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: Control Center Server (CCS)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18342 
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server
(CCS) does not properly limit its capabilities to the specified purpose.

In conjunction with CVE-2019-18341, an unauthenticated remote attacker with
network access to the CCS server could exploit this vulnerability
to read or delete arbitrary files, or access other resources on the same
server.
Problem types: cwe_id: CWE-749
description: CWE-749: Exposed Dangerous Method or Function
Affected products: vendor: Siemens
product: Control Center Server (CCS)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C
baseScore: 9.9
baseSeverity: CRITICAL
Published: 2019-12-12T19:08:49.000Z
CVE-2019-18344 
Sourcecodester Online Grading System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the student, instructor, department, room, class, or user page (id or classid parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T14:36:36.000Z
CVE-2019-18345 
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-12T13:54:35.000Z
CVE-2019-18346 
A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-04T17:15:07.000Z
CVE-2019-18347 
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-04T17:22:37.000Z
CVE-2019-18348 
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:31:22.000Z
CVE-2019-18349 
HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T17:55:07.000Z
CVE-2019-18350 
In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of JavaScript code in the login after-action script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T17:24:34.000Z
CVE-2019-18352 
Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using MAC-based port security.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-18T15:15:00.000Z
CVE-2019-18355 
An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T18:38:15.000Z
CVE-2019-18356 
An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T18:38:24.000Z