rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-1897 
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence. This issue affects versions of proxygen prior to v2020.05.18.00.
Problem types: description: Use-after-free (CWE-ID 416)
Affected products: vendor: Facebook
product: proxygen
Published: 2020-05-18T21:30:14.000Z
CVE-2020-1898 
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
Problem types: cwe_id: CWE-674
description: Uncontrolled Recursion (CWE-674)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-03-11T00:55:18.000Z
CVE-2020-1899 
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
Problem types: cwe_id: CWE-822
description: Untrusted Pointer Dereference (CWE-822)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-03-11T00:55:19.000Z
CVE-2020-1900 
When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-03-11T00:55:20.000Z
CVE-2020-1901 
Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Facebook
product: WhatsApp for iOS
Published: 2020-10-06T17:35:24.000Z
CVE-2020-1902 
A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Facebook
product: WhatsApp for Android
vendor: Facebook
product: WhatsApp Business for Android
Published: 2020-10-06T17:35:25.000Z
CVE-2020-1903 
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Facebook
product: WhatsApp for iOS
vendor: Facebook
product: WhatsApp Business for iOS
Published: 2020-10-06T17:35:25.000Z
CVE-2020-1904 
A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx, xlsx, and pptx files as attachments to messages.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Facebook
product: WhatsApp for iOS
vendor: Facebook
product: WhatsApp Business for iOS
Published: 2020-10-06T17:35:26.000Z
CVE-2020-1905 
Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious third party app chosen to open the file to guess the URIs for previously opened attachments until the opener app is terminated.
Problem types: cwe_id: CWE-340
description: CWE-340: Generation of Predictable Numbers or Identifiers
Affected products: vendor: Facebook
product: WhatsApp for Android
Published: 2020-10-06T17:35:26.000Z
CVE-2020-1906 
A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when processing malformed local videos with E-AC-3 audio streams.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Facebook
product: WhatsApp for Android
vendor: Facebook
product: WhatsApp Business for Android
Published: 2020-10-06T17:35:26.000Z
CVE-2020-1907 
A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Facebook
product: WhatsApp for Android
vendor: Facebook
product: WhatsApp Business for Android
vendor: Facebook
product: WhatsApp for iOS
vendor: Facebook
product: WhatsApp Business for iOS
vendor: Facebook
product: WhatsApp for Portal
Published: 2020-10-06T17:35:27.000Z
CVE-2020-1908 
Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Facebook
product: WhatsApp Business for iOS
vendor: Facebook
product: WhatsApp for iOS
Published: 2020-11-03T19:15:16.000Z
CVE-2020-1909 
A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Facebook
product: WhatsApp Business for iOS
vendor: Facebook
product: WhatsApp for iOS
Published: 2020-11-03T19:15:17.000Z
CVE-2020-1910 
A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read and write if a user applied specific image filters to a specially crafted image and sent the resulting image.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: WhatsApp
product: WhatsApp Business for Android
vendor: WhatsApp
product: WhatsApp for Android
Published: 2021-02-02T19:55:13.000Z
CVE-2020-1911 
A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Problem types: cwe_id: CWE-843
description: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Facebook
product: Hermes
Published: 2020-09-04T02:35:20.000Z
CVE-2020-1912 
An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write, CWE-125: Out-of-bounds Read
Affected products: vendor: Facebook
product: Hermes
Published: 2020-09-09T18:50:17.000Z
CVE-2020-1913 
An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Problem types: cwe_id: CWE-195
description: CWE-195: Signed to Unsigned Conversion Error
Affected products: vendor: Facebook
product: Hermes
Published: 2020-09-09T19:00:19.000Z
CVE-2020-1914 
A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Problem types: cwe_id: CWE-670
description: CWE-670: Always-Incorrect Control Flow Implementation, CWE-1119: Excessive Use of Unconditional Branching
Affected products: vendor: Facebook
product: Hermes
Published: 2020-10-08T18:50:11.000Z
CVE-2020-1915 
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Facebook
product: Hermes
Published: 2020-10-26T20:20:13.000Z
CVE-2020-1916 
An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-03-10T15:50:27.000Z
CVE-2020-1917 
xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-03-10T15:50:28.000Z
CVE-2020-1918 
In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
Problem types: cwe_id: CWE-127
description: Buffer Under-read (CWE-127)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-03-10T15:50:28.000Z
CVE-2020-1919 
Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-03-10T15:50:29.000Z
CVE-2020-1920 
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
Problem types: cwe_id: CWE-1333
description: CWE-1333: Inefficient Regular Expression Complexity
Affected products: vendor: Facebook
product: react-native
Published: 2021-06-01T11:45:12.000Z
CVE-2020-1921 
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow (CWE-121)
Affected products: vendor: Facebook
product: HHVM
Published: 2021-03-10T15:50:30.000Z
CVE-2020-1925 
Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.
