Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-9386 State: PUBLISHED Published: 2019-06-17T19:31:01 Last Updated: 2024-08-05T17:02:44.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "get_file.sh" which allows a user to retrieve any file stored in the "cmh-ext" folder on the device. However, the "filename" parameter is not validated correctly and this allows an attacker to directory traverse outside the /cmh-ext folder and read any file on the device. It is necessary to create the folder "cmh-ext" on the device which can be executed by an attacker first in an unauthenticated fashion and th
reate the folder "cmh-ext" on the device which can be executed by an attacker first in an unauthenticated fashion and then execute a directory traversal attack. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
CVE ID: CVE-2017-9387 State: PUBLISHED Published: 2019-06-17T19:13:37 Last Updated: 2024-08-05T17:02:44.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called relay.sh which is used for creating new SSH relays for the device so that the device connects to Vera servers. All the parameters passed in this specific script are logged to a log file called log.relay in the /tmp folder. The user can also read all the log files from the device using a script called log.sh. However, when the script loads the log files it displays them with content-type text/html and passes a
pt called log.sh. However, when the script loads the log files it displays them with content-type text/html and passes all the logs through the ansi2html binary which converts all the character text including HTML meta-characters correctly to be displayed in the browser. This allows an attacker to use the log files as a storing mechanism for the XSS payload and thus whenever a user navigates to that log.sh script, it enables the XSS payload and allows an attacker to execute his malicious payload on the user's browser. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_se
ences: - https://seclists.org/bugtraq/2019/Jun/8 - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
CVE ID: CVE-2017-9388 State: PUBLISHED Published: 2019-06-17T16:52:59 Last Updated: 2024-08-05T17:02:44.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific request to and from from another website. This is primarily used as a method of communication between the device and Vera website when the user is logged in to the https://home.getvera.com and allows the device to communicate between the
era website when the user is logged in to the https://home.getvera.com and allows the device to communicate between the device and website. One of the parameters retrieved by this specific script is "url". This parameter is not sanitized by the script correctly and is passed in a call to "eval" to execute "curl" functionality. This allows an attacker to escape from the executed command and then execute any commands of his/her choice. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html - https://github.com/ethanhunnt/IoT_vulnerab
s/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
CVE ID: CVE-2017-9389 State: PUBLISHED Published: 2019-06-17T19:26:35 Last Updated: 2024-08-05T17:02:44.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device allows a user to install applications written in the Lua programming language. Also the interface allows any user to write his/her application in the Lua language. However, this functionality is not protected by authentication and this allows an attacker to run arbitrary Lua code on the device. The POST request is forwarded to L
y authentication and this allows an attacker to run arbitrary Lua code on the device. The POST request is forwarded to LuaUPNP daemon on the device. This binary handles the received Lua code in the function "LU::JobHandler_LuaUPnP::RunLua(LU::JobHandler_LuaUPnP *__hidden this, LU::UPnPActionWrapper *)". The value in the "code" parameter is then passed to the function "LU::LuaInterface::RunCode(char const*)" which actually loads the Lua engine and runs the code. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html - https://github
packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
CVE ID: CVE-2017-9390 State: PUBLISHED Published: 2019-06-17T19:04:34 Last Updated: 2024-08-05T17:02:44.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called connect.sh which is supposed to return a specific cookie for the user when the user is authenticated to https://home.getvera.com. One of the parameters retrieved by this script is "RedirectURL". However, the application lacks strict input validation of this parameter and this allows an attacker to execute the client-side code on this application. Additional Analyst Notes: - CVE Program Container: References:
ker to execute the client-side code on this application. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
CVE ID: CVE-2017-9391 State: PUBLISHED Published: 2019-06-17T20:05:31 Last Updated: 2024-08-05T17:02:44.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the service actions for a normal user to retrieve an image from a camera that is controlled by the controller. It seems that the "URL" parameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to overflow the
rameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to overflow the buffer. The function "LU::Generic_IP_Camera_Manager::REQ_Image" is activated when the lu_request_image is passed as the "id" parameter in query string. This function then calls "LU::Generic_IP_Camera_Manager::GetUrlFromArguments" and passes a "pointer" to the function where it will be allowed to store the value from the URL parameter. This pointer is passed as the second parameter $a2 to the function "LU::Generic_IP_Camera_Manager::GetUrlFromArguments". However, neither the callee or the caller in this case performs a simple length check and as a result an attacker who is a
wever, neither the callee or the caller in this case performs a simple length check and as a result an attacker who is able to send more than 1336 characters can easily overflow the values stored on the stack including the $RA value and thus execute code on the device. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
CVE ID: CVE-2017-9392 State: PUBLISHED Published: 2019-06-17T20:12:38 Last Updated: 2024-08-05T17:02:44.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the service actions for a normal user to retrieve an image from a camera that is controlled by the controller. It seems that the "res" (resolution) parameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to
esolution) parameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to overflow the buffer. The function "LU::Generic_IP_Camera_Manager::REQ_Image" is activated when the lu_request_image is passed as the "id" parameter in the query string. This function then calls "LU::Generic_IP_Camera_Manager::GetUrlFromArguments". This function retrieves all the parameters passed in the query string including "res" and then uses the value passed in it to fill up buffer using the sprintf function. However, the function in this case lacks a simple length check and as a result an attacker who is able to send more than 184 characters can easily overflow the val
simple length check and as a result an attacker who is able to send more than 184 characters can easily overflow the values stored on the stack including the $RA value and thus execute code on the device. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
CVE ID: CVE-2017-9393 State: PUBLISHED Published: 2017-09-22T14:00:00Z Last Updated: 2024-09-17T03:02:02.761Z Vendors: CA Technologies Products: Identity Manager Problem Types: Information Disclosure Description: CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100956 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html
CVE ID: CVE-2017-9394 State: PUBLISHED Published: 2017-11-14T21:00:00Z Last Updated: 2024-09-17T02:26:32.330Z Vendors: CA Technologies Products: CA Identity Governance Problem Types: CWE-79 Description: A stored cross-site scripting vulnerability in CA Identity Governance 12.6 allows remote authenticated attackers to display HTML or execute script in the context of another user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101849 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20171114-01--security-notice-for-ca-identity-governance.html
CVE ID: CVE-2017-9403 State: PUBLISHED Published: 2017-06-02T19:00:00 Last Updated: 2024-08-05T17:02:44.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://bugzilla.maptools.org/show_bug.cgi?id=2689 - http://www.debian.org/security/2017/dsa-3903
CVE ID: CVE-2017-9404 State: PUBLISHED Published: 2017-06-02T19:00:00 Last Updated: 2024-08-05T17:02:44.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3602-1/ - http://bugzilla.maptools.org/show_bug.cgi?id=2688 - http://www.debian.org/security/2017/dsa-3903
CVE ID: CVE-2017-9405 State: PUBLISHED Published: 2017-06-02T19:00:00Z Last Updated: 2024-09-16T17:43:27.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/457
CVE ID: CVE-2017-9406 State: PUBLISHED Published: 2017-06-02T19:00:00 Last Updated: 2024-08-05T17:02:44.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4079 - https://security.gentoo.org/glsa/201801-17 - https://bugs.freedesktop.org/show_bug.cgi?id=100775
CVE ID: CVE-2017-9407 State: PUBLISHED Published: 2017-06-02T19:00:00Z Last Updated: 2024-09-16T23:41:56.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/459
CVE ID: CVE-2017-9408 State: PUBLISHED Published: 2017-06-02T19:00:00 Last Updated: 2024-08-05T17:02:44.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=100776 - https://www.debian.org/security/2018/dsa-4079 - https://security.gentoo.org/glsa/201801-17
CVE ID: CVE-2017-9409 State: PUBLISHED Published: 2017-06-02T19:00:00Z Last Updated: 2024-09-17T03:34:28.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/458
CVE ID: CVE-2017-9410 State: REJECTED Published: 2017-07-27T06:00:00 Last Updated: 2019-09-04T16:01:54 Description: No description available.
CVE ID: CVE-2017-9411 State: REJECTED Published: 2017-07-27T06:00:00 Last Updated: 2019-09-04T16:16:58 Description: No description available.
