rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-18357 
An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T18:38:35.000Z
CVE-2019-18359 
A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T19:05:48.000Z
CVE-2019-18360 
In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T14:02:29.000Z
CVE-2019-18361 
JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T14:37:38.000Z
CVE-2019-18362 
JetBrains MPS before 2019.2.2 exposed listening ports to the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T14:43:55.000Z
CVE-2019-18363 
In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T14:48:59.000Z
CVE-2019-18364 
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T14:54:36.000Z
CVE-2019-18365 
In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:12:10.000Z
CVE-2019-18366 
In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:16:41.000Z
CVE-2019-18367 
In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:20:03.000Z
CVE-2019-18368 
In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:24:16.000Z
CVE-2019-18369 
In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:25:56.000Z
CVE-2019-18370 
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar zxf command to decompress, so one can control the contents of the files in the decompressed directory. In addition, the application's sh script for testing upload and download speeds reads a URL list from /tmp/speedtest_urls.xml, and there is a command injection vulnerability, as demonstrated by api/xqnetdetect/netspeed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T20:01:55.000Z
CVE-2019-18371 
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T20:02:12.000Z
CVE-2019-18372 
Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection
Published: 2019-11-15T17:41:41.000Z
CVE-2019-18373 
Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking other apps on the device, thereby allowing the individual to gain access.
Problem types: description: Security Bypass
Affected products: vendor: Symantec
product: Norton AppLock
Published: 2019-11-18T20:57:35.000Z
CVE-2019-18374 
Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing authentication controls.
Problem types: description: Authentication Bypass
Affected products: vendor: Symantec
product: Critical System Protection (CSP)
Published: 2019-11-25T16:22:15.000Z
CVE-2019-18375 
The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console.
Problem types: description: Session hijacking
Affected products: vendor: n/a
product: Symantec Advanced Secure Gateway (ASG) and ProxySG
Published: 2020-04-09T23:16:17.000Z
CVE-2019-18376 
A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) user's web browser history or a network device that intercepts/logs traffic to MC, to obtain CSRF tokens and use them to perform CSRF attacks against MC.
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Symantec Management Center (MC)
Published: 2020-04-09T23:11:48.000Z
CVE-2019-18377 
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Messaging Gateway
Published: 2019-12-11T15:49:05.000Z
CVE-2019-18378 
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
Problem types: description: XSS
Affected products: vendor: n/a
product: Symantec Messaging Gateway
Published: 2019-12-11T15:49:17.000Z
CVE-2019-18379 
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which is a type of issue that can let an attacker send crafted requests from the backend server of a vulnerable web application or access services available through the loopback interface.
Problem types: description: SSRF
Affected products: vendor: n/a
product: Symantec Messaging Gateway
Published: 2019-12-11T15:49:28.000Z
CVE-2019-18380 
Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat actor to create or modify application user accounts without proper authentication.
Problem types: description: Unauthorized Access
Affected products: vendor: Symantec Corporation
product: Industrial Control System Protection (ICSP)
Published: 2019-12-09T17:28:11.000Z
CVE-2019-18381 
Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.
