Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-17414 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.400Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was
SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4225. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-979
CVE ID: CVE-2017-17415 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.391Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Count method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Wa
t SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4226. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-980
CVE ID: CVE-2017-17416 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.424Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus GetPlugins method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying databas
struct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4227. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-981
CVE ID: CVE-2017-17417 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.300Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Acknowledge method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying databa
nstruct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4228. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46446/ - https://zerodayinitiative.com/advisories/ZDI-17-982
CVE ID: CVE-2017-17418 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.423Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPolicy Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-C
ueries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4229. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-983
CVE ID: CVE-2017-17419 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.145Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUTransferHistory Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database.
uct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4230. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-984
CVE ID: CVE-2017-17420 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.135Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobCountHistory Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database.
uct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4231. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-985
CVE ID: CVE-2017-17421 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.389Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUSelectionSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was
SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4232. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-986
CVE ID: CVE-2017-17422 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.436Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-C
ueries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4233. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-975
CVE ID: CVE-2017-17423 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.338Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupSegment Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Wa
t SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4234. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-976
CVE ID: CVE-2017-17424 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.408Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUScheduleSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was
SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4235. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-977
CVE ID: CVE-2017-17425 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T20:51:31.654Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-89 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUSourceDeviceSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database.
uct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4237. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-17-987
CVE ID: CVE-2017-17426 State: PUBLISHED Published: 2017-12-05T17:00:00Z Last Updated: 2024-09-16T16:32:49.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22375 - https://sourceware.org/git/gitweb.cgi?p=glibc.gi
: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22375 - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=34697694e8a93b325b18f25f7dcded55d6baeaf6
CVE ID: CVE-2017-17427 State: PUBLISHED Published: 2017-12-13T16:00:00 Last Updated: 2024-08-05T20:51:31.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack ("Bleichenbacher attack"). This allows an attacker to decrypt observed traffic that has been encrypted with the RSA cipher and to perform other private key operations. Additional Analyst Notes: - CVE Program Container: References: - https://robotattack.org/ - http://www.securityfocus.com/bid/102199 - https://www.kb.cert.org/vuls/id/144389 - https://support.radware.com/app/answers/answer_view/a_id/101
s.com/bid/102199 - https://www.kb.cert.org/vuls/id/144389 - https://support.radware.com/app/answers/answer_view/a_id/1010361/~/cve-2017-17427-adaptive-chosen-ciphertext-attack-vulnerability
CVE ID: CVE-2017-17428 State: PUBLISHED Published: 2018-03-05T18:00:00 Last Updated: 2024-08-05T20:51:31.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102170 - https://www.cavium.com/security-advisory-cve-2017-17428.html - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher - http://www.securitytracker.com/id/1039984 - https://
er/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher - http://www.securitytracker.com/id/1039984 - https://www.kb.cert.org/vuls/id/144389
CVE ID: CVE-2017-17429 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:51:31.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: In K7 Antivirus Premium before 15.1.0.53, user-controlled input to the K7Sentry device is not sufficiently authenticated: a local user with a LOW integrity process can access a raw hard disk by sending a specific IOCTL. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-5th-December-2017
CVE ID: CVE-2017-17430 State: PUBLISHED Published: 2017-12-07T08:00:00 Last Updated: 2024-08-05T20:51:31.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp.sangoma.com/nsc/2.3/Changelog
