Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
n TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5103. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-957
CVE ID: CVE-2017-16593 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.204Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.restore.del_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filenames parameter, the process does not properly validate
which listens on TCP port 8081 by default. When parsing the filenames parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete any files accessible to the Administrator user. Was ZDI-CAN-5104. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-958
CVE ID: CVE-2017-16594 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.404Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-434 Description: This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.db.save_005fimage_jsp servlet, which listens on TCP port 8081 by default. When parsing the id parameter, the process does not properly validate user-s
which listens on TCP port 8081 by default. When parsing the id parameter, the process does not properly validate user-supplied data, which can allow for the upload of files. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5117. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-959
CVE ID: CVE-2017-16595 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.353Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.reports.export_005fdownload_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not p
load_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5118. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-960
CVE ID: CVE-2017-16596 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.248Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.designer.script_005fsamples_jsp servlet, which listens on TCP port 8081 by default. When parsing the type parameter, the process does not prope
ples_jsp servlet, which listens on TCP port 8081 by default. When parsing the type parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5119. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-961
CVE ID: CVE-2017-16597 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.275Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of WRQ requests. When parsing the Filename field, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the con
ied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5137. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-962
CVE ID: CVE-2017-16598 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.320Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.tools.snmpwalk.snmpwalk_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the ip parameter, the process
walk.snmpwalk_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the ip parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5138. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-963
CVE ID: CVE-2017-16599 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.203Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.reports.templates.misc.sample_jsp servlet, which listens on TCP port 8081 by default. When parsing the type parameter, the process does not properly va
sp servlet, which listens on TCP port 8081 by default. When parsing the type parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5190. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-964
CVE ID: CVE-2017-16600 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.255Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.reports.templates.network.traffic_005freport_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not
report_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to overwrite any files accessible to the Administrator. Was ZDI-CAN-5191. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-965 - http://www.securityfocus.com/bid/102528
CVE ID: CVE-2017-16601 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.233Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.reports.templates.service.service_005ffailures_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the proc
rvice_005ffailures_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to overwrite any files accessible to the Administrator. Was ZDI-CAN-5192. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-966
CVE ID: CVE-2017-16602 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.362Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-78 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.tools.exec_jsp servlet, which listens on TCP port 8081 by default. When parsing the command parameter, the process does not properly validate a user-su
istens on TCP port 8081 by default. When parsing the command parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5193. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-967
CVE ID: CVE-2017-16603 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.311Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.settings.upload_005ffile_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the proc
ad_005ffile_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate user-supplied data, which can allow for the upload of files. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5194. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-968
CVE ID: CVE-2017-16604 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.331Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.cnnic.asset.deviceReport.deviceReport_005fexport_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter,
iceReport_005fexport_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to overwrite any files accessible to the Administrator. Was ZDI-CAN-5195. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-969
CVE ID: CVE-2017-16605 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.328Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.db.save_005fattrs_jsp servlet, which listens on TCP port 8081 by default. When parsing the id parameter, the process does not properly validate a us
