rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-6034 
a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows arbitrary scripts to be executed in the context of the application due to unspecified vectors.
Problem types: description: Script injection
Affected products: vendor: appleple inc.
product: a-blog cms
Published: 2019-12-26T15:16:50.000Z
CVE-2019-6035 
Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
Problem types: description: Open Redirect
Affected products: vendor: Verison Media
product: Athenz
Published: 2019-12-26T15:16:50.000Z
CVE-2019-6036 
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: ThinkingReed inc.
product: F-RevoCRM
Published: 2020-01-27T09:35:26.000Z
CVE-2019-6109 
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-31T00:00:00.000Z
CVE-2019-6110 
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-31T00:00:00.000Z
CVE-2019-6111 
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-31T00:00:00.000Z
CVE-2019-6112 
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-14T13:42:24.000Z
CVE-2019-6113 
Directory traversal vulnerability on ONKYO TX-NR686 1030-5000-1040-0010 A/V Receiver devices allows remote attackers to read arbitrary files via a .. (dot dot) and %2f to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T21:13:30.000Z
CVE-2019-6114 
An issue was discovered in Corel PaintShop Pro 2019 21.0.0.119. An integer overflow in the jp2 parsing library allows an attacker to overwrite memory and to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-19T15:56:24.000Z
CVE-2019-6116 
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-19T18:27:21.000Z
CVE-2019-6117 
The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T17:51:25.000Z
CVE-2019-6120 
An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 (Username Enumeration) an adversary can enumerate a large number of valid users' Email addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T17:12:05.000Z
CVE-2019-6121 
An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as his recent payments, unclaimed Balance, Old Balance (at the time of December 2017 breach) , Projected payout, Mining stats like profitability, Efficiency, Number of workers, etc.. A valid Email address is required in order to retrieve this Information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T17:17:03.000Z
CVE-2019-6122 
A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T17:19:01.000Z
CVE-2019-6126 
The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T05:00:00.000Z
CVE-2019-6127 
An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table[] SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T05:00:00.000Z
CVE-2019-6128 
The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T05:00:00.000Z
CVE-2019-6129 
png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T05:00:00.000Z
CVE-2019-6130 
Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. This is related to page-number mishandling in cbz/mucbz.c, cbz/muimg.c, and svg/svg-doc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T05:00:00.000Z
CVE-2019-6131 
svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as demonstrated by mutool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T05:00:00.000Z
CVE-2019-6132 
An issue was discovered in Bento4 v1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp when called from the AP4_EsdsAtom class in Core/Ap4EsdsAtom.cpp, as demonstrated by mp42aac.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T05:00:00.000Z
CVE-2019-6133 
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T14:00:00.000Z
CVE-2019-6135 
An issue has been found in libIEC61850 v1.3.1. Memory_malloc in hal/memory/lib_memory.c has a memory leak when called from Asn1PrimitiveValue_create in mms/asn1/asn1_ber_primitive_value.c, as demonstrated by goose_publisher_example.c and iec61850_9_2_LE_example.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T17:00:00.000Z
CVE-2019-6136 
An issue has been found in libIEC61850 v1.3.1. Ethernet_setProtocolFilter in hal/ethernet/linux/ethernet_linux.c has a SEGV, as demonstrated by sv_subscriber_example.c and sv_subscriber.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T17:00:00.000Z
CVE-2019-6137 
An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T17:00:00.000Z
CVE-2019-6138 
An issue has been found in libIEC61850 v1.3.1. Memory_malloc and Memory_calloc in hal/memory/lib_memory.c have memory leaks when called from mms/iso_mms/common/mms_value.c, server/mms_mapping/mms_mapping.c, and server/mms_mapping/mms_sv.c (via common/string_utilities.c), as demonstrated by iec61850_9_2_LE_example.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T17:00:00.000Z
CVE-2019-6139 
Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnerability may lead to remote code execution. To fix this vulnerability, upgrade to FUID version 1.3 or higher. To prevent the vulnerability on FUID versions 1.2 and below, apply local firewall rules on the FUID server to disable all external access to port TCP/5001. FUID requires this port only for local connections through the loopback interface.
