rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-19660 
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T15:39:24.000Z
CVE-2019-19661 
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T17:29:52.000Z
CVE-2019-19662 
A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Delete accounts via RAPR/TriggerServerFunction.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T16:49:17.000Z
CVE-2019-19663 
A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after exploiting it at RAPR/FolderSetsSet.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T15:54:34.000Z
CVE-2019-19664 
A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGeneralSet.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T16:44:15.000Z
CVE-2019-19665 
A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server FTP settings at RAPR/FTPSettingsSet.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T16:00:03.000Z
CVE-2019-19666 
A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can create/update event notices via RAPR/EventNoticesSet.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T17:38:58.000Z
CVE-2019-19667 
A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP address via RAPR/BlockedClients.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T17:45:35.000Z
CVE-2019-19668 
A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that are used on the server via RAPR/TriggerServerFunction.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T18:03:50.000Z
CVE-2019-19669 
A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and update the upload forms via RAPR/TriggerServerFunction.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T17:59:24.000Z
CVE-2019-19670 
A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1. A successful exploit can result in stored XSS, website defacement, etc. via ExtraHTTPHeader to RAPR/WebSettingsGeneralSet.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T17:54:08.000Z
CVE-2019-19675 
In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspecified attack vector in Workspace Preferences, when it is enabled. As a result, the attacker can start applications that should be blocked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-17T14:42:22.000Z
CVE-2019-19676 
A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering formula code in the following columns: Kundennummer, Firma, Street, PLZ, Ort, Zahlziel, and Bemerkung, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-18T21:55:53.000Z
CVE-2019-19677 
arxes-tolina 3.0.0 allows User Enumeration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-18T22:27:14.000Z
CVE-2019-19678 
In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via the Generic Test Definition field of a new Generic Test issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T15:31:17.000Z
CVE-2019-19679 
In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summary field of a Create Pre-Condition action for a new Test Issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T15:30:59.000Z
CVE-2019-19680 
A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD), in the unpatched versions of PPS through 8.9.22 and 8.14.2 respectively, allows attackers to bypass protection mechanisms (related to extensions, MIME types, virus detection, and journal entries for transmitted files) by sending malformed (not RFC compliant) multipart email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T20:06:25.000Z
CVE-2019-19681 
Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-26T15:59:27.000Z
CVE-2019-19682 
nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T16:58:24.000Z
CVE-2019-19683 
RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T16:57:13.000Z
CVE-2019-19684 
nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T16:58:12.000Z
CVE-2019-19685 
RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T16:58:02.000Z
CVE-2019-19687 
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T17:14:14.000Z
CVE-2019-19688 
A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a malicious DLL file into the application directory and elevate privileges.
Problem types: description: Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro HouseCall for Home Networks
Published: 2019-12-18T18:30:15.000Z
CVE-2019-19689 
Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the program uses.
Problem types: description: DLL Hijack
Affected products: vendor: Trend Micro
product: Trend Micro HouseCall for Home Networks
Published: 2019-12-18T18:30:16.000Z
CVE-2019-19690 
Trend Micro Mobile Security for Android (Consumer) versions 10.3.1 and below on Android 8.0+ has an issue in which an attacker could bypass the product's App Password Protection feature.
Problem types: description: Protection Bypass
Affected products: vendor: Trend Micro
product: Trend Micro Mobile Security for Android (Consumer)
Published: 2019-12-18T18:30:16.000Z
CVE-2019-19691 
A vulnerability in Trend Micro Apex One and OfficeScan XG could allow an attacker to expose a masked credential key by manipulating page elements using development tools. Note that the attacker must already have admin/root privileges on the product console to exploit this vulnerability.
Problem types: description: Credential Exposure
Affected products: vendor: Trend Micro
product: Trend Micro Apex One and OfficeScan
Published: 2019-12-20T04:05:21.000Z
CVE-2019-19692 
Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console. Note that the Japanese version of the product is NOT affected.