t, which listens on TCP port 8081 by default. When parsing the id parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to overwrite any files accessible to the Administrator. Was ZDI-CAN-5196. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-970 - http://www.securityfocus.com/bid/102512
CVE ID: CVE-2017-16606 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.220Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp._3d.add_005f3d_005fview_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the proce
d_005fview_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5197. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-971
CVE ID: CVE-2017-16607 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.197Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-200 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within heapdumps.jsp. The issue results from the lack of proper validation of a user-supplied string before using it to download heap memory dump. An attacker can leverage this in conjunction with other vulnerabilities to disclose sensitive information in the c
dump. An attacker can leverage this in conjunction with other vulnerabilities to disclose sensitive information in the context of the current process. Was ZDI-CAN-4718. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102219 - https://zerodayinitiative.com/advisories/ZDI-17-949 - https://www.tenable.com/security/research/tra-2018-02
CVE ID: CVE-2017-16608 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.227Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-78 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within exec.jsp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current user. Was ZDI-CAN-4749. Additional Anal
can leverage this vulnerability to execute code under the context of the current user. Was ZDI-CAN-4749. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-950 - https://www.tenable.com/security/research/tra-2018-02
CVE ID: CVE-2017-16609 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.302Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-39 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within download.jsp. The issue results from the lack of proper validation of a user-supplied string before using it to download a file. An attacker can leverage this vulnerability to expose sensitive information. Was ZDI-CAN-4750. Additional Analyst Notes: - CVE
acker can leverage this vulnerability to expose sensitive information. Was ZDI-CAN-4750. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-951 - https://www.tenable.com/security/research/tra-2018-02
CVE ID: CVE-2017-16610 State: PUBLISHED Published: 2018-01-23T01:00:00 Last Updated: 2024-08-05T20:27:04.209Z Vendors: NetGain Systems Products: NetGain Systems Enterprise Manager Problem Types: CWE-22 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within upload_save_do.jsp. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the context of the current user. Was ZDI-CAN-4751. Additional
ker can leverage this vulnerability to execute code under the context of the current user. Was ZDI-CAN-4751. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-952 - https://www.tenable.com/security/research/tra-2018-02
CVE ID: CVE-2017-16611 State: PUBLISHED Published: 2017-12-01T17:00:00 Last Updated: 2024-08-05T20:27:04.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/11/28/7 - https://bugzilla.suse.com/show_bug.cgi?id=1050459 - http://www.ubuntu.com/usn/USN-3500-1 - https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2 - https://security.gentoo.o
tu.com/usn/USN-3500-1 - https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2 - https://security.gentoo.org/glsa/201801-10 - https://marc.info/?l=freedesktop-xorg-announce&m=151188049718337&w=2 - http://security.cucumberlinux.com/security/details.php?id=155 - https://lists.debian.org/debian-lts-announce/2022/01/msg00028.html
CVE ID: CVE-2017-16612 State: PUBLISHED Published: 2017-12-01T17:00:00 Last Updated: 2024-08-05T20:27:04.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP. It is also possible that an attack vector exists against the related code in cursor/xcursor.c in Wayland through 1.14.0. Additional Analyst Notes: - CVE Program Container: References: - https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8 - https://usn.ubuntu.com/3622-1/ - http://www.openwall.com/lists/oss-security/2017
4b5dd34688158fb51a2943032569d3780c4b8 - https://usn.ubuntu.com/3622-1/ - http://www.openwall.com/lists/oss-security/2017/11/28/6 - https://bugzilla.suse.com/show_bug.cgi?id=1065386 - https://security.gentoo.org/glsa/201801-04 - https://lists.freedesktop.org/archives/wayland-devel/2017-November/035979.html - http://www.ubuntu.com/usn/USN-3501-1 - https://lists.debian.org/debian-lts-announce/2017/12/msg00002.html - https://cgit.freedesktop.org/wayland/wayland/commit/?id=5d201df72f3d4f4cb8b8f75f980169b03507da38 - https://marc.info/?l=freedesktop-xorg-announce&m=151188036018262&w=2 - http://security.cucumberlinux.com/security/details.php?id=156 - https://www.debian.org/security/2017/dsa-4059
CVE ID: CVE-2017-16613 State: PUBLISHED Published: 2017-11-21T13:00:00 Last Updated: 2024-08-05T20:27:04.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team. Additional A
thub.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101926 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882314 - https://www.debian.org/security/2017/dsa-4044 - https://bugs.launchpad.net/swift/+bug/1655781 - https://github.com/openstack/swauth/commit/70af7986265a3defea054c46efc82d0698917298
CVE ID: CVE-2017-16614 State: PUBLISHED Published: 2018-03-30T21:00:00 Last Updated: 2024-08-05T20:27:04.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the plugins/payment/weixin/lib/WxPay.tedatac.php fBill parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/77