rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-8428 
ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-18T00:00:00.000Z
CVE-2019-8429 
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-18T00:00:00.000Z
CVE-2019-8432 
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-18T00:00:00.000Z
CVE-2019-8433 
JTBC(PHP) 3.0.1.8 allows Arbitrary File Upload via the console/#/console/file/manage.php?type=list URI, as demonstrated by a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-18T00:00:00.000Z
CVE-2019-8434 
In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-18T00:00:00.000Z
CVE-2019-8435 
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-18T00:00:00.000Z
CVE-2019-8436 
imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-18T00:00:00.000Z
CVE-2019-8437 
njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2019-8438 
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting->site setting" of admin/index.php, aka site_name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2019-8439 
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting->site setting" of admin/index.php, aka site_domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2019-8440 
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of "System setting->site setting" of admin/index.php, aka site_logo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-07T22:00:00.000Z
CVE-2019-8442 
The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.
Problem types: description: Information Exposure
Affected products: vendor: Atlassian
product: Jira
Published: 2019-05-22T17:39:14.653Z
CVE-2019-8443 
The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.
Problem types: description: Improper Access Control
Affected products: vendor: Atlassian
product: Jira
Published: 2019-05-22T17:37:11.201Z
CVE-2019-8444 
The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.797Z
CVE-2019-8445 
Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization (CWE-863)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.839Z
CVE-2019-8446 
The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization (CWE-863)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.890Z
CVE-2019-8447 
The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.
Problem types: description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-23T13:49:47.940Z
CVE-2019-8448 
The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
Problem types: description: Information Exposure
Affected products: vendor: Atlassian
product: Jira
Published: 2019-08-13T14:39:56.841Z
CVE-2019-8449 
The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
Problem types: description: Information Exposure
Affected products: vendor: Atlassian
product: Jira
Published: 2019-09-11T13:56:26.301Z
CVE-2019-8450 
Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-09-11T13:56:26.352Z
CVE-2019-8451 
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.
Problem types: description: Server-Side Request Forgery (SSRF)
Affected products: vendor: Atlassian
product: Jira
Published: 2019-09-11T13:56:26.397Z
CVE-2019-8452 
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.
Problem types: cwe_id: CWE-65
description: CWE-65
Affected products: vendor: Check Point ZoneAlarm
product: Check Point ZoneAlarm
vendor: Check Point ZoneAlarm
product: Check Point Endpoint Security client for Windows
Published: 2019-04-22T21:43:19.000Z
CVE-2019-8453 
Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attacker to replace a DLL file with a malicious one and cause Denial of Service to the client.
Problem types: cwe_id: CWE-114
description: CWE-114
Affected products: vendor: n/a
product: Check Point ZoneAlarm
Published: 2019-04-17T14:06:40.000Z
CVE-2019-8454 
A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes and another BAT file, then by impersonating the WPAD server, the attacker can write BAT commands into that file that will later be run by the user or the system.
Problem types: cwe_id: CWE-65
description: CWE-65,CWE-377
Affected products: vendor: Check Point
product: Check Point Endpoint Security client for Windows
Published: 2019-04-29T15:10:15.000Z
CVE-2019-8455 
A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.
Problem types: cwe_id: CWE-65
description: CWE-65
Affected products: vendor: n/a
product: Check Point ZoneAlarm
Published: 2019-04-17T14:05:54.000Z
CVE-2019-8456 
Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration and setup to successfully connect to a site-to-site VPN server.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Check Point
product: Check Point IPsec VPN
Published: 2019-04-09T20:44:32.000Z
CVE-2019-8457 
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: n/a
product: SQLite
Published: 2019-05-30T15:51:52.000Z
CVE-2019-8458 
Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL during an update initiated by the UI. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate.
Problem types: cwe_id: CWE-114
description: CWE-114
Affected products: vendor: Check Point
product: Check Point Endpoint Security Client for Windows, Anti-Malware blade
Published: 2019-06-20T16:44:33.000Z
CVE-2019-8459 
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.
Problem types: cwe_id: CWE-428
description: CWE-428
Affected products: vendor: Check Point
product: Check Point Endpoint Security Client for Windows, VPN blade
Published: 2019-06-20T16:50:58.000Z
CVE-2019-8460 
OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.
