rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-15726 
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T16:51:43.000Z
CVE-2019-15727 
An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T16:53:03.000Z
CVE-2019-15728 
An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T16:54:28.000Z
CVE-2019-15729 
An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-17T14:34:48.000Z
CVE-2019-15730 
An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T16:57:33.000Z
CVE-2019-15731 
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T16:58:39.000Z
CVE-2019-15732 
An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T16:59:34.000Z
CVE-2019-15733 
An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T17:00:24.000Z
CVE-2019-15734 
An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T17:01:20.000Z
CVE-2019-15736 
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T17:02:11.000Z
CVE-2019-15737 
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T17:02:54.000Z
CVE-2019-15738 
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T17:03:36.000Z
CVE-2019-15739 
An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T17:04:23.000Z
CVE-2019-15740 
An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T17:05:15.000Z
CVE-2019-15741 
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T17:06:35.000Z
CVE-2019-15742 
A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application. A local attacker can exploit this issue to gain elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-16T23:15:20.000Z
CVE-2019-15743 
The Sony Xperia Touch Android device with a build fingerprint of Sony/blanc_windy/blanc_windy:7.0/LOIRE-SMART-BLANC-1.0.0-170530-0834/1:user/dev-keys contains a pre-installed app with a package name of com.sonymobile.android.maintenancetool.testmic app (versionCode=24, versionName=7.0) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record audio to external storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:27:54.000Z
CVE-2019-15744 
The Sony Xperia Xperia XZs Android device with a build fingerprint of Sony/keyaki_softbank/keyaki_softbank:7.1.1/TONE3-3.0.0-SOFTBANK-170517-0323/1:user/dev-keys contains a pre-installed app with a package name of jp.softbank.mb.tdrl app (versionCode=1413005, versionName=1.3.0) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T16:19:46.000Z
CVE-2019-15745 
The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart plugs in a network, take over control of a device, and perform actions such as turning it on and off.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:40:53.000Z
CVE-2019-15746 
SITOS six Build v6.2.1 allows an attacker to inject arbitrary PHP commands. As a result, an attacker can compromise the running server and execute system commands in the context of the web user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T11:29:30.000Z
CVE-2019-15747 
SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient checks on the server side.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T11:39:13.000Z
CVE-2019-15748 
SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM package that includes a PHP file, which could execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T11:40:15.000Z
CVE-2019-15749 
SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account (e.g., via XSS or an unattended workstation) to change that password and address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T11:41:21.000Z
CVE-2019-15750 
A Cross-Site Scripting (XSS) vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T11:42:19.000Z
CVE-2019-15751 
An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to the web root of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T11:45:48.000Z
CVE-2019-15752 
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-28T20:24:33.000Z
CVE-2019-15753 
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-28T20:33:39.000Z
CVE-2019-15757 
libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T00:29:40.000Z
CVE-2019-15758 
An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T01:02:01.000Z
CVE-2019-15759 
An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T01:01:51.000Z
CVE-2019-15766 
The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the configFile parameter set to the arbitrary file to be written to (and the config_text parameter set to the content of the file to be created). This can be a PHP file that is written to in the public web directory and subsequently executed. The attacker must have network connectivity to the PHP server that is running on the Android device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T20:02:13.000Z
CVE-2019-15767 
In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EPD file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T02:05:12.000Z
CVE-2019-15769 
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:21:33.000Z
CVE-2019-15770 
The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:22:39.000Z
CVE-2019-15771 
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:37:31.000Z
CVE-2019-15772 
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:25:59.000Z
CVE-2019-15773 
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:30:08.000Z
CVE-2019-15774 
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:42:07.000Z
CVE-2019-15775 
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:40:21.000Z
CVE-2019-15776 
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:45:31.000Z
CVE-2019-15777 
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:49:04.000Z
CVE-2019-15778 
The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:35:56.000Z
CVE-2019-15779 
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:34:11.000Z
CVE-2019-15780 
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:55:16.000Z
CVE-2019-15781 
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:33:32.000Z
CVE-2019-15782 
WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:07:38.000Z
CVE-2019-15783 
Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:09:13.000Z
CVE-2019-15784 
Secure Reliable Transport (SRT) through 1.3.4 has a CSndUList array overflow if there are many SRT connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:09:05.000Z
CVE-2019-15785 
FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:39:08.000Z
CVE-2019-15786 
ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:38:27.000Z
CVE-2019-15787 
libZetta.rs through 0.1.2 has an integer overflow in the zpool parser (for error stats) that leads to a panic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:18:26.000Z
CVE-2019-15788 
Clara Genomics Analysis before 0.2.0 has an integer overflow for cudapoa memory management in allocate_block.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T12:04:22.000Z
CVE-2019-15789 Microk8s Privilege Escalation Vulnerability
Privilege escalation vulnerability in MicroK8s allows a low privilege user with local access to obtain root access to the host by provisioning a privileged container. Fixed in MicroK8s 1.15.3.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Canonical
product: MicroK8s
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Denis Andzakovic
Published: 2020-04-08T01:00:26.136Z
CVE-2019-15790 Apport reads PID files with elevated privileges
Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged user could exploit this to read information about a privileged running process by exploiting PID recycling. This information could then be used to obtain ASLR offsets for a process with an existing memory corruption vulnerability. The initial fix introduced regressions in the Python Apport library due to a missing argument in Report.add_proc_environ in apport/report.py. It also caused an autopkgtest failure when reading /proc/pid and with Python 2 compatibility by reading /proc maps. The initial and subsequent regression fixes are in 2.20.11-0ubuntu16, 2.20.11-0ubuntu8.6, 2.20.9-0ubuntu7.12, 2.20.1-0ubuntu2.22 and 2.14.1-0ubuntu3.29+esm3.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: Canonical
product: Apport
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 2.8
baseSeverity: LOW
Credits: lang: en
value: Kevin Backhouse
Published: 2020-04-27T23:25:19.961Z
CVE-2019-15791 Reference count underflow in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow.
Problem types: cwe_id: CWE-672
description: CWE-672 Operation on a Resource after Expiration or Release
Affected products: vendor: Ubuntu
product: Shiftfs in the Linux kernel
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Jann Horn of Google Project Zero
Published: 2020-04-23T23:55:23.619Z
CVE-2019-15792 Type confusion in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), which casts file->private_data, a void* that points to a filesystem-dependent type, to a "struct shiftfs_file_info *". As the private_data is not required to be a pointer, an attacker can use this to cause a denial of service or possibly execute arbitrary code.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Ubuntu
product: Shiftfs in the Linux kernel
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Jann Horn of Google Project Zero
Published: 2020-04-23T23:55:24.126Z
CVE-2019-15793 Mishandling of file-system uid/gid with namespaces in shiftfs
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whereas they should have been translated into the s_user_ns for the lower filesystem. This resulted in using ids other than the intended ones in the lower fs, which likely did not map into the shifts s_user_ns. A local attacker could use this to possibly bypass discretionary access control permissions.
Problem types: cwe_id: CWE-538
description: CWE-538 File and Directory Information Exposure
Affected products: vendor: Ubuntu
product: Shiftfs in the Linux kernel
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Jann Horn of Google Project Zero
Published: 2020-04-23T23:55:24.581Z
CVE-2019-15794 Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow.
Problem types: cwe_id: CWE-672
description: CWE-672 Operation on a Resource after Expiration or Release
Affected products: vendor: Ubuntu
product: Linux kernel
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Jann Horn of Google Project Zero
Published: 2020-04-23T23:55:25.039Z