Problem types: description: Remote Code Execution
Affected products: vendor: Forcepoint .
product: Forcepoint User ID (FUID) server
Published: 2019-02-07T23:00:00.000Z
CVE-2019-6140 
A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration process is not completed.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Forcepoint
product: Forcepoint Email Security
Published: 2019-04-09T20:51:32.000Z
CVE-2019-6142 
It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix in order to remediate this issue.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Forcepoint
product: Forcepoint Email Security
Published: 2019-11-05T20:49:15.000Z
CVE-2019-6143 
Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The vulnerability affects the following NGFW features when the LDAP authentication method is used as the backend authentication: IPsec VPN, SSL VPN or Browser-based user authentication. The vulnerability does not apply when any other backend authentication is used. The RADIUS authentication method is not vulnerable, for example.
Problem types: description: Authentication Bypass
Affected products: vendor: Forcepoint
product: Forcepoint Next Generation Firewall
Published: 2019-08-20T20:24:21.000Z
CVE-2019-6144 
This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: n/a
product: Forcepoint One Endpoint
Published: 2019-10-23T18:57:51.000Z
CVE-2019-6145 
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs for finding this vulnerability and for reporting it to us.
Problem types: description: Unquoted search path vulnerability
Affected products: vendor: Forcepoint
product: Forcepoint VPN Client for Windows
Published: 2019-09-20T19:56:34.000Z
CVE-2019-6146 
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Forcepoint Web Security
Published: 2020-01-22T16:10:21.000Z
CVE-2019-6147 
Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can corrupt the internal configuration database. When the database is corrupted, the SMC might produce an incorrect IPsec configuration for the Forcepoint Next Generation Firewall (NGFW), possibly resulting in settings that are weaker than expected. All SMC versions lower than 6.5.12 or 6.7.1 are vulnerable.
Problem types: description: Rare internal database corruption can lead to incorrect IPSec configuration
Affected products: vendor: Forcepoint
product: NGFW Security Management Center
Published: 2019-12-23T19:17:18.000Z
CVE-2019-6149 
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
Affected products: vendor: unspecified
product: unspecified
default_status: unknown
Published: 2019-03-15T22:00:00.000Z
CVE-2019-6154 
A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.
Problem types: description: Code execution
Affected products: vendor: Lenovo
product: Lenovo Bootable Generator
Credits: lang: en
value: Lenovo thanks SaifAllah benMassaoud & Oussama Sahnoun and Mustapha Mhenaoui for reporting this issue.
Published: 2019-04-10T17:04:19.857Z
CVE-2019-6155 
A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM BladeCenter systems that could lead to denial of service.
Problem types: description: Denial of service
Affected products: vendor: IBM
product: System x BIOS
vendor: IBM
product: BladeCenter BIOS
Published: 2019-04-22T15:21:29.643Z
CVE-2019-6156 
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
Problem types: description: None
Affected products: vendor: Lenovo
product: BIOS
Credits: lang: en
value: Lenovo would like to thank Emin Ghuliev for reporting this issue.
Published: 2019-04-10T17:04:19.908Z
CVE-2019-6157 
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.
Problem types: description: Information disclosure
Affected products: vendor: Lenovo
product: System x
Published: 2019-04-22T15:21:29.692Z
CVE-2019-6158 
An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x.
Problem types: description: Information disclosure
Affected products: vendor: Lenovo
product: Lenovo XClarity Administrator
Published: 2019-05-03T19:27:27.963Z
CVE-2019-6159 
A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Controller (BMC). This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM log which may then be executed in the user's web browser when IMM log records containing the JavaScript code are viewed. The JavaScript code is not executed on IMM itself. The later IMM2 (IMM v2) is not affected.
Problem types: description: code execution
Affected products: vendor: IBM
product: legacy System x IMM (IMM v1) firmware
Credits: lang: en
value: Lenovo thanks Christopher Arnold for reporting this issue.
