rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-9855 Windows 8.3 path equivalence handling flaw allows LibreLogo script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added to block calling LibreLogo from script event handers. However a Windows 8.3 path equivalence handling flaw left LibreOffice vulnerable under Windows that a document could trigger executing LibreLogo via a Windows filename pseudonym. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.
Problem types: description: Windows 8.3 path equivalence handling flaw
Affected products: vendor: Document Foundation
product: LibreOffice
Credits: lang: en
value: Thanks to alex (@insertscript) for reporting this issue
Published: 2019-09-06T18:40:17.271Z
CVE-2019-9857 
In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotify_put_mark() with IN_MASK_CREATE after fsnotify_find_mark(), which will cause a memory leak (aka refcount leak). Finally, this will cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T15:02:13.000Z
CVE-2019-9858 
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads, it invokes the functions getImage() and _getUpload(), which uses unsanitized user input as a path to save the image. The unsanitized POST parameter object[photo][img][file] is saved in the $upload[img][file] PHP variable, allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php, one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms, which default to securely using a random path.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T16:26:06.000Z
CVE-2019-9859 
Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the dangerous command exec. This function can be dangerous if arguments passed to it are not filtered. Every user input in VestaCP that is used as an argument is filtered with the escapeshellarg function. This function comes from the PHP library directly and its description is as follows: "escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument." It means that if you give Username, it will have 'Username' as a replacement. This works well and protects users from exploiting this potentially dangerous exec function. Unfortunately, VestaCP uses this escapeshellarg function incorrectly in several places.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-10T12:34:32.000Z
CVE-2019-9860 
Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014 or FUBE50015) relative to its controlled Secvest wireless alarm system FUAA50000 3.01.01, so that sent commands by the remote control are not accepted anymore.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-27T14:01:34.000Z
CVE-2019-9861 
Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can easily be cloned and used to deactivate the alarm system in an unauthorized way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-14T16:03:38.000Z
CVE-2019-9862 
An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE50015. Because "encrypted signal transmission" is missing, an attacker is able to eavesdrop sensitive data as cleartext (for instance, the current rolling code state).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-27T13:52:47.000Z
CVE-2019-9863 
Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote controls FUBE50014 and FUBE50015, an attacker is able to predict valid future rolling codes, and can thus remotely control the alarm system in an unauthorized way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-27T13:41:32.000Z
CVE-2019-9864 
PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Parameter Tampering of the payment amount.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-28T14:18:03.000Z
CVE-2019-9865 
When RPC is enabled in Wind River VxWorks 6.9 prior to 6.9.1, a specially crafted RPC request can trigger an integer overflow leading to an out-of-bounds memory copy. It may allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T16:33:27.000Z
CVE-2019-9866 
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T16:28:16.000Z
CVE-2019-9867 
An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-19T15:53:29.000Z
CVE-2019-9868 
An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-19T15:54:00.000Z
CVE-2019-9870 
plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-19T16:27:07.000Z
CVE-2019-9871 
Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T19:55:18.000Z
CVE-2019-9872 
In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize IDE settings using a public repository, these credentials were published to this repository. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-03T18:40:17.000Z
CVE-2019-9873 
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-03T18:43:42.000Z
CVE-2019-9874 
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T20:11:49.000Z
CVE-2019-9875 
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T20:34:46.000Z
CVE-2019-9877 
There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for example) be triggered by sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-19T18:16:29.000Z
CVE-2019-9878 
There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-19T18:16:53.000Z
CVE-2019-9879 
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-10T17:28:53.000Z
CVE-2019-9880 
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-10T17:32:39.000Z
CVE-2019-9881 
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-10T17:37:26.000Z
CVE-2019-9882 Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist.
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list.php?ACSION=&type=email&category=white&locate=big5&cmd=add&new=hacker@socialengineering.com&new_memo=&add=%E6%96%B0%E5%A2%9E without any authorizes.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: OAKlouds
product: MailSherlock MSR35
vendor: OAKlouds
product: MailSherlock MSR45
Credits: lang: en
value: AurOraD@d
Published: 2019-06-03T18:03:21.000Z
CVE-2019-9883 Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account.
Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cgi?chief=&wk_group=full&cf_name=test&cf_account=test&cf_email=&cf_acl=Management&apply_lang=&dn= without any authorizes.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: OAKlouds
product: MailSherlock MSR35
vendor: OAKlouds
product: MailSherlock MSR45
Credits: lang: en
value: AurOraD@d
Published: 2019-06-03T18:03:21.000Z
CVE-2019-9884 eClass platform contains a Broken Access Control vulnerability
eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: BroadLearning
product: eclass
Credits: lang: en
value: Chris Chan @ UDomain Web Hosting Co.Ltd
Published: 2019-07-25T16:25:39.710Z
CVE-2019-9885 eClass platform contains a SQL injection vulnerability
eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: BroadLearning
product: eclass
Credits: lang: en
value: Chris Chan @ UDomain Web Hosting Co.Ltd
Published: 2019-07-25T16:25:39.770Z
CVE-2019-9886 eClass platform allows user to download arbitrary files without authentication
Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: BroadLearning
product: eclass
Credits: lang: en
value: Mr. Kaede Rukawa
Published: 2019-07-11T18:21:51.743Z
CVE-2019-9889 
In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-20T22:12:27.000Z
CVE-2019-9890 
An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-17T16:34:05.000Z
CVE-2019-9891 
The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of commands when used in a shell script called, for example, via sudo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-31T20:42:48.000Z
CVE-2019-9892 
An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbitrary files on the OTRS filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T23:17:49.000Z
CVE-2019-9893 
libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T02:30:42.000Z
CVE-2019-9894 
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T02:30:54.000Z
CVE-2019-9895 
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T02:31:06.000Z
CVE-2019-9896 
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T02:31:32.000Z
CVE-2019-9897 
Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T02:31:46.000Z
CVE-2019-9898 
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T02:31:58.000Z
CVE-2019-9900 
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T14:55:57.000Z
CVE-2019-9901 
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T15:31:19.000Z
CVE-2019-9903 
PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T17:42:50.000Z
CVE-2019-9904 
An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, related to agfstsubg in lib\cgraph\subg.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T17:43:15.000Z
CVE-2019-9908 
The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T23:01:00.000Z
CVE-2019-9909 
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T23:01:11.000Z
CVE-2019-9910 
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T23:01:22.000Z
CVE-2019-9911 
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T23:01:34.000Z
CVE-2019-9912 
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T23:01:44.000Z
CVE-2019-9913 
The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T23:01:55.000Z
CVE-2019-9914 
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T23:03:15.000Z
CVE-2019-9915 
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-21T23:03:25.000Z
CVE-2019-9917 
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-27T05:41:11.000Z
CVE-2019-9918 
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Input does not get validated and queries are not written in a way to prevent SQL injection. Therefore arbitrary SQL-Statements can be executed in the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T14:05:45.000Z
CVE-2019-9919 
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to craft messages in a way that JavaScript gets executed on the side of the receiving user when the message is opened, aka XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T14:06:03.000Z
CVE-2019-9920 
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to perform an action within the context of the account of another user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T14:06:20.000Z
CVE-2019-9921 
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to read information that should only be accessible by a different user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T14:06:43.000Z
CVE-2019-9922 
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access to arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T14:07:13.000Z
CVE-2019-9923 
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-22T07:06:44.000Z
CVE-2019-9924 
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-22T07:05:28.000Z
CVE-2019-9925 
S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-22T07:05:58.000Z
CVE-2019-9926 
An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewScriptReport.view CSRF vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-29T16:46:31.000Z
CVE-2019-9927 
Caret before 2019-02-22 allows Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-22T07:06:20.000Z
CVE-2019-9928 
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-24T14:48:24.000Z
CVE-2019-9929 
Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T16:54:38.000Z
CVE-2019-9930 
Various Lexmark products have an Integer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-28T21:35:20.000Z