rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-7675 
An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application is delivered over cleartext HTTP with Basic Authentication, as demonstrated by the /admin/index.html URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-09T22:00:00.000Z
CVE-2019-7676 
A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-09T22:00:00.000Z
CVE-2019-7677 
XSS exists in Enphase Envoy R3.*.* via the profileName parameter to the /home URI on TCP port 8888.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-09T22:00:00.000Z
CVE-2019-7678 
A directory traversal vulnerability was discovered in Enphase Envoy R3.*.* via images/, include/, include/js, or include/css on TCP port 8888.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-09T22:00:00.000Z
CVE-2019-7684 
inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxedu.os.common.controller.VideoUploadController#gok4 (com/inxedu/os/common/controller/VideoUploadController.java). The attacker uses the /video/uploadvideo fileType parameter to change the list of acceptable extensions from jpg,gif,png,jpeg to jpg,gif,png,jsp,jpeg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-09T22:00:00.000Z
CVE-2019-7687 
cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T18:58:07.000Z
CVE-2019-7690 
In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the process, even after the user disconnects from the remote SSH server. This affects Passwordless Authentication that has a Password Protected SSH Private Key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T15:58:33.000Z
CVE-2019-7692 
install/install.php in CIM 0.9.3 allows remote attackers to execute arbitrary PHP code via a crafted prefix value because of configuration file mishandling in the N=83 case, as demonstrated by a call to the PHP fputs function that creates a .php file in the public folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T16:00:00.000Z
CVE-2019-7693 
Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx Error_Parameters parameter. In some situations, the XSS would be on the family.axioscloud.it cloud service; however, the vendor also supports "Sissi in Rete (con server)" for offline operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7697 
An issue was discovered in Bento4 v1.5.1-627. There is an assertion failure in AP4_AtomListWriter::Action in Core/Ap4Atom.cpp, leading to a denial of service (program crash), as demonstrated by mp42hls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7698 
An issue was discovered in AP4_Array<AP4_CttsTableEntry>::EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at excessive memory allocation, as demonstrated by mp42hls, a related issue to CVE-2018-20095.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7699 
A heap-based buffer over-read occurs in AP4_BitStream::WriteBytes in Codecs/Ap4BitStream.cpp in Bento4 v1.5.1-627. Remote attackers could leverage this vulnerability to cause an exception via crafted mp4 input, which leads to a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7700 
A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-merge.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7701 
A heap-based buffer over-read was discovered in wasm::SExpressionParser::skipWhitespace() in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm2js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7702 
A NULL pointer dereference was discovered in wasm::SExpressionWasmBuilder::parseExpression in wasm-s-parser.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7703 
In Binaryen 1.38.22, there is a use-after-free problem in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp. Remote attackers could leverage this vulnerability to cause a denial-of-service via a wasm file, as demonstrated by wasm-merge.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7704 
wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-merge and wasm-opt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-10T22:00:00.000Z
CVE-2019-7711 
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the (user controlled) shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-26T01:00:24.000Z
CVE-2019-7712 
An issue was discovered in handler_ipcom_shell_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. When using the pwd command, the current working directory path is used as the first argument to printf() without a proper check. An attacker may thus forge a path containing format string modifiers to get a custom format string evaluated. This results in an information leak of memory addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-26T01:00:37.000Z
CVE-2019-7713 
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. There is a heap-based buffer overflow in the function responsible for printing the shell prompt, when a custom modifier is used to display information such as a process ID, IP address, or current working directory. Modifier expansion triggers this overflow, causing memory corruption or a crash (and also leaks memory address information).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-26T01:00:49.000Z
CVE-2019-7714 
An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. It allocates 60 bytes for the HTTP Authentication header. However, when copying this header to parse, it does not check the size of the header, leading to a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-26T01:01:00.000Z
CVE-2019-7715 
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the environment variable ipcom.shell.greeting as the first argument to printf(). Setting this variable using the sysvar command results in a user-controlled format string during login, resulting in an information leak of memory addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-26T01:01:45.000Z
CVE-2019-7718 
An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php?2=file_put_contents URIs because app/system/databack/admin/index.class.php creates bakup_tables.php temporarily.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T03:00:00.000Z