Problem types: description: CORS
Affected products: vendor: n/a
product: Norton Password Manager
Published: 2019-12-05T17:17:35.000Z
CVE-2019-18382 
An issue was discovered on AVStar PE204 3.10.70 IP camera devices. A denial of service can occur on open TCP port 23456. After a TELNET connection, no TCP ports are open.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T21:00:32.000Z
CVE-2019-18383 
An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramaster_TNAS-00E43A_config_backup.bin without permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T21:00:21.000Z
CVE-2019-18384 
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=*public*%25252Fadmin_OnlyRead.txt substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T21:00:08.000Z
CVE-2019-18385 
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T20:59:54.000Z
CVE-2019-18386 
Systems management on Unisys ClearPath Forward Libra and ClearPath MCP Software Series can fault and have other unspecified impact when receiving specifically crafted message payloads over a systems management communication channel
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-07T18:47:06.000Z
CVE-2019-18387 
Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the id parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T22:56:29.000Z
CVE-2019-18388 
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T00:00:00.000Z
CVE-2019-18389 
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T00:00:00.000Z
CVE-2019-18390 
An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T00:00:00.000Z
CVE-2019-18391 
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-23T00:00:00.000Z
CVE-2019-18393 
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T10:58:18.000Z
CVE-2019-18394 
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T10:58:34.000Z
CVE-2019-18396 
An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017–14127.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T19:08:27.000Z
CVE-2019-18397 
A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T13:55:35.000Z
CVE-2019-18408 
archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T13:37:39.000Z
CVE-2019-18409 
The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T13:59:19.000Z
CVE-2019-18411 
Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T21:48:40.000Z
CVE-2019-18412 
JetBrains IDETalk plugin before version 193.4099.10 allows XXE
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-15T15:08:04.000Z
CVE-2019-18413 
In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
Published: 2019-10-24T00:00:00.000Z
CVE-2019-18414 
Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T17:20:23.000Z
CVE-2019-18415 
Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T17:30:25.000Z
CVE-2019-18416 
Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T17:29:59.000Z
CVE-2019-18417 
Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution. The issue occurs because the application fails to adequately sanitize user-supplied input, e.g., "add a new food" allows .php files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T17:30:14.000Z
CVE-2019-18418 
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T19:01:06.000Z
CVE-2019-18419 
A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T19:00:55.000Z
CVE-2019-18420 
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and earlier are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T13:30:06.000Z
CVE-2019-18421 
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these page tables directly, Xen keeps track of how pages are used using a type system; pages must be "promoted" before being used as a pagetable, and "demoted" before being used for any other type. Xen also allows for "recursive" promotions: i.e., an operating system promoting a page to an L4 pagetable may end up causing pages to be promoted to L3s, which may in turn cause pages to be promoted to L2s, and so on. These operations may take an arbitrarily large amount of time, and so must be re-startable. Unfortunately, making recursive pagetable promotion and demotion operations restartable is incredibly complicated, and the code contains several races which, if triggered, can cause Xen to drop or retain extra type counts, potentially allowing guests to get write access to in-use pagetables. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All x86 systems with untrusted PV guests are vulnerable. HVM and PVH guests cannot exercise this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T13:34:00.000Z
CVE-2019-18422 
An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled. This could lead to data corruption, denial of service, or possibly even privilege escalation. However a precise attack technique has not been identified.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T13:35:15.000Z
CVE-2019-18423 
An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the functions p2m_resolve_translation_fault() and p2m_get_entry() to sanity check guest physical frame. The rest of the code in the two functions will assume that there is a valid root table and check that with BUG_ON(). The function p2m_get_root_pointer() will ignore the unused top bits of a guest physical frame. This means that the function p2m_set_entry() will alias the frame. However, p2m->max_mapped_gfn will be updated using the original frame. It would be possible to set p2m->max_mapped_gfn high enough to cover a frame that would lead p2m_get_root_pointer() to return NULL in p2m_get_entry() and p2m_resolve_translation_fault(). Additionally, the sanity check on p2m->max_mapped_gfn is off-by-one allowing "highest mapped + 1" to be considered valid. However, p2m_get_root_pointer() will return NULL. The problem could be triggered with a specially crafted hypercall XENMEM_add_to_physmap{, _batch} followed by an access to an address (via hypercall or direct access) that passes the sanity check but cause p2m_get_root_pointer() to return NULL. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen version 4.8 and newer are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T13:36:27.000Z
CVE-2019-18424 
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary address. The IOMMU is used to protect the host from malicious DMA by making sure that the device addresses can only target memory assigned to the guest. However, when the guest domain is torn down, or the device is deassigned, the device is assigned back to dom0, thus allowing any in-flight DMA to potentially target critical host data. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T13:38:31.000Z