CVE ID: CVE-2017-17431 State: PUBLISHED Published: 2017-12-05T21:00:00Z Last Updated: 2024-09-16T23:26:06.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765. Additional Analyst Notes: - CVE Program Container: References: - https://code610.blogspot.com/2017/12/modus-operandi-genixcms-115.html
CVE ID: CVE-2017-17432 State: PUBLISHED Published: 2017-12-06T00:00:00 Last Updated: 2024-08-05T20:51:31.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value. Additional Analyst Notes: - CVE Program Container: References: - https://www.openafs.org/pages/security/OPENAFS-SA-2017-001.txt - https://bugs.debian.org/883602 - https://www.debian.org/security/2017/dsa-4067 - https://lists.debian.org/debian-lts-announce/2017/1
.debian.org/883602 - https://www.debian.org/security/2017/dsa-4067 - https://lists.debian.org/debian-lts-announce/2017/12/msg00016.html
CVE ID: CVE-2017-17433 State: PUBLISHED Published: 2017-12-06T03:00:00 Last Updated: 2024-08-05T20:51:31.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: References: - http://security.cucumberlinux.com/security/details.php?id=169 - https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=3e06d40029cfdce9d0f73d87cfd4edaf54be9c51 - https://www.d
.php?id=169 - https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=3e06d40029cfdce9d0f73d87cfd4edaf54be9c51 - https://www.debian.org/security/2017/dsa-4068 - https://lists.debian.org/debian-lts-announce/2017/12/msg00020.html
CVE ID: CVE-2017-17434 State: PUBLISHED Published: 2017-12-06T03:00:00 Last Updated: 2024-08-05T20:51:31.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://git.samba.org/?p=rsync.git%3Ba=commit%3
ctions. Additional Analyst Notes: - CVE Program Container: References: - https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=70aeb5fddd1b2f8e143276f8d5a085db16c593b9 - http://security.cucumberlinux.com/security/details.php?id=170 - https://www.debian.org/security/2017/dsa-4068 - https://lists.debian.org/debian-lts-announce/2017/12/msg00020.html - https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=5509597decdbd7b91994210f700329d8a35e70a1
CVE ID: CVE-2017-17435 State: PUBLISHED Published: 2017-12-07T00:00:00 Last Updated: 2024-08-05T20:51:31.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request, the safe does not check the PIN code, so an attacker can obtain authorization using any value. Once an attacker sees the Bluetooth Low Energy (BLE) advertisement for the safe, they need only to write a BLE characteristic to enable no
ees the Bluetooth Low Energy (BLE) advertisement for the safe, they need only to write a BLE characteristic to enable notifications, and send a crafted getAuthor packet that returns a temporary key, and an unlock packet including that temporary key. The safe then opens after the unlock packet is processed, with no verification of PIN or other credentials. Additional Analyst Notes: - CVE Program Container: References: - https://vaulteksafe.com/index.php/cve-2017-17435/ - https://www.twosixlabs.com/bluesteal-popping-gatt-safes/
CVE ID: CVE-2017-17436 State: PUBLISHED Published: 2017-12-07T00:00:00 Last Updated: 2024-08-05T20:51:31.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and "Data transmissions are secure via AES256 bit encryption." These claims, however, are not true. Moreover, AES256 bit encryption is not supported in the Bluetooth Low Energy (BLE) standard, so it would have to be at the application lev
it encryption is not supported in the Bluetooth Low Energy (BLE) standard, so it would have to be at the application level. This lack of encryption allows an individual to learn the passcode by eavesdropping on the communications between the application and the safe. Additional Analyst Notes: - CVE Program Container: References: - https://vaulteksafe.com/index.php/cve-2017-17435/ - https://www.twosixlabs.com/bluesteal-popping-gatt-safes/
CVE ID: CVE-2017-17439 State: PUBLISHED Published: 2017-12-06T15:00:00 Last Updated: 2024-08-05T20:51:31.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878144 -
itional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878144 - https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887 - http://www.h5l.org/pipermail/heimdal-announce/2017-December/000008.html - http://www.h5l.org/pipermail/heimdal-discuss/2017-August/000259.html - https://github.com/heimdal/heimdal/issues/353 - http://h5l.org/advisories.html?show=2017-12-08 - https://www.debian.org/security/2017/dsa-4055
CVE ID: CVE-2017-17440 State: PUBLISHED Published: 2017-12-06T17:00:00 Last Updated: 2024-08-05T20:51:31.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, as demonstrated by the EXTRACTOR_xm_extract_method function in plugins/xm_extractor.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00005.html - https://bugs.debian.org/883528#35 - https://lists.gnu.org/archive/html/bug
html/bug-libextractor/2017-11/msg00005.html - https://bugs.debian.org/883528#35 - https://lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00001.html - https://lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00000.html - http://www.securityfocus.com/bid/102116 - https://lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00002.html - https://gnunet.org/git/libextractor.git/commit/?id=7cc63b001ceaf81143795321379c835486d0c92e - https://lists.gnu.org/archive/html/bug-libextractor/2017-11/msg00004.html
CVE ID: CVE-2017-17442 State: PUBLISHED Published: 2018-03-13T18:00:00Z Last Updated: 2024-09-17T03:07:25.995Z Vendors: BlackBerry Products: UEM Management Console Problem Types: Reflected cross-site scripting vulnerability Description: In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the context of the affected UEM Management Console account by crafting a malicious link and then persuading a user with legitimate access to the Management Console to click on the malicious link. Additional Analyst Notes: - CVE Program Container: References: - http://support.blackberry.com/k
on the malicious link. Additional Analyst Notes: - CVE Program Container: References: - http://support.blackberry.com/kb/articleDetail?articleNumber=000047227