CVE-2019-7719 
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T03:00:00.000Z
CVE-2019-7720 
taocms through 2014-05-24 allows eval injection by placing PHP code in the install.php db_name parameter and then making a config.php request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T03:00:00.000Z
CVE-2019-7721 
lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T03:00:00.000Z
CVE-2019-7722 
PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T14:00:00.000Z
CVE-2019-7725 
includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T04:19:46.000Z
CVE-2019-7726 
modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T04:26:00.000Z
CVE-2019-7727 
In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restricting registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol by using the JMX connector. The observed affected TCP port is 6338 but, based on the product's configuration, a different one could be vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T19:07:51.000Z
CVE-2019-7728 
An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to improperly implemented TLS certificate checks, a malicious actor could potentially succeed in executing a man-in-the-middle attack for some connections. (The Bosch Smart Home App is not affected. iOS Apps are not affected.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T13:00:00.000Z
CVE-2019-7729 
An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succeed in retrieving video clips or still images that have been cached for clip sharing. (The Bosch Smart Home App is not affected. iOS Apps are not affected.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T13:00:00.000Z
CVE-2019-7730 
MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnerability for deleting a database via the /?q=wrkfrm&type=databases URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T17:00:00.000Z
CVE-2019-7731 
MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function with a .php filename for the backup's archive file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T17:00:00.000Z
CVE-2019-7732 
In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T17:00:00.000Z
CVE-2019-7733 
In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T17:00:00.000Z
CVE-2019-7736 
D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T17:00:00.000Z
CVE-2019-7737 
A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T21:00:00.000Z
CVE-2019-7738 
C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T21:00:00.000Z
CVE-2019-7739 
An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior. However, it might be unexpected for the user because the configuration dialog lacks an additional message to explain this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T18:00:00.000Z
CVE-2019-7740 
An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XSS attack vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T18:00:00.000Z
CVE-2019-7741 
An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T18:00:00.000Z
CVE-2019-7742 
An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T18:00:00.000Z
CVE-2019-7743 
An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T18:00:00.000Z
CVE-2019-7744 
An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T18:00:00.000Z
CVE-2019-7745 
JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmap_web_cgi Page=GetWiFi_Setting request and then reading the wpa_security_key field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T18:59:04.000Z
CVE-2019-7746 
JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap_auth type=getuser request and then reading the token field. This token value can then be used to change the Wi-Fi password or perform a factory reset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-07T18:59:57.000Z
CVE-2019-7747 
DbNinja 3.2.7 allows session fixation via the data.php sessid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T21:00:00.000Z
CVE-2019-7748 
_includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-11T21:00:00.000Z
CVE-2019-7751 
A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing, FusionPro VDP before 10.0 allows a remote attacker to list or enumerate sensitive contents of files. Furthermore, this could allow for privilege escalation by dumping the local machine's SAM and SYSTEM database files, and possibly remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T16:39:48.000Z
CVE-2019-7753 
Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-12T12:00:00.000Z
CVE-2019-7755 
In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbitrary SQL queries, aka SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-30T16:49:28.000Z
CVE-2019-7758 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier version, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Problem types: description: Out-of-Bounds Read
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:11:25.000Z
CVE-2019-7759 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:13:59.000Z
CVE-2019-7760 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:16:41.000Z
CVE-2019-7761 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:18:29.000Z
CVE-2019-7762 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:21:33.000Z
CVE-2019-7763 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:23:07.000Z
CVE-2019-7764 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:24:13.000Z
CVE-2019-7765 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:25:50.000Z
CVE-2019-7766 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:27:24.000Z
CVE-2019-7767 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:29:58.000Z
CVE-2019-7768 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:31:06.000Z
CVE-2019-7769 
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Problem types: description: Out-of-Bounds Read
Affected products: vendor: Adobe
product: Adobe Acrobat and Reader
Published: 2019-05-22T13:01:02.000Z