rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-8251 
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerability. Successful exploitation could lead to information disclosure.
Problem types: description: Type Confusion
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2020-07-06T17:38:18.000Z
CVE-2019-8252 
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerability. Successful exploitation could lead to information disclosure.
Problem types: description: Type Confusion
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2020-07-06T17:38:19.000Z
CVE-2019-8253 
Adobe Photoshop CC versions before 20.0.8 and 21.0.x before 21.0.2 have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe
product: Adobe Photoshop CC
Published: 2019-12-19T19:44:23.000Z
CVE-2019-8254 
Adobe Photoshop CC versions before 20.0.8 and 21.0.x before 21.0.2 have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe
product: Adobe Photoshop CC
Published: 2019-12-19T19:44:02.000Z
CVE-2019-8255 
Brackets versions 1.14 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Command Injection
Affected products: vendor: Adobe
product: Brackets
Published: 2019-12-19T19:38:52.000Z
CVE-2019-8256 
ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. Successful exploitation could lead to privilege escalation.
Problem types: description: Insecure inherited permissions of default installation directory
Affected products: vendor: Adobe
product: ColdFusion
Published: 2019-12-19T19:40:43.000Z
CVE-2019-8257 
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2020-01-27T23:12:28.000Z
CVE-2019-8258 
UltraVNC revision 1198 has a heap buffer overflow vulnerability in VNC client code which results code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1199.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: UltraVNC
product: UltraVNC
Published: 2019-03-05T15:00:00.000Z
CVE-2019-8259 
UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1199.
Problem types: cwe_id: CWE-665
description: CWE-665: Improper Initialization
Affected products: vendor: UltraVNC
product: UltraVNC
Published: 2019-03-05T15:00:00.000Z
CVE-2019-8260 
UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: UltraVNC
product: UltraVNC
Published: 2019-03-05T15:00:00.000Z
CVE-2019-8261 
UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: UltraVNC
product: UltraVNC
Published: 2019-03-05T15:00:00.000Z
CVE-2019-8262 
UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1204.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: UltraVNC
product: UltraVNC
Published: 2019-03-05T15:00:00.000Z
CVE-2019-8263 
UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. User interaction is required to trigger this vulnerability. This vulnerability has been fixed in revision 1206.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-05T15:00:00.000Z
CVE-2019-8264 
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside Ultra2 decoder, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1204.
Problem types: cwe_id: CWE-788
description: CWE-788: Access of Memory Location After End of Buffer
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8265 
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macro in VNC client code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1208.
Problem types: cwe_id: CWE-788
description: CWE-788: Access of Memory Location After End of Buffer
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8266 
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer function in VNC client code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. User interaction is required to trigger these vulnerabilities. These vulnerabilities have been fixed in revision 1208.
Problem types: cwe_id: CWE-788
description: CWE-788: Access of Memory Location After End of Buffer
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8267 
UltraVNC revision 1207 has out-of-bounds read vulnerability in VNC client code inside TextChat module, which results in a denial of service (DoS) condition. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1208.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8268 
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which can potentially result code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1207.
Problem types: cwe_id: CWE-193
description: CWE-193: Off-by-one Error
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8269 
UltraVNC revision 1206 has stack-based Buffer overflow vulnerability in VNC client code inside FileTransfer module, which leads to a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. This vulnerability has been fixed in revision 1207.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8270 
UltraVNC revision 1210 has out-of-bounds read vulnerability in VNC client code inside Ultra decoder, which results in a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. This vulnerability has been fixed in revision 1211.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8271 
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which can potentially result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8272 
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.
Problem types: cwe_id: CWE-193
description: CWE-193: Off-by-one Error
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8273 
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8274 
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8275 
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote users. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.
Problem types: cwe_id: CWE-170
description: CWE-170: Improper Null Termination
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8276 
UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service (DoS). This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8277 
UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.
Problem types: cwe_id: CWE-665
description: multiple memory leaks (CWE-665)
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8278 
Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.