Problem types: description: Server Side Request Forgery
Affected products: vendor: Apache Software Foundation
product: Apache Olingo
Published: 2020-01-09T18:41:08.000Z
CVE-2020-1926 Timing attack in Cookie signature verification
Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
Problem types: cwe_id: CWE-208
description: CWE-208 Information Exposure Through Timing Discrepancy
Affected products: vendor: Apache Software Foundation
product: Apache Hive
Credits: lang: en
value: Apache Hive would like to thank S. Wasin for reporting this issue.
Published: 2021-03-16T13:00:16.000Z
CVE-2020-1927 
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
Problem types: cwe_id: CWE-601
description: mod_rewrite CWE-601 open redirect
Affected products: vendor: Apache
product: Apache HTTP Server
Published: 2020-04-01T23:08:43.000Z
CVE-2020-1928 
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
Published: 2020-01-28T00:28:08.000Z
CVE-2020-1929 
The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.
Problem types: description: Information Disclosure
Affected products: vendor: Apache
product: Beam
Published: 2020-01-15T18:56:55.000Z
CVE-2020-1930 
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges.
Problem types: description: Local & Remote Command Execution
Affected products: vendor: Apache Software Foundation
product: Apache SpamAssassin
Published: 2020-01-30T17:42:38.000Z
CVE-2020-1931 
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.
Problem types: description: Local & Remote Command Execution
Affected products: vendor: Apache Software Foundation
product: Apache SpamAssassin
Published: 2020-01-30T17:38:42.000Z
CVE-2020-1932 
An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Superset
Published: 2020-01-28T00:38:15.000Z
CVE-2020-1933 
A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.
Problem types: description: XSS Attack
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
Published: 2020-01-28T00:33:32.000Z
CVE-2020-1934 
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
Problem types: description: mod_proxy_ftp use of uninitialized value
Affected products: vendor: Apache
product: Apache HTTP Server
Published: 2020-04-01T19:22:23.000Z
CVE-2020-1935 
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Problem types: description: HTTP Request Smuggling
Affected products: vendor: Apache
product: Apache Tomcat
Published: 2020-02-24T21:11:38.000Z
CVE-2020-1936 Stored XSS in Apache Ambari
A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Apache Software Foundation
product: Apache Ambari
Credits: lang: en
value: Apache Ambari would like to thank Krzysztof Przybylski from STM Solutions
Published: 2021-03-02T09:00:22.000Z
CVE-2020-1937 
Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.
Problem types: description: SQL injection
Affected products: vendor: Apache
product: Apache Kylin
Published: 2020-02-24T20:57:52.000Z
CVE-2020-1938 
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
Problem types: description: AJP Request Injection leading to possible Remote Code Execution
Affected products: vendor: Apache
product: Apache Tomcat
Published: 2020-02-24T21:19:18.000Z
CVE-2020-1939 
The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected only if they have enabled ftpd. Versions 6.15 to 8.2 are affected.
Problem types: description: NULL Pointer Dereference
Affected products: vendor: n/a
product: Apache NuttX (incubating)
Published: 2020-05-12T14:57:55.000Z
CVE-2020-1940 
The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Jackrabbit Oak
Published: 2020-01-28T16:51:10.000Z
CVE-2020-1941 
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
Problem types: description: XSS
Affected products: vendor: n/a
product: Apache ActiveMQ
Published: 2020-05-14T16:29:26.000Z
CVE-2020-1942 
In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache NiFi
Published: 2020-02-11T20:57:26.000Z
CVE-2020-1943 
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
Problem types: description: XSS Vulnerability
Affected products: vendor: Apache
product: Apache OFBiz
Published: 2020-04-01T18:18:48.000Z