rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-3787 UAA defaults email address to an insecure domain
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.
Problem types: cwe_id: CWE-840
description: CWE-840: Business Logic Errors
Affected products: vendor: Cloud Foundry
product: UAA Release (OSS)
Published: 2019-06-19T22:28:07.316Z
CVE-2019-3788 UAA redirect-uri allows wildcard in the subdomain
Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim.
Problem types: cwe_id: CWE-601
description: CWE-601: Open Redirect
Affected products: vendor: Cloud Foundry
product: UAA Release (OSS)
vendor: Pivotal
product: Pivotal Application Service
Published: 2019-04-25T20:17:37.233Z
CVE-2019-3789 Gorouter allows space developer to hijack route services hosted outside the platform
Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.
Problem types: cwe_id: CWE-840
description: CWE-840: Business Logic Errors
Affected products: vendor: Cloud Foundry
product: CF Routing
Published: 2019-04-24T15:21:10.443Z
CVE-2019-3790 Ops Manager uaa client issues tokens after refresh token expiration
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.
Problem types: cwe_id: CWE-324
description: CWE-324: Use of a Key Past its Expiration Date
Affected products: vendor: Pivotal
product: Pivotal Ops Manager
Published: 2019-06-06T19:16:16.854Z
CVE-2019-3792 Concourse 5.0.0 SQL Injection vulnerability
Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.
Problem types: cwe_id: CWE-89
description: CWE-89: SQL Injection
Affected products: vendor: Pivotal
product: Concourse
Published: 2019-04-01T20:54:47.233Z
CVE-2019-3793 Invitations Service supports HTTP connections
Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests.
Problem types: cwe_id: CWE-300
description: CWE-300: Man-in-the-Middle
Affected products: vendor: Pivotal
product: Apps Manager
Published: 2019-04-24T15:21:10.482Z
CVE-2019-3794 UAA - Login app subject to clickjacking attack
Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control - Generic
Affected products: vendor: Cloud Foundry
product: UAA Release (OSS)
Published: 2019-07-18T15:47:00.225Z
CVE-2019-3795 Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
Problem types: cwe_id: CWE-330
description: CWE-330: Use of Insufficiently Random Values
Affected products: vendor: Spring
product: Spring Security
Published: 2019-04-09T15:29:02.127Z
CVE-2019-3797 Additional information exposure with Spring Data JPA derived queries
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Problem types: cwe_id: CWE-89
description: CWE-89: SQL Injection
Affected products: vendor: Spring
product: Spring Boot
Published: 2019-05-06T15:21:37.081Z
CVE-2019-3798 Escalation of Privileges in Cloud Controller
Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication - Generic
Affected products: vendor: Cloud Foundry
product: CAPI-release
Published: 2019-04-17T13:32:35.609Z
CVE-2019-3799 Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Problem types: cwe_id: CWE-22
description: CWE-22: Path Traversal
Affected products: vendor: Spring
product: Spring Cloud Config
Published: 2019-05-06T15:21:37.135Z
CVE-2019-3800 CF CLI  writes the client id and secret to config file
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Cloud Foundry
product: CF CLI Release
vendor: Cloud Foundry
product: CF CLI
Published: 2019-08-05T16:38:20.424Z
CVE-2019-3801 Java Projects using HTTP to fetch dependencies
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.
Problem types: cwe_id: CWE-494
description: CWE-494: Download of Code Without Integrity Check
Affected products: vendor: Cloud Foundry
product: CredHub
vendor: Cloud Foundry
product: UAA Release (OSS)
vendor: Cloud Foundry
product: cf-deployment
vendor: Pivotal
product: UAA Release (LTS)
Published: 2019-04-25T20:17:37.272Z
CVE-2019-3802 Additional information exposure with Spring Data JPA example matcher
This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.
Problem types: cwe_id: CWE-155
description: CWE-155: Improper Neutralization of Wildcards or Matching Symbols
Affected products: vendor: Spring
product: Spring Data JPA
Published: 2019-06-03T13:47:42.791Z
CVE-2019-3803 Concourse includes token in CLI authentication callback
Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: Pivotal
product: Concourse
Published: 2019-01-12T01:00:00.000Z
CVE-2019-3804 
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.
Problem types: cwe_id: CWE-909
description: CWE-909
Affected products: vendor: [UNKNOWN]
product: cockpit
Published: 2019-03-26T00:00:00.000Z
CVE-2019-3805 
A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.
Problem types: cwe_id: CWE-364
description: CWE-364
Affected products: vendor: Red Hat
product: wildfly
Published: 2019-05-03T19:25:28.000Z
CVE-2019-3806 
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: Power DNS
product: pdns-recursor
Published: 2019-01-29T17:00:00.000Z
CVE-2019-3807 
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.
