rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-6842 
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the firmware with a missing web server image inside the package using FTP protocol.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: n/a
product: Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info)
Published: 2019-10-29T14:47:16.000Z
CVE-2019-6843 
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the controller with an empty firmware package using FTP protocol.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: n/a
product: Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info)
Published: 2019-10-29T14:48:04.000Z
CVE-2019-6844 
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service atack on the PLC when upgrading the controller with a firmware package containing an invalid web server image using FTP protocol.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: n/a
product: Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info)
Published: 2019-10-29T14:48:44.000Z
CVE-2019-6845 
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information when transferring applications to the controller using Modbus TCP protocol.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: n/a
product: Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions)
Published: 2019-10-29T14:49:49.000Z
CVE-2019-6846 
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause information disclosure when using the FTP protocol.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: n/a
product: Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions)
Published: 2019-10-29T14:51:31.000Z
CVE-2019-6847 
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the FTP service when upgrading the firmware with a version incompatible with the application in the controller using FTP protocol.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: n/a
product: Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notification for version info)
Published: 2019-10-29T14:52:24.000Z
CVE-2019-6848 
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BMENOC0321) (see notification for version info), which could cause a Denial of Service attack on the PLC when sending specific data on the REST API of the controller/communication module.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: n/a
product: Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BMENOC0321) (see notification for version info)
Published: 2019-10-29T14:53:10.000Z
CVE-2019-6849 
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: n/a
product: Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321
Published: 2019-10-29T14:53:44.000Z
CVE-2019-6850 
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when reading specific registers with the REST API of the controller/communication module.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: n/a
product: Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321
Published: 2019-10-29T14:54:39.000Z
CVE-2019-6851 
A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information from the controller when using TFTP protocol.
Problem types: cwe_id: CWE-538
description: CWE-538: File and Directory Information Exposure
Affected products: vendor: n/a
product: Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions)
Published: 2019-10-29T14:55:35.000Z
CVE-2019-6852 
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: Schneider Electric
product: Modicon Controllers (M340 CPUs, M340 communication modules,  Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
Published: 2019-11-20T22:01:49.000Z
CVE-2019-6853 
A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702) , which could enable a successful Cross-site Scripting (XSS attack) when using the products web server.
Problem types: cwe_id: CWE-79
description: CWE-79: Failure to Preserve Web Page Structure
Affected products: vendor: Schneider Electric
product: Andover Continuum models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702
Published: 2019-11-20T22:01:18.000Z
CVE-2019-6854 
A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 2019- which could cause a low privilege user to delete or modify database, setting or certificate files. Those users must have access to the file system of that operating system to exploit this vulnerability. Affected versions in current support includes ClearSCADA 2017 R3, ClearSCADA 2017 R2, and ClearSCADA 2017.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: n/a
product: EcoStruxure Geo SCADA Expert (ClearSCADA) with initial releases before 1 January 2019 (see notification for more details)
Published: 2020-01-06T22:56:53.000Z
CVE-2019-6855 
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: n/a
product: EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10)
Published: 2020-01-06T22:56:58.000Z
CVE-2019-6856 
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service when writing specific physical memory blocks using Modbus TCP.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Schneider Electric SE
product: Modicon M580, Modicon M340, Modicon Quantum,  Modicon Premium (see security notification for specific versions)
Published: 2020-01-06T22:57:02.000Z
CVE-2019-6857 
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service of the controller when reading specific memory blocks using Modbus TCP.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Schneider Electric SE
product: Modicon M580, Modicon M340, Modicon Quantum,  Modicon Premium (see security notification for specific versions)
Published: 2020-01-06T22:57:05.000Z
CVE-2019-6858 
A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause privilege escalation when injecting a malicious DLL.