Published: 2019-08-19T14:56:44.914Z
CVE-2019-6160 
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.
Problem types: description: Information disclosure
Affected products: vendor: Iomega and LenovoEMC
product: NAS products
Credits: lang: en
value: Lenovo would like to thank WhiteHat Security and Vertical Structure for reporting this issue.
Published: 2019-07-16T18:53:10.650Z
CVE-2019-6161 
An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware versions prior to 1908.M. This vulnerability allows session IDs to be reused, which could provide unauthorized access to the BMC under certain circumstances. This vulnerability does not affect ThinkSystem XCC, System x IMM2, or other BMCs.
Problem types: description: unauthorized access
Affected products: vendor: Lenovo
product: ThinkAgile CP-SB
Published: 2019-09-26T15:22:15.136Z
CVE-2019-6163 
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations.
Problem types: description: privilege escalation
Affected products: vendor: Lenovo
product: System Update
Credits: lang: en
value: Lenovo would like to thank Eran Shimony at CyberArk Labs for reporting this issue.
Published: 2019-06-26T14:12:34.696Z
CVE-2019-6165 
A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: PaperDisplay Hotkey Service
Credits: lang: en
value: Lenovo would like to thank Michael Bourque for reporting this issue.
Published: 2019-08-19T14:56:44.995Z
CVE-2019-6166 
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery.
Problem types: description: cross-site request forgery
Affected products: vendor: Lenovo
product: Service Bridge
Credits: lang: en
value: Lenovo would like to thank Bill Demirkapi for reporting this issue.
Published: 2019-06-26T14:12:34.747Z
CVE-2019-6167 
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.
Problem types: description: remote code execution
Affected products: vendor: Lenovo
product: Service Bridge
Credits: lang: en
value: Lenovo would like to thank Bill Demirkapi for reporting this issue.
Published: 2019-06-26T14:12:34.783Z
CVE-2019-6168 
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.
Problem types: description: remote code execution
Affected products: vendor: Lenovo
product: Service Bridge
Credits: lang: en
value: Lenovo would like to thank Bill Demirkapi for reporting this issue.
Published: 2019-06-26T14:12:34.822Z
CVE-2019-6169 
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP.
Problem types: description: unencrypted downloads over FTP
Affected products: vendor: Lenovo
product: Service Bridge
Credits: lang: en
value: Lenovo would like to thank Bill Demirkapi for reporting this issue.
Published: 2019-06-26T14:12:34.865Z
CVE-2019-6170 
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow arbitrary code execution.
Problem types: description: Arbitrary code execution
Affected products: vendor: Lenovo
product: ThinkPad
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2019-11-12T20:40:53.000Z
CVE-2019-6171 
A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the ability to update the Embedded Controller with unsigned firmware.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo
product: BIOS
Credits: lang: en
value: Lenovo would like to thank Alex Matrosov and Alexandre Gazet for reporting this issue.
Published: 2019-08-19T14:56:45.041Z
CVE-2019-6172 
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution.
Problem types: description: Arbitrary code execution
Affected products: vendor: Lenovo
product: ThinkPad
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2019-11-12T20:40:53.000Z
CVE-2019-6173 
A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during installation if an attacker already has administrative privileges.
Problem types: cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Lenovo
product: Installation Packages
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Eran Shimony at CyberArk Labs for reporting this issue
Published: 2020-06-09T19:50:34.062Z
CVE-2019-6175 System Update Vulnerability
A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-standard locations.
Problem types: description: Denial of service
Affected products: vendor: Lenovo
product: System Update
Credits: lang: en
value: Lenovo would like to thank Eran Shimony at CyberArk Labs for reporting this issue.
Published: 2019-09-26T15:22:15.000Z
CVE-2019-6176 
A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.
Problem types: description: local privilege escalation
Affected products: vendor: Lenovo
product: ThinkPad USB-C Dock Firmware
Published: 2019-11-20T01:31:12.617Z