deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14450
Published: 2018-04-24
Description: A buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2.0.2. A specially crafted GIF image can lead to a buffer overflow on a global section. An attacker can display an image to trigger this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: https://lists.debian.org/debian-lts-announce/2018/04/msg00005.html; https://security.gentoo.org/glsa/201903-17; https://www.debian.org/security/2018/dsa-4177
CVE: CVE-2017-2802
Published: 2018-04-24
Description: An exploitable dll hijacking vulnerability exists in the poaService.exe service component of the Dell Precision Optimizer software version 3.5.5.0. A specifically named malicious dll file located in one of directories pointed to by the PATH environment variable will lead to privilege escalation. An attacker with local access to vulnerable system can exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/99360; https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0247; http://www.securityfocus.com/bid/99360
CVE: CVE-2017-2803
Published: 2018-04-24
Description: A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 version 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific TIFF file to trigger this vulnerability. This vulnerability only exists in the 64-bit version.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/99900; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0297; http://www.securityfocus.com/bid/99900
CVE: CVE-2017-2804
Published: 2018-04-24
Description: A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661. A specially crafted TIFF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific TIFF file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/99900; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0298; http://www.securityfocus.com/bid/99900
CVE: CVE-2017-2811
Published: 2018-04-24
Description: A code execution vulnerability exists in the Kakadu SDK 7.9's parsing of compressed JPEG 2000 images. A specially crafted JPEG 2000 file can be read by the program, and can lead to an out of bounds write causing an exploitable condition to arise.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/100141; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0308; http://www.securityfocus.com/bid/100141
CVE: CVE-2017-2812
Published: 2018-04-24
Description: A code execution vulnerability exists in the kdu_buffered_expand function of the Kakadu SDK 7.9. A specially crafted JPEG 2000 file can be read by the program and can lead to an out of bounds write causing an exploitable condition to arise.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/100140; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0309; http://www.securityfocus.com/bid/100140
CVE: CVE-2017-2832
Published: 2018-04-24
Description: An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/99184; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0335; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2833
Published: 2018-04-24
Description: An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the boot process. To trigger this vulnerability, an attacker needs to send an HTTP request and reboot the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/99184; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0334; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2834
Published: 2018-04-24
Description: An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle attack to trigger this vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/99942; https://www.debian.org/security/2017/dsa-3923; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0336
CVE: CVE-2017-2835
Published: 2018-04-24
Description: An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://www.debian.org/security/2017/dsa-3923; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0337; https://www.debian.org/security/2017/dsa-3923
CVE: CVE-2017-2836
Published: 2018-04-24
Description: An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use man in the middle to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/99942; https://www.debian.org/security/2017/dsa-3923; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0338
CVE: CVE-2017-2837
Published: 2018-04-24
Description: An exploitable denial of service vulnerability exists within the handling of security data in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use man in the middle to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190
References: http://www.securityfocus.com/bid/99942; https://www.debian.org/security/2017/dsa-3923; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0339
CVE: CVE-2017-2838
Published: 2018-04-24
Description: An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use man in the middle to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190
References: http://www.securityfocus.com/bid/99942; https://www.debian.org/security/2017/dsa-3923; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0340
CVE: CVE-2017-2839
Published: 2018-04-24
Description: An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use man in the middle to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/99942; https://www.debian.org/security/2017/dsa-3923; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0341
CVE: CVE-2017-2840
Published: 2018-04-24
Description: A buffer overflow vulnerability exists in the ISO parsing functionality of EZB Systems UltraISO 9.6.6.3300. A specially crafted .ISO file can cause a vulnerability resulting in potential code execution. An attacker can provide a specific .ISO file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.securityfocus.com/bid/100084; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0342; http://www.securityfocus.com/bid/100084
CVE: CVE-2017-2885
Published: 2018-04-24
Description: An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/160388/ProCaster-LE-32F430-GStreamer-souphttpsrc-libsoup-2.51.3-Stack-Overflow.html; http://seclists.org/fulldisclosure/2020/Dec/3; http://www.securityfocus.com/bid/100258
CVE: CVE-2017-2899
Published: 2018-04-24
Description: An exploitable integer overflow exists in the TIFF loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.tif' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0406
CVE: CVE-2017-2900
Published: 2018-04-24
Description: An exploitable integer overflow exists in the PNG loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.png' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0407
CVE: CVE-2017-2901
Published: 2018-04-24