Problem types: cwe_id: CWE-427
description: CWE-427:Uncontrolled Search Path Element
Affected products: vendor: n/a
product: MSX Configurator (Software Version prior to V1.0.8.1)
Published: 2020-01-22T13:59:17.000Z
CVE-2019-6859 
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hardcoded Credentials
Affected products: vendor: n/a
product: Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications)
Published: 2020-04-22T18:14:28.000Z
CVE-2019-6956 
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-25T16:00:00.000Z
CVE-2019-6957 Buffer Overflow for Bosch Video Systems, PSIM and Access Control Systems
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video Recording Manager (VRM), Video Streaming Gateway (VSG), Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The vulnerability potentially allows the unauthorized execution of code in the system via the network interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T18:55:20.387Z
CVE-2019-6958 Improper Access Control for Bosch Video Systems, PSIM and Access Control Systems
A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Configuration Manager, Building Integration System (BIS) with Video Engine, Access Professional Edition (APE), Access Easy Controller (AEC), Bosch Video Client (BVC) and Video SDK (VSDK). The RCP+ network port allows access without authentication. Adding authentication feature to the respective library fixes the issue. The issue is classified as "CWE-284: Improper Access Control." This vulnerability, for example, allows a potential attacker to delete video or read video data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T18:47:37.354Z
CVE-2019-6960 
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T19:52:48.000Z
CVE-2019-6961 
Incorrect access control in actionHandlerUtility.php in the RDK RDKB-20181217-1 WebUI module allows a logged in user to control DDNS, QoS, RIP, and other privileged configurations (intended only for the network operator) by sending an HTTP POST to the PHP backend, because the page filtering for non-superuser (in header.php) is done only for GET requests and not for direct AJAX calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T13:43:44.000Z
CVE-2019-6962 
A shell injection issue in cosa_wifi_apis.c in the RDK RDKB-20181217-1 CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell commands under the CcspWifiSsp process (running as root) if the platform was compiled with the ENABLE_FEATURE_MESHWIFI macro. The attack is conducted by changing the Wi-Fi network password to include crafted escape characters. This is related to the WebUI module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T13:45:51.000Z
CVE-2019-6963 
A heap-based buffer overflow in cosa_dhcpv4_dml.c in the RDK RDKB-20181217-1 CcspPandM module may allow attackers with login credentials to achieve remote code execution by crafting a long buffer in the "Comment" field of an IP reservation form in the admin panel. This is related to the CcspCommonLibrary module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T13:47:40.000Z
CVE-2019-6964 
A heap-based buffer over-read in Service_SetParamStringValue in cosa_x_cisco_com_ddns_dml.c of the RDK RDKB-20181217-1 CcspPandM module may allow attackers with login credentials to achieve information disclosure and code execution by crafting an AJAX call responsible for DDNS configuration with an exactly 64-byte username, password, or domain, for which the buffer size is insufficient for the final '\0' character. This is related to the CcspCommonLibrary and WebUI modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-20T13:50:35.000Z
CVE-2019-6965 
An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T12:25:45.000Z
CVE-2019-6966 
An issue was discovered in Bento4 1.5.1-628. The AP4_ElstAtom class in Core/Ap4ElstAtom.cpp has an attempted excessive memory allocation related to AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h, as demonstrated by mp42hls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-25T23:00:00.000Z
CVE-2019-6967 
AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T18:02:36.000Z
CVE-2019-6968 
The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T20:50:46.000Z
CVE-2019-6969 
The web interface of the D-Link DVA-5592 20180823 is vulnerable to an authentication bypass that allows an unauthenticated user to have access to sensitive information such as the Wi-Fi password and the phone number (if VoIP is in use).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-02T20:53:05.000Z
CVE-2019-6970 
Moodle 3.5.x before 3.5.4 allows SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T20:28:37.000Z
CVE-2019-6971 
An issue was discovered on TP-Link TL-WR1043ND V2 devices. An attacker can send a cookie in an HTTP authentication packet to the router management web interface, and fully control the router without knowledge of the credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T14:05:03.000Z
CVE-2019-6972 
An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Rainbow Table attacks. Specifically, credentials in the "Authorization" cookie are encoded with URL encoding and base64, leading to easy decoding. Also, the username is cleartext, and the password is hashed with the MD5 algorithm (after decoding of the URL encoded string with base64).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T14:06:34.000Z
CVE-2019-6973 
Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server (based on gSOAP 2.8.x) is configured for an iterative queueing approach (aka non-threaded operation) with a timeout of several seconds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T18:12:13.000Z
CVE-2019-6974 
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-15T15:00:00.000Z
CVE-2019-6975 
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T13:00:00.000Z
CVE-2019-6976 
libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-26T23:00:00.000Z
CVE-2019-6977 
gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-27T02:00:00.000Z
CVE-2019-6978 
The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T07:00:00.000Z
CVE-2019-6979 
An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T08:00:00.000Z
CVE-2019-6980 
Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T21:10:00.000Z
CVE-2019-6981 
Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T21:14:38.000Z
CVE-2019-6982 
An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-of-Bounds Write and crash during the handling of certain PDF files that embed specifically crafted 3D content, because of the improper handling of a logic exception in the IFXASSERT function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T09:00:00.000Z
CVE-2019-6983 
An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Integer Overflow and crash during the handling of certain PDF files that embed specifically crafted 3D content, because of a free of valid memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T09:00:00.000Z
CVE-2019-6984 
An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter a Use-After-Free or Type Confusion and crash during handling of certain PDF files that embed specifically crafted 3D content, due to the use of a wild pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T09:00:00.000Z
CVE-2019-6985 
An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-of-Bounds Read in Indexing or a Heap Overflow and crash during handling of certain PDF files that embed specifically crafted 3D content, due to an array access violation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T09:00:00.000Z
CVE-2019-6986 
SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service (ReDoS), as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T15:00:00.000Z
CVE-2019-6988 
An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T16:00:00.000Z
CVE-2019-6989 
TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function. By sending specially crafted ICMP echo request packets, a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T17:24:50.000Z
CVE-2019-6990 
A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a crafted Zone NAME to the index.php?view=zones&action=zoneImage&mid=1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T20:00:00.000Z
CVE-2019-6991 
A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3, allowing an unauthenticated attacker to execute code via a long username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-28T20:00:00.000Z