rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-3836 
It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.
Problem types: cwe_id: CWE-456
description: CWE-456
Affected products: vendor: gnutls
product: gnutls
Published: 2019-04-01T14:16:51.000Z
CVE-2019-3837 
It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.
Problem types: cwe_id: CWE-362
description: CWE-362
Affected products: vendor: The Linux Foundation
product: kernel
Published: 2019-04-11T14:37:26.000Z
CVE-2019-3838 
It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Problem types: cwe_id: CWE-648
description: CWE-648
Affected products: vendor: The ghostscript Project
product: ghostscript
Published: 2019-03-25T18:30:25.000Z
CVE-2019-3839 
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.
Problem types: cwe_id: CWE-648
description: CWE-648
Affected products: vendor: The ghostscript Project
product: ghostscript
Published: 2019-05-16T18:31:08.000Z
CVE-2019-3840 
A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: The libvirt Project
product: libvirt
Published: 2019-03-27T12:24:10.000Z
CVE-2019-3841 
Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible undetected tampering of trusted container image content.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: The Kubevirt project
product: kubevirt/virt-cdi-importer
Published: 2019-03-25T17:03:28.000Z
CVE-2019-3842 
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: The systemd Project
product: systemd
Published: 2019-04-09T20:25:01.000Z
CVE-2019-3843 
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.
Problem types: cwe_id: CWE-266
description: CWE-266
Affected products: vendor: [freedesktop.org]
product: systemd
Published: 2019-04-26T20:27:30.000Z
CVE-2019-3844 
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.
Problem types: cwe_id: CWE-268
description: CWE-268
Affected products: vendor: [freedesktop.org]
product: systemd
Published: 2019-04-26T20:26:53.000Z
CVE-2019-3845 
A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Red Hat
product: qpid-dispatch-router
Published: 2019-04-11T14:31:40.000Z
CVE-2019-3846 
A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: n/a
product: kernel
Published: 2019-06-03T18:25:57.000Z
CVE-2019-3847 
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: [UNKNOWN]
product: Moodle
Published: 2019-03-27T00:00:00.000Z
CVE-2019-3848 
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: [UNKNOWN]
product: moodle
Published: 2019-03-26T00:00:00.000Z
CVE-2019-3849 
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: [UNKNOWN]
product: moodle
Published: 2019-03-26T17:46:47.000Z
CVE-2019-3850 
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits.
Problem types: description: n/a
Affected products: vendor: [UNKNOWN]
product: moodle
Published: 2019-03-26T17:46:54.000Z
CVE-2019-3851 
A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page.
Problem types: description: n/a
Affected products: vendor: [UNKNOWN]
product: moodle
Published: 2019-03-26T17:46:59.000Z
CVE-2019-3852 
A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing into account when checking user capabilities
Problem types: description: n/a
Affected products: vendor: [UNKNOWN]
product: moodle
Published: 2019-03-26T17:47:06.000Z
CVE-2019-3855 
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
Problem types: cwe_id: CWE-190
description: CWE-190
cwe_id: CWE-787
description: CWE-787
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-21T20:13:25.000Z
CVE-2019-3856 
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
Problem types: cwe_id: CWE-190
description: CWE-190
cwe_id: CWE-787
description: CWE-787
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-25T18:31:03.000Z
CVE-2019-3857 
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
Problem types: cwe_id: CWE-190
description: CWE-190
cwe_id: CWE-787
description: CWE-787
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-25T18:30:56.000Z
CVE-2019-3858 
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-21T20:22:47.000Z
CVE-2019-3859 
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-20T21:18:13.000Z
CVE-2019-3860 
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-25T18:30:50.000Z
CVE-2019-3861 
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-25T18:30:43.000Z
CVE-2019-3862 
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Problem types: cwe_id: CWE-130
description: CWE-130
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-20T21:39:52.000Z
CVE-2019-3863 
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
Problem types: cwe_id: CWE-190
description: CWE-190
cwe_id: CWE-787
description: CWE-787
Affected products: vendor: The libssh2 Project
product: libssh2
Published: 2019-03-25T17:52:10.000Z
CVE-2019-3864 
A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Red Hat
product: quay
Published: 2020-01-21T15:44:00.000Z
CVE-2019-3865 
A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: [UNKNOWN]
product: quay
Published: 2020-06-22T17:51:19.000Z
CVE-2019-3866 
An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: [UNKNOWN]
product: openstack-mistral
Published: 2019-11-08T14:45:58.000Z
CVE-2019-3867 
A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.
Problem types: cwe_id: CWE-613
description: CWE-613
Affected products: vendor: n/a
product: quay
Published: 2021-03-18T18:04:18.000Z
CVE-2019-3868 
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Red Hat
product: keycloak
Published: 2019-04-24T15:21:50.000Z
CVE-2019-3869 
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
Problem types: cwe_id: CWE-214
description: CWE-214
Affected products: vendor: Red Hat
product: Tower
Published: 2019-03-28T13:04:59.000Z
CVE-2019-3870 
A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: The Samba Project
product: samba
Published: 2019-04-09T15:17:43.000Z
CVE-2019-3871 
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: The PowerDNS Project
product: pdns
Published: 2019-03-21T20:42:35.000Z
CVE-2019-3872 
It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Red Hat
product: picketlink
Published: 2019-06-12T13:45:56.000Z
CVE-2019-3873 
It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Red Hat
product: picketlink
Published: 2019-06-12T13:43:46.000Z
CVE-2019-3874 
The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: The Linux Foundation
product: kernel
Published: 2019-03-25T18:30:37.000Z
CVE-2019-3875 
A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
Problem types: cwe_id: CWE-345
description: CWE-345
cwe_id: CWE-295
description: CWE-295
Affected products: vendor: Red Hat
product: keycloak
Published: 2019-06-12T13:51:38.000Z
CVE-2019-3876 
A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Red Hat
product: web-console
Published: 2019-04-01T14:15:42.000Z
CVE-2019-3877 
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: uninett
product: mod_auth_mellon
Published: 2019-03-27T12:19:19.000Z
CVE-2019-3878 
A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
Problem types: cwe_id: CWE-305
description: CWE-305
Affected products: vendor: uninett
product: mod_auth_mellon
Published: 2019-03-26T17:44:29.000Z
CVE-2019-3879 
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: unspecified
product: ovirt-engine
Published: 2019-03-25T18:30:17.000Z
CVE-2019-3880 
A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: The Samba Project
product: samba
Published: 2019-04-09T15:18:08.000Z
CVE-2019-3881 
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: n/a
product: rubygem-bundler
Published: 2020-09-04T00:00:00.000Z
CVE-2019-3882 
A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: The Linux Foundation
product: kernel
Published: 2019-04-24T15:23:10.000Z
CVE-2019-3883 
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.
Problem types: cwe_id: CWE-772
description: CWE-772
Affected products: vendor: Red Hat
product: 389-ds-base
Published: 2019-04-17T00:00:00.000Z
CVE-2019-3884 
A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects. Versions 3.6, 3.7, 3.8, 3.9, 3.10, 3.11 and 4.1 are affected.
Problem types: cwe_id: CWE-290
description: CWE-290
Affected products: vendor: Red Hat
product: atomic-openshift
Published: 2019-08-01T13:20:50.000Z
CVE-2019-3885 
A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: ClusterLabs
product: pacemaker
Published: 2019-04-18T00:00:00.000Z
CVE-2019-3886 
An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: The libvirt Project
product: libvirt
Published: 2019-04-04T00:00:00.000Z
CVE-2019-3887 
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: The Linux Foundation
product: Kernel
Published: 2019-04-09T00:00:00.000Z