Problem types: cwe_id: CWE-1049
description: CWE-1049
Affected products: vendor: n/a
product: OpenBSD
Published: 2019-08-26T19:18:49.000Z
CVE-2019-8461 
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoint Client installed. An attacker can leverage this to gain LPE using a specially crafted DLL placed in any PATH location accessible with write permissions to the user.
Problem types: cwe_id: CWE-114
description: CWE-114: Process Control
Affected products: vendor: n/a
product: Check Point Endpoint Security Initial Client for Windows
Published: 2019-08-29T20:41:54.000Z
CVE-2019-8462 
In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique configuration of enhanced logging.
Problem types: cwe_id: CWE-755
description: CWE-755
Affected products: vendor: n/a
product: Check Point Security Gateway
Published: 2019-10-02T16:37:41.000Z
CVE-2019-8463 
A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service log file to be written to non-standard locations.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Check Point
product: Check Point Endpoint Security Client for Windows
Published: 2019-12-23T18:18:50.000Z
CVE-2019-8502 
An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization.
Problem types: description: A malicious application may be able to initiate a Dictation request without user authorization
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8503 
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website.
Problem types: description: A malicious website may be able to execute scripts in the context of another website
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: tvOS
vendor: Apple
product: Safari
vendor: Apple
product: iTunes for Windows
vendor: Apple
product: iCloud for Windows
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8504 
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A local user may be able to read kernel memory.
Problem types: description: A local user may be able to read kernel memory
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8505 
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting.
Problem types: description: Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: Safari
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8506 
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: Safari
vendor: Apple
product: iTunes for Windows
vendor: Apple
product: iCloud for Windows
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8507 
Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.4. Processing malicious data may lead to unexpected application termination.
Problem types: description: Processing malicious data may lead to unexpected application termination
Affected products: vendor: Apple
product: macOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8508 
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.
Problem types: description: Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges
Affected products: vendor: Apple
product: macOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8509 
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. A malicious application may be able to elevate privileges.
Problem types: description: A malicious application may be able to elevate privileges
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2020-10-27T19:23:35.000Z
CVE-2019-8510 
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to determine kernel memory layout.
Problem types: description: A malicious application may be able to determine kernel memory layout
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8511 
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A malicious application may be able to elevate privileges.
Problem types: description: A malicious application may be able to elevate privileges
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8512 
This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure.
Problem types: description: A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure
Affected products: vendor: Apple
product: iOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8513 
This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to execute arbitrary shell commands.
Problem types: description: A local user may be able to execute arbitrary shell commands
Affected products: vendor: Apple
product: macOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8514 
A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. An application may be able to gain elevated privileges.
Problem types: description: An application may be able to gain elevated privileges
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8515 
A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may disclose sensitive user information.
Problem types: description: Processing maliciously crafted web content may disclose sensitive user information
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: tvOS
vendor: Apple
product: Safari
vendor: Apple
product: iTunes for Windows
vendor: Apple
product: iCloud for Windows
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8516 
A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously crafted string may lead to a denial of service.
Problem types: description: Processing a maliciously crafted string may lead to a denial of service
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8517 
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously crafted font may result in the disclosure of process memory.
Problem types: description: Processing a maliciously crafted font may result in the disclosure of process memory
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8518 
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: Safari
vendor: Apple
product: iTunes for Windows
vendor: Apple
product: iCloud for Windows
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8519 
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. An application may be able to read restricted memory.
Problem types: description: An application may be able to read restricted memory
Affected products: vendor: Apple
product: macOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8520 
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to read restricted memory.
Problem types: description: A malicious application may be able to read restricted memory
Affected products: vendor: Apple
product: macOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8521 
This issue was addressed with improved checks. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to overwrite arbitrary files.
Problem types: description: A malicious application may be able to overwrite arbitrary files
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8522 
A logic issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4. An encrypted volume may be unmounted and remounted by a different user without prompting for the password.
Problem types: description: An encrypted volume may be unmounted and remounted by a different user without prompting for the password
Affected products: vendor: Apple
product: macOS
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8523 
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: tvOS
vendor: Apple
product: Safari
vendor: Apple
product: iTunes for Windows
vendor: Apple
product: iCloud for Windows
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8524 
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: tvOS
vendor: Apple
product: Safari
vendor: Apple
product: iTunes for Windows
vendor: Apple
product: iCloud for Windows
Published: 2019-12-18T17:33:16.000Z
CVE-2019-8525 
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. An application may be able to execute arbitrary code with kernel privileges.
Problem types: description: An application may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2020-10-27T19:23:26.000Z