rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-9808 
If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown origin" as the requestee, leading to user confusion about which site is asking for this permission. This vulnerability affects Firefox < 66.
Problem types: description: WebRTC permissions can display incorrect origin with data: and blob: URLs
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-26T16:10:38.000Z
CVE-2019-9809 
If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resources through invalid credentials or locations. These messages cannot be immediately dismissed, allowing for a denial of service (DOS) attack. This vulnerability affects Firefox < 66.
Problem types: description: Denial of service through FTP modal alert error messages
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-26T16:10:29.000Z
CVE-2019-9810 
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
Problem types: description: IonMonkey MArraySlice has incorrect alias information
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2019-04-26T16:10:13.000Z
CVE-2019-9811 
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Problem types: description: Sandbox escape via installation of malicious language pack
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2019-07-23T13:26:03.000Z
CVE-2019-9812 
Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69.
Problem types: description: Sandbox escape through Firefox Sync
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2020-01-08T21:41:06.000Z
CVE-2019-9813 
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
Problem types: description: Ionmonkey type confusion with __proto__ mutations
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2019-04-26T16:09:57.000Z
CVE-2019-9814 
Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 67.
Problem types: description: Memory safety bugs fixed in Firefox 67
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-07-23T13:24:44.000Z
CVE-2019-9815 
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. *Note: users need to update to macOS 10.14.5 in order to take advantage of this change.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Disable hyperthreading on content JavaScript threads on macOS
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:24:32.000Z
CVE-2019-9816 
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Type confusion with object groups and UnboxedObjects
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:24:19.000Z
CVE-2019-9817 
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Stealing of cross-domain images using canvas
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:24:05.000Z
CVE-2019-9818 
A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. *Note: this vulnerability only affects Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Use-after-free in crash generation server
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:23:53.000Z
CVE-2019-9819 
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Compartment mismatch with fetch API
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:23:43.000Z
CVE-2019-9820 
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Problem types: description: Use-after-free of ChromeEventHandler by DocShell
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2019-07-23T13:23:31.000Z
CVE-2019-9821 
A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. This vulnerability affects Firefox < 67.
Problem types: description: Use-after-free in AssertWorkerThread
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-07-23T13:23:21.000Z
CVE-2019-9823 
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-03T18:11:48.000Z
CVE-2019-9824 
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T20:50:39.000Z
CVE-2019-9825 
FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-14T22:00:00.000Z
CVE-2019-9826 
The fulltext search component in phpBB before 3.2.6 allows Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T20:43:17.000Z
CVE-2019-9827 
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-03T20:13:06.000Z
CVE-2019-9829 
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T03:00:00.000Z
CVE-2019-9831 
The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /?Key=PhoneRequestAuthorization requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T17:00:00.000Z
CVE-2019-9832 
The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket connections through a configured port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T17:00:00.000Z
CVE-2019-9833 
The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-stop requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T17:00:00.000Z
CVE-2019-9834 
The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T17:00:00.000Z
CVE-2019-9835 
The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T18:00:00.000Z
CVE-2019-9836 
Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-25T20:17:47.000Z
CVE-2019-9837 
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T23:00:00.000Z
CVE-2019-9838 
VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T20:46:28.000Z
CVE-2019-9839 
VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T20:44:04.000Z
CVE-2019-9841 
Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-19T18:34:28.000Z
CVE-2019-9842 
madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in app_code/handlers/PostHandler.cs writes a decoded base64 string to a file without validating the extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-14T19:14:39.000Z
CVE-2019-9843 
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T23:00:00.000Z
CVE-2019-9844 
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T23:00:00.000Z
CVE-2019-9845 
madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in Controllers/BlogController.cs writes a decoded base64 string to a file without validating the extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-16T17:53:22.000Z
CVE-2019-9846 
RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-16T12:00:00.000Z
CVE-2019-9847 Executable hyperlink targets executed unconditionally on activation
A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windows and macOS when processing a hyperlink target explicitly activated by the user there was no judgment made on whether the target was an executable file, so such executable targets were launched unconditionally. This issue affects: All LibreOffice Windows and macOS versions prior to 6.1.6; LibreOffice Windows and macOS versions in the 6.2 series prior to 6.2.3.
Problem types: description: Code Execution Vulnerability
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Zhongcheng Li(CK01) of Pox Security Team
Published: 2019-05-09T13:51:04.424Z
CVE-2019-9848 
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
Problem types: description: LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which could be leveraged to by an attacker document to silently execute arbitrary python commands
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Thanks to Nils Emmerich of ERNW Research GmbH for discovering and reporting this issue
Published: 2019-07-17T11:21:57.813Z
CVE-2019-9849 
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
Problem types: description: In 'stealth mode' where only trusted documents are allowed to download remote resources untrusted documents could download remote bullet graphics urls
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Thanks to Matei "Mal" Badanoiu for discovering and reporting this problem
Published: 2019-07-17T11:26:03.387Z
CVE-2019-9850 Insufficient url validation allowing LibreLogo script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Problem types: description: Insufficient url validation
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Thanks to alex (@insertscript) for reporting this issue
Published: 2019-08-15T21:30:42.285Z
CVE-2019-9851 LibreLogo global-event script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Problem types: description: arbitrary script execution
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Thanks to Gabriel Masei of 1&1 for discovering and reporting this issue
Published: 2019-08-15T21:35:46.759Z
CVE-2019-9852 Insufficient URL encoding flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Problem types: cwe_id: CWE-116
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Thanks to Nils Emmerich of ERNW Research GmbH for discovering and reporting this issue
Published: 2019-08-15T21:40:18.556Z
CVE-2019-9853 Insufficient URL decoding flaw in categorizing macro location
LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings. The documents were correctly detected as containing macros, and prompted the user to their existence within the documents, but macros within the document were subsequently not controlled by the security settings allowing arbitrary macro execution This issue affects: LibreOffice 6.2 series versions prior to 6.2.7; LibreOffice 6.3 series versions prior to 6.3.1.
Problem types: cwe_id: CWE-116
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Thanks to Nils Emmerich of ERNW Research GmbH for discovering and reporting this issue
Published: 2019-09-27T15:07:40.492Z
CVE-2019-9854 Unsafe URL assembly flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.
Problem types: description: Unsafe URL assembly flaw in allowed script location check
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Thanks to RiceX(@ricex_cc) for reporting this issue
Published: 2019-09-06T18:30:08.910Z