Description: An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0408
CVE: CVE-2017-2902
Published: 2018-04-24
Description: An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0409
CVE: CVE-2017-2903
Published: 2018-04-24
Description: An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0410
CVE: CVE-2017-2904
Published: 2018-04-24
Description: An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.hdr' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0411
CVE: CVE-2017-2905
Published: 2018-04-24
Description: An exploitable integer overflow exists in the bmp loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.bmp' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0412
CVE: CVE-2017-2906
Published: 2018-04-24
Description: An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0413
CVE: CVE-2017-2907
Published: 2018-04-24
Description: An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0414
CVE: CVE-2017-2908
Published: 2018-04-24
Description: An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to render the thumbnail for the file while in the File->Open dialog.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0415
CVE: CVE-2017-2918
Published: 2018-04-24
Description: An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html; https://www.debian.org/security/2018/dsa-4248; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0425
CVE: CVE-2017-2923
Published: 2018-04-24
Description: An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/100807; https://www.debian.org/security/2017/dsa-3976; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430
CVE: CVE-2017-2924
Published: 2018-04-24
Description: An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/100799; https://www.debian.org/security/2017/dsa-3976; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431
CVE: CVE-2018-3836
Published: 2018-04-24
Description: An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An attacker can provide a malicious path as input to an application that passes attacker data to this function to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://lists.debian.org/debian-lts-announce/2018/02/msg00019.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0516; https://lists.debian.org/debian-lts-announce/2018/02/msg00019.html
CVE: CVE-2013-3947
Published: 2018-04-24
Description: Buffer overflow in MedCoreD.sys in AhnLab V3 Internet Security 8.0.7.5 (Build 1373) allows local users to gain privileges via a crafted 0xA3350014 IOCTL call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-264
References: http://secunia.com/advisories/54465; https://exchange.xforce.ibmcloud.com/vulnerabilities/90626; http://secunia.com/advisories/54465
CVE: CVE-2013-7245
Published: 2018-04-24
Description: The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging failure to validate credentials, aka SAP Security Note 1927859.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: http://blog.spiderlabs.com/2014/01/sap-sybase-ase-157-security-updates.html; https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-035.txt; http://blog.spiderlabs.com/2014/01/sap-sybase-ase-157-security-updates.html
CVE: CVE-2017-17557
Published: 2018-04-24
Description: In Foxit Reader before 9.1 and Foxit PhantomPDF before 9.1, a flaw exists within the parsing of the BITMAPINFOHEADER record in BMP files. The issue results from the lack of proper validation of the biSize member, which can result in a heap based buffer overflow. An attacker can leverage this to execute code in the context of the current process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103999; http://www.securitytracker.com/id/1040733; https://blog.0patch.com/2018/05/0patching-foxit-reader-buffer-oops.html
CVE: CVE-2018-10361
Published: 2018-04-25
Description: An issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary files in the KTextEditor's kauth_ktexteditor_helper service (as utilized in the Kate text editor) can allow other unprivileged users on the local system to gain root privileges. The attack occurs when one user (who has an unprivileged account but is also able to authenticate as root) writes a text file using Kate into a directory owned by a another unprivileged user. The latter unprivileged user conducts a symlink attack to achieve privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2018/04/24/1; http://www.openwall.com/lists/oss-security/2019/07/09/3; https://bugzilla.suse.com/show_bug.cgi?id=1033055
CVE: CVE-2018-10362
Published: 2018-04-25
Description: An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-provided login password, it is possible to login with a simpler password if the password has the form of a power in scientific notation (like '2e2' for '200' or '0e1234' for '0'). This is possible because, in the loose comparison case, PHP interprets the string as a number in scientific notation, and thus converts it to a number. After that, the comparison with '==' casts the user input (e.g., the string '200' or '0') to a number, too. Hence the attacker can login with just a '0' or a simple number he has to brute force. Strong comparison with '===' prevents the cast into numbers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://k3research.outerhaven.de/posts/small-mistakes-lead-to-big-problems.html; https://github.com/phpLiteAdmin/pla/issues/11; http://k3research.outerhaven.de/posts/small-mistakes-lead-to-big-problems.html
CVE: CVE-2018-10310
Published: 2018-04-25
Description: A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/147333/WordPress-UK-Cookie-Consent-2.3.9-Cross-Site-Scripting.html; https://gist.github.com/B0UG/9732614abccaf2893c352d14c822d07b; https://wordpress.org/plugins/uk-cookie-consent/#developers
CVE: CVE-2018-10366
Published: 2018-04-25
Description: An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rainlab/user-plugin/commit/098c2bc907443d67e9e18645f850e3de42941d20; https://www.exploit-db.com/exploits/44546/; https://github.com/rainlab/user-plugin/commit/098c2bc907443d67e9e18645f850e3de42941d20
CVE: CVE-2018-10367
Published: 2018-04-25
Description: An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/135; https://github.com/wuzhicms/wuzhicms/issues/135
CVE: CVE-2018-10368
Published: 2018-04-25
Description: An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an announcement.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/136; https://github.com/wuzhicms/wuzhicms/issues/136
CVE: CVE-2018-10372
Published: 2018-04-25
Description: process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/103976; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3032