Problem types: description: XSS
Affected products: vendor: Trend Micro
product: Trend Micro Apex Central
Published: 2019-12-20T04:05:22.000Z
CVE-2019-19693 
The Trend Micro Security 2020 consumer family of products contains a vulnerability that could allow a local attacker to disclose sensitive information or to create a denial-of-service condition on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: DoS
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2019-12-20T04:05:22.000Z
CVE-2019-19694 
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manipulate a key file at a certain time during the system startup process to disable the product's malware protection functions or the entire product completely..
Problem types: description: DoS
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2020-02-20T22:50:23.000Z
CVE-2019-19695 
A privilege escalation vulnerability in Trend Micro Antivirus for Mac 2019 (v9.0.1379 and below) could potentially allow an attacker to create a symbolic link to a target file and modify it.
Problem types: description: Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac
Published: 2019-12-24T08:25:11.000Z
CVE-2019-19696 
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishing sites.
Problem types: description: RootCA Access
Affected products: vendor: Trend Micro
product: Trend Micro Password Manager
Published: 2020-01-17T23:45:24.000Z
CVE-2019-19697 
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administrator privileges on the target machine in order to exploit the vulnerability.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2020-01-17T23:45:25.000Z
CVE-2019-19698 
marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-10T06:07:49.000Z
CVE-2019-19699 
There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at 22:30 every day. To exploit the vulnerability, someone must have Admin access to the Centreon Web Interface and create a custom main.php?p=60803&type=3 command. The user must then set the Pollers Post-Restart Command to this previously created command via the main.php?p=60901&o=c&server_id=1 URI. This is triggered via an export of the Poller Configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T15:30:11.000Z
CVE-2019-19702 
The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML documents that are emailed to the address in the rua field of the DMARC records of a domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-10T19:19:50.000Z
CVE-2019-19703 
In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-10T19:43:28.000Z
CVE-2019-19704 
In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-08T20:52:51.000Z
CVE-2019-19705 
Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (and on many other Lenovo and non-Lenovo products), mishandles DLL preloading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2019-19707 
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T01:03:51.000Z
CVE-2019-19708 
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T01:33:31.000Z
CVE-2019-19709 
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T01:33:11.000Z
CVE-2019-19712 
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-17T13:59:38.000Z
CVE-2019-19714 
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-17T14:04:03.000Z
CVE-2019-19719 
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T03:05:55.000Z
CVE-2019-19720 
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T03:22:14.000Z
CVE-2019-19721 
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-15T17:28:23.000Z
CVE-2019-19722 
In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-13T16:34:48.000Z
CVE-2019-19724 
Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-18T20:52:24.000Z
CVE-2019-19725 
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T00:00:00.000Z
CVE-2019-19726 
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-12T00:00:00.000Z
CVE-2019-19727 
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T18:14:55.000Z
CVE-2019-19728 
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T18:14:01.000Z
CVE-2019-19729 
An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects _bsontype==ObjectID in the user-input object. As a result, objects in arbitrary forms can bypass formatting if they have a valid bsontype.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T19:56:01.000Z
CVE-2019-19731 
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-16T16:26:04.000Z
CVE-2019-19732 
translation_manage_text.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 directly insert values from the aSortDir_0 and/or sSortDir_0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T16:59:24.000Z
CVE-2019-19733 
_get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T16:59:40.000Z
CVE-2019-19734 
_account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T16:59:50.000Z
CVE-2019-19735 
class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set the password within a few hours by bruteforcing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T17:00:02.000Z
CVE-2019-19736 
MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be used by attackers to obtain the cookie via cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T17:00:12.000Z
CVE-2019-19737 
MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T17:00:28.000Z
CVE-2019-19738 
log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T17:00:40.000Z
CVE-2019-19739 
MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext channels.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T16:46:00.000Z
CVE-2019-19740 
Octeth Oempro 4.7 and 4.8 allow SQL injection. The parameter CampaignID in Campaign.Get is vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-12T02:13:21.000Z