rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-6753 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.3.0.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Stuff method. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7561.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Anonymous
Published: 2019-06-03T18:15:01.000Z
CVE-2019-6754 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the localFileStorage method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7407.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Steven Seeley (mr_me) of Source Incite
Published: 2019-06-03T18:15:01.000Z
CVE-2019-6755 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7613.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Hao Li from ADLab of VenusTech
Published: 2019-06-03T18:15:01.000Z
CVE-2019-6756 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF 9.4.0.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HTML files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7769.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PhantomPDF
Credits: lang: en
value: Mat Powell of Trend Micro Zero Day Initiative
Published: 2019-06-03T18:15:01.000Z
CVE-2019-6757 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7696.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Hao Li from ADLab of VenusTech
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6758 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7701.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Hao Li from ADLab of VenusTech
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6759 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7614.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Hao Li from ADLab of VenusTech
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6760 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7694.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Hao Li from ADLab of VenusTech
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6761 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.0.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA CXFA_FFDocView object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7777.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: juggernaut
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6762 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7844.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PhantomPDF
Credits: lang: en
value: kdot
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6763 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ToggleFormsDesign method of the Foxit.FoxitReader.Ctl ActiveX object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7874.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: @j00sean (https://twitter.com/j00sean)
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6764 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA Template objects. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7972.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: hungtt28 of Viettel Cyber Security
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6765 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8170.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Foxit
product: PhantomPDF
Credits: lang: en
value: RockStar
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6766 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8162.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: hemidallt
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6767 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8163.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: hemidallt
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6768 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8164.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: hemidallt
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6769 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8165.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: hemidallt
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6770 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the resetForm method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8229.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: hemidallt
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6771 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 2019.010.20098. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the value property of a Field object within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8230.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: hemidallt
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6772 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 2019.010.20098. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8231.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: hemidallt
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6773 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the richValue property of a Field object within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8272.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Anonymous
Published: 2019-06-03T18:15:02.000Z
CVE-2019-6774 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the deleteItemAt method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8295.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: Anonymous
Published: 2019-10-04T17:37:02.000Z
CVE-2019-6775 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportValues method within a AcroForm. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8491.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Reader
Credits: lang: en
value: banananapenguin
Published: 2019-10-04T17:37:02.000Z
CVE-2019-6776 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing watermarks within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8801.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PhantomPDF
Credits: lang: en
value: Mat Powell of Trend Micro Zero Day Initiative
Published: 2019-10-04T17:37:02.000Z
CVE-2019-6777 
An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-24T15:00:00.000Z
CVE-2019-6778 
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T18:00:46.000Z
CVE-2019-6779 
Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-24T19:00:00.000Z
CVE-2019-6780 
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-24T20:00:00.000Z
CVE-2019-6781 
An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T15:42:39.000Z
CVE-2019-6782 
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 1 of 6). An authorization issue allows the contributed project information of a private profile to be viewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T19:17:09.000Z
CVE-2019-6783 
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T19:19:45.000Z
CVE-2019-6784 
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T19:21:45.000Z
CVE-2019-6785 
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Denial of Service. Inputting an overly long string into a Markdown field could cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T19:26:05.000Z
CVE-2019-6786 
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 1 of 3). The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T19:28:06.000Z
CVE-2019-6787 
An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitLab API allowed project Maintainers and Owners to view the trigger tokens of other project users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T15:49:11.000Z
CVE-2019-6788 
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 3 of 6). For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the user OAuth token for those services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T19:30:25.000Z
CVE-2019-6789 
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 4 of 6). In some cases, users without project permissions will receive emails after a project move. For private projects, this will disclose the new project namespace to an unauthorized user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T19:32:53.000Z
CVE-2019-6790 
An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T15:53:27.000Z