Problem types: cwe_id: CWE-345
description: CWE-345
Affected products: vendor: Power DNS
product: pdns-recursor
Published: 2019-01-29T17:00:00.000Z
CVE-2019-3808 
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: [UNKNOWN]
product: moodle
Published: 2019-03-25T17:28:32.000Z
CVE-2019-3809 
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: [UNKNOWN]
product: moodle
Published: 2019-03-25T17:38:35.000Z
CVE-2019-3810 
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: [UNKNOWN]
product: moodle
Published: 2019-03-25T00:00:00.000Z
CVE-2019-3811 
A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
Problem types: cwe_id: CWE-552
description: CWE-552
cwe_id: CWE-200
description: CWE-200
Affected products: vendor: The sssd Project
product: sssd
Published: 2019-01-15T15:00:00.000Z
CVE-2019-3812 
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: The QEMU Project
product: qemu
Published: 2019-02-19T14:00:00.000Z
CVE-2019-3813 
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.
Problem types: description: Denial of Service
Affected products: vendor: Red Hat, Inc.
product: Spice
Published: 2019-02-04T18:00:00.000Z
CVE-2019-3814 
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: dovecot
product: dovecot
Published: 2019-03-27T12:20:45.000Z
CVE-2019-3815 
A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: The systemd Project
product: systemd
Published: 2019-01-28T15:00:00.000Z
CVE-2019-3816 
Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: [UNKNOWN]
product: openwsman
Published: 2019-03-14T00:00:00.000Z
CVE-2019-3817 
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: libcomps
product: libcomps
Published: 2019-03-27T12:25:40.000Z
CVE-2019-3818 
The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the encryption.
Problem types: cwe_id: CWE-327
description: CWE-327
Affected products: vendor: [UNKNOWN]
product: kube-rbac-proxy
Published: 2019-02-05T17:00:00.000Z
CVE-2019-3819 
A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.
Problem types: cwe_id: CWE-835
description: CWE-835
Affected products: vendor: The Linux Foundation
product: kernel:
Published: 2019-01-25T18:00:00.000Z
CVE-2019-3820 
It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: The Gnome Project
product: gnome-shell
Published: 2019-02-06T20:00:00.000Z
CVE-2019-3821 
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.
Problem types: cwe_id: CWE-772
description: CWE-772
Affected products: vendor: [UNKNOWN]
product: ceph
Published: 2019-03-27T12:22:00.000Z
CVE-2019-3822 
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: The curl Project
product: curl
Published: 2019-02-06T20:00:00.000Z
CVE-2019-3823 
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The curl Project
product: curl
Published: 2019-02-06T20:00:00.000Z
CVE-2019-3824 
A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T15:00:00.000Z
CVE-2019-3825 
A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: The Gnome Projectr
product: gdm
Published: 2019-02-06T20:00:00.000Z
CVE-2019-3826 
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: [UNKNOWN]
product: prometheus
Published: 2019-03-26T17:48:31.000Z
CVE-2019-3827 
An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: [UNKNOWN]
product: gvfs
Published: 2019-03-25T17:47:35.000Z
CVE-2019-3828 
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: Red Hat
product: Ansible
Published: 2019-03-27T00:00:00.000Z
CVE-2019-3829 
A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: gnutls
product: gnutls
Published: 2019-03-27T17:24:17.000Z
CVE-2019-3830 
A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.
Problem types: cwe_id: CWE-532
description: CWE-532
Affected products: vendor: [UNKNOWN]
product: openstack-ceilometer
Published: 2019-03-26T17:55:47.000Z
CVE-2019-3831 
A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could be abused to execute arbitrary commands as root.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: [UNKNOWN]
product: vdsm
Published: 2019-03-25T17:12:10.000Z
CVE-2019-3832 
It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of a buffer in wav_write_header() function in wav.c. A local attacker may use this flaw to make the application crash.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: [UNKNOWN]
product: libsndfile
Published: 2019-03-20T20:00:27.000Z
CVE-2019-3833 
Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.
Problem types: cwe_id: CWE-835
description: CWE-835
Affected products: vendor: [UNKNOWN]
product: openwsman
Published: 2019-03-14T22:00:00.000Z
CVE-2019-3834 
It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.
Problem types: cwe_id: CWE-470
description: CWE-470
Affected products: vendor: RedHat
product: struts
Published: 2019-10-03T13:31:06.000Z
CVE-2019-3835 
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Problem types: cwe_id: CWE-648
description: CWE-648
Affected products: vendor: The ghostscript Project
product: ghostscript
Published: 2019-03-25T18:30:31.000Z