CVE ID: CVE-2017-9412 State: PUBLISHED Published: 2017-07-27T06:00:00 Last Updated: 2024-08-05T17:02:44.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/63 - https://www.exploit-db.com/exploits/42390/
CVE ID: CVE-2017-9413 State: PUBLISHED Published: 2017-07-25T18:00:00 Last Updated: 2024-08-05T17:02:44.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or (2) update Internet Radio Settings via the urlRedirectCustomUrl parameter to networkSettings.view. NOTE: These vulnerabilities can be exploited to conduct server-side request forgery (SSRF) attacks. Additional Analyst Notes: - CVE Program Container: References: - http://p
ct server-side request forgery (SSRF) attacks. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/142794/Subsonic-6.1.1-Server-Side-Request-Forgery.html - https://www.exploit-db.com/exploits/42118/
CVE ID: CVE-2017-9414 State: PUBLISHED Published: 2018-02-05T16:00:00 Last Updated: 2024-08-05T17:02:44.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting (XSS) attacks or possibly have unspecified other impact via the name parameter to playerSettings.view. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42120/ - http://packetstormsecurity.com/files/142796/Subsonic-6.1.1-Persistent-XSS.html - http://hyp3rl
-db.com/exploits/42120/ - http://packetstormsecurity.com/files/142796/Subsonic-6.1.1-Persistent-XSS.html - http://hyp3rlinx.altervista.org/advisories/SUBSONIC-CSRF-PERSISTENT-XSS.txt
CVE ID: CVE-2017-9415 State: PUBLISHED Published: 2017-07-21T14:00:00 Last Updated: 2024-08-05T17:02:44.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42117/
CVE ID: CVE-2017-9416 State: PUBLISHED Published: 2017-06-03T23:00:00 Last Updated: 2024-08-05T17:02:44.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/17394
CVE ID: CVE-2017-9417 State: PUBLISHED Published: 2017-06-03T23:00:00 Last Updated: 2024-08-05T17:02:44.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-07-01 - https://www.blackhat.com/us-17/briefings.html#broadpwn-remotely-compromising-android-and-ios-via-a-bug-in-broadcoms-wi-fi-chipsets - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-9417 - http://www.securityfocus.com/bid/99482 - http://www.securitytrac
ft.com/en-US/security-guidance/advisory/CVE-2017-9417 - http://www.securityfocus.com/bid/99482 - http://www.securitytracker.com/id/1038950 - https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html - http://www.securitytracker.com/id/1039330 - http://seclists.org/fulldisclosure/2019/May/24 - https://support.apple.com/kb/HT210121 - https://seclists.org/bugtraq/2019/May/30
CVE ID: CVE-2017-9418 State: PUBLISHED Published: 2017-06-12T13:00:00 Last Updated: 2024-08-05T17:02:44.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8845 - https://www.exploit-db.com/exploits/42166/
CVE ID: CVE-2017-9419 State: PUBLISHED Published: 2017-06-15T19:00:00 Last Updated: 2024-08-05T17:02:44.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8848
CVE ID: CVE-2017-9420 State: PUBLISHED Published: 2017-06-05T19:00:00 Last Updated: 2024-08-05T17:02:44.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter. Additional Analyst Notes: - CVE Program Container: References: - http://spiffycalendar.sunnythemes.com/version-3-3-0/ - https://wpvulndb.com/vulnerabilities/8842 - http://www.securityfocus.com/bid/98931
CVE ID: CVE-2017-9421 State: PUBLISHED Published: 2018-05-24T13:00:00 Last Updated: 2024-08-05T17:02:44.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jer1nj0y/Vulns/blob/master/Kiteworks%20Vulnerability
CVE ID: CVE-2017-9422 State: REJECTED Published: 2017-06-06T16:00:00 Last Updated: 2017-06-06T15:57:01 Description: No description available.
CVE ID: CVE-2017-9424 State: PUBLISHED Published: 2017-06-22T16:00:00 Last Updated: 2024-08-05T17:02:44.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization. Additional Analyst Notes: - CVE Program Container: References: - http://breeze.github.io/doc-net/release-notes.html - https://www.blackhat.com/us-17/briefings.html#friday-the-13th-json-attacks
CVE ID: CVE-2017-9425 State: PUBLISHED Published: 2018-02-26T04:00:00 Last Updated: 2024-08-05T17:02:44.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action. Additional Analyst Notes: - CVE Program Container: References: - http://touhidshaikh.com/blog/poc/facetag-ext-piwigo-stored-xss/ - https://www.youtube.com/watch?v=_ha7XBT_Omo - https://www.exploit-db.com/exploits/42098/
CVE ID: CVE-2017-9426 State: PUBLISHED Published: 2018-02-26T04:00:00 Last Updated: 2024-08-05T17:02:44.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=MVCe_zYtFsQ - https://www.exploit-db.com/exploits/42094/ - http://touhidshaikh.com/blog/poc/facetag-extension-piwigo-sqli/