Problem types: description: Stored XSS
Affected products: vendor: Kaspersky Lab
product: Invision Power Board
Published: 2019-03-02T01:00:00.000Z
CVE-2019-8279 
Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.
Problem types: description: Multiple XSS
Affected products: vendor: Kaspersky Lab
product: Vanilla Forums
Published: 2019-03-02T01:00:00.000Z
CVE-2019-8280 
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution. This attack appear to be exploitable via network connectivity. This vulnerability has been fixed in revision 1204.
Problem types: cwe_id: CWE-788
description: CWE-788: Access of Memory Location After End of Buffer
Affected products: vendor: Kaspersky Lab
product: UltraVNC
Published: 2019-03-09T00:00:00.000Z
CVE-2019-8282 
Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one.
Problem types: cwe_id: CWE-300
description: CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Affected products: vendor: n/a
product: Sentinel LDK RTE
Published: 2019-06-07T14:21:01.000Z
CVE-2019-8283 
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.
Problem types: cwe_id: CWE-1004
description: CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
Affected products: vendor: n/a
product: Sentinel LDK RTE
Published: 2019-06-07T14:18:05.000Z
CVE-2019-8285 
Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potentially allow arbitrary code execution
Problem types: description: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Kaspersky Lab Antivirus Engine
Published: 2019-05-08T17:45:04.000Z
CVE-2019-8286 
Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Product ID by forcing victim to visit a specially crafted webpage (for example, via clicking phishing link). Vulnerability has CVSS v3.0 base score 2.6
Problem types: description: Information Disclosure
Affected products: vendor: Kaspersky
product: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security
Published: 2019-07-18T18:34:15.000Z
CVE-2019-8287 
TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Kaspersky
product: TightVNC
Published: 2019-10-29T16:43:30.000Z
CVE-2019-8288 
Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized.
Problem types: description: Online store system v1.0 Stored XSS
Affected products: vendor: abcprintf
product: Online Store
Published: 2019-10-01T19:53:28.000Z
CVE-2019-8289 
Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variable
Problem types: description: Online store system v1.0 Stored XSS.
Affected products: vendor: abcprintf
product: Online Store
Published: 2019-10-01T19:53:28.000Z
CVE-2019-8290 
Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sent_register.php allowing special characters to be included and an XSS payload to be injected.
Problem types: description: User input not sanitized in sent_register.php.
Affected products: vendor: abcprintf
product: Online Store
Published: 2019-10-01T19:53:28.000Z
CVE-2019-8291 
Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal.
Problem types: description: unauthenticated arbitrary file deletions via path traversal
Affected products: vendor: abcprintf
product: Online Store
Published: 2019-10-01T19:53:28.000Z
CVE-2019-8292 
Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary product deletion.
Problem types: description: unauthenticated arbitrary product deletions.
Affected products: vendor: abcprintf
product: Online Store
Published: 2019-10-01T19:53:28.000Z
CVE-2019-8293 
Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution.
Problem types: description: Arbitrary File Upload
Affected products: vendor: n/a
product: abcprintf upload-image-with-ajax
Published: 2019-12-23T21:45:08.000Z
CVE-2019-8308 
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T23:00:00.000Z
CVE-2019-8312 
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the IPAddress field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T03:00:00.000Z
CVE-2019-8313 
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv6FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv6AddressRangeStart field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T03:00:00.000Z
CVE-2019-8314 
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T03:00:00.000Z
CVE-2019-8315 
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv4AddressRangeStart field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T03:00:00.000Z
CVE-2019-8316 
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the WebFilterURLs field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T03:00:00.000Z
CVE-2019-8317 
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T03:00:00.000Z
CVE-2019-8318 
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T03:00:00.000Z
CVE-2019-8319 
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv4Settings API function, as demonstrated by shell metacharacters in the Gateway field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-13T03:00:00.000Z
CVE-2019-8320 
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T14:50:02.000Z
CVE-2019-8321 
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:02:34.000Z
CVE-2019-8322 
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:02:14.000Z