rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-19579 
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describes alternate ways of preparing devices for assignment, and libvirt uses its own ways as well. Hosts where these "alternate" methods are used will still leave the system in a vulnerable state after the device comes back from a guest. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-04T21:03:38.000Z
CVE-2019-19580 
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All security-supported versions of Xen are vulnerable. Only x86 systems are affected. Arm systems are not affected. Only x86 PV guests can leverage the vulnerability. x86 HVM and PVH guests cannot leverage the vulnerability. Note that these attacks require very precise timing, which may be difficult to exploit in practice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T16:51:43.000Z
CVE-2019-19581 
An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On 32-bit Arm accesses to bitmaps with bit a count which is a multiple of 32, an out of bounds access may occur. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. 32-bit Arm systems are vulnerable. 64-bit Arm systems are not vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T16:50:48.000Z
CVE-2019-19582 
An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On x86 accesses to bitmaps with a compile time known size of 64 may incur undefined behavior, which may in particular result in infinite loops. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. x86 systems with 64 or more nodes are vulnerable (there might not be any such systems that Xen would run on). x86 systems with less than 64 nodes are not vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T16:50:13.000Z
CVE-2019-19583 
An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for #DB interception. The VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. HVM/PVH guest userspace code may be able to crash the guest, resulting in a guest Denial of Service. All versions of Xen are affected. Only systems supporting VMX hardware virtual extensions (Intel, Cyrix, or Zhaoxin CPUs) are affected. Arm and AMD systems are unaffected. Only HVM/PVH guests are affected. PV guests cannot leverage the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T16:48:26.000Z
CVE-2019-19585 
An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T19:24:04.000Z
CVE-2019-19587 
In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-04T23:56:30.000Z
CVE-2019-19588 
The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T00:05:02.000Z
CVE-2019-19589 
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control & block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T03:16:50.000Z
CVE-2019-19590 
In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T01:55:47.000Z
CVE-2019-19592 
Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T18:27:23.000Z
CVE-2019-19594 
reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T15:26:45.000Z
CVE-2019-19595 
reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T15:25:18.000Z
CVE-2019-19596 
GitBook through 2.6.9 allows XSS via a local .md file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T02:52:56.000Z
CVE-2019-19597 
D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T03:07:13.000Z
CVE-2019-19598 
D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value. In HTTP requests, part of the HNAP_AUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to the value stored in the device's /var/hnap/timestamp file, the request will pass the HNAP_AUTH check function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T03:07:05.000Z
CVE-2019-19601 
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T12:52:34.000Z
CVE-2019-19602 
fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T13:21:28.000Z
CVE-2019-19603 
SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T18:44:06.000Z
CVE-2019-19604 
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-10T23:33:06.000Z
CVE-2019-19605 
X-Plane before 11.41 allows Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-30T21:33:54.000Z
CVE-2019-19606 
X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to a remote system) via crafted network packets. This could be used to execute arbitrary commands on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-30T21:31:32.000Z
CVE-2019-19607 
A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the session parameter. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T17:55:30.000Z
CVE-2019-19608 
A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the registeredList.cgi page. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T17:56:07.000Z
CVE-2019-19609 
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T19:44:28.000Z
CVE-2019-19610 
An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T20:16:26.000Z
CVE-2019-19611 
An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the session cookie for each user. Fixed in Release 10.24.11206.1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T18:54:28.000Z
CVE-2019-19612 
An issue was discovered in Halvotec RaQuest 10.23.10801.0. Several features of the application allow stored Cross-site Scripting (XSS). Fixed in Release 24.2020.20608.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T20:18:52.000Z
CVE-2019-19613 
An issue was discovered in Halvotec RaQuest 10.23.10801.0. The login page of the admin application is vulnerable to an Open Redirect attack allowing an attacker to redirect a user to a malicious site after authentication. The attacker needs to be on the same network to modify the victim's request on the wire. Fixed in Release 24.2020.20608.0
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T20:21:39.000Z
CVE-2019-19614 
An issue was discovered in Halvotec RAQuest 10.23.10801.0. The login page is vulnerable to wildcard injection, allowing an attacker to enumerate the list of users sharing an identical password. Fixed in Release 10.24.11206.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T18:51:19.000Z
CVE-2019-19615 
Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link, the XSS payload will render and execute in the context of the victim user's account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T20:27:42.000Z
CVE-2019-19616 
An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T02:06:33.000Z
CVE-2019-19617 
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T02:45:14.000Z
CVE-2019-19619 
domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T03:28:46.000Z
CVE-2019-19620 
In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions from a file. This is limited in scope to the collection of process-execution telemetry, for executions against specific files where the SYSTEM user was denied access to the source file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T15:59:14.000Z
CVE-2019-19624 
An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T14:26:56.000Z
CVE-2019-19625 
SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2) leaks node information due to a leaky default configuration as indicated in the policy/defaults/dds/governance.xml document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T15:09:54.000Z
CVE-2019-19627 
SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps_protection_kind configuration. (SROS2 provides the tools to generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-06T15:09:34.000Z
CVE-2019-19628 
In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-05T21:51:51.000Z
CVE-2019-19629 
In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by the Elasticsearch integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-05T21:54:30.000Z
CVE-2019-19630 
HTMLDOC 1.9.7 allows a stack-based buffer overflow in the hd_strlcpy() function in string.c (when called from render_contents in ps-pdf.cxx) via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-08T01:57:28.000Z
CVE-2019-19631 
An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5, 4.7 through 4.7.7, 5.0 through 5.0.1, and 5.1 through 5.1.4; and Multi-Cloud Director through 1.1.0. A read-only user can access sensitive information via an API endpoint that reveals session cookies of authenticated administrators, leading to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T15:15:39.000Z
CVE-2019-19632 
An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5, 4.7 through 4.7.7, 5.0 through 5.0.1, and 5.1 through 5.1.4; and Multi-Cloud Director through 1.1.0. An unauthenticated attacker may inject stored arbitrary JavaScript (XSS), and execute it in the content of authenticated administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-24T14:58:06.000Z
CVE-2019-19634 
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-17T17:11:29.000Z
CVE-2019-19635 
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-08T03:00:23.000Z
CVE-2019-19636 
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-08T03:00:53.000Z
CVE-2019-19637 
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-08T03:00:44.000Z
CVE-2019-19638 
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-08T03:00:34.000Z
CVE-2019-19642 
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareName. The attacker can achieve a persistent backdoor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-08T03:39:13.000Z
CVE-2019-19643 
ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-14T14:02:11.000Z
CVE-2019-19645 
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T15:15:57.000Z
CVE-2019-19646 
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T18:36:18.000Z
CVE-2019-19647 
radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T00:36:32.000Z
CVE-2019-19648 
In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can cause an out-of-bounds memory access, resulting in Denial of Service (application crash) or potential code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T00:37:00.000Z
CVE-2019-19649 
Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T17:57:41.000Z
CVE-2019-19650 
Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-11T17:40:20.000Z
CVE-2019-19659 
A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a user account by changing the password, update users' details, and escalate privileges via RAPR/DefineUsersSet.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T15:48:55.000Z