deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-0383
Published: 2017-01-12
Description: An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1. Android ID: A-31677614.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/95243; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95243
CVE: CVE-2017-0384
Published: 2017-01-12
Description: An elevation of privilege vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32095626.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/95239; https://android.googlesource.com/platform/frameworks/av/+/321ea5257e37c8edb26e66fe4ee78cca4cd915fe; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0385
Published: 2017-01-12
Description: An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32585400.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/95239; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95239
CVE: CVE-2017-0386
Published: 2017-01-12
Description: An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32255299.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/95256; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95256
CVE: CVE-2017-0387
Published: 2017-01-12
Description: An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32660278.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/95258; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95258
CVE: CVE-2017-0388
Published: 2017-01-12
Description: An elevation of privilege vulnerability in the External Storage Provider could enable a local secondary user to read data from an external storage SD card inserted by the primary user. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32523490.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95252; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95252
CVE: CVE-2017-0389
Published: 2017-01-12
Description: A denial of service vulnerability in core networking could enable a remote attacker to use specially crafted network packet to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31850211.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/95251; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95251
CVE: CVE-2017-0390
Published: 2017-01-12
Description: A denial of service vulnerability in Tremolo/dpen.s in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31647370.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/95230; https://android.googlesource.com/platform/external/tremolo/+/5dc99237d49e73c27d3eca54f6ccd97d13f94de0; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0391
Published: 2017-01-12
Description: A denial of service vulnerability in decoder/ihevcd_decode.c in libhevc in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32322258.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/95230; http://www.securitytracker.com/id/1038623; https://android.googlesource.com/platform/external/libhevc/+/a33f6725d7e9f92330f995ce2dcf4faa33f6433f
CVE: CVE-2017-0392
Published: 2017-01-12
Description: A denial of service vulnerability in VBRISeeker.cpp in libstagefright in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32577290.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/95230; https://android.googlesource.com/platform/frameworks/av/+/453b351ac5bd2b6619925dc966da60adf6b3126c; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0393
Published: 2017-01-12
Description: A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-30436808.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/95230; https://android.googlesource.com/platform/external/libvpx/+/6886e8e0a9db2dbad723dc37a548233e004b33bc; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0394
Published: 2017-01-12
Description: A denial of service vulnerability in Telephony could enable a remote attacker to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31752213.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/95255; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95255
CVE: CVE-2017-0395
Published: 2017-01-12
Description: An elevation of privilege vulnerability in Contacts could enable a local malicious application to silently create contact information. This issue is rated as Moderate because it is a local bypass of user interaction requirements (access to functionality that would normally require either user initiation or user permission). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32219099.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/95261; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95261
CVE: CVE-2017-0396
Published: 2017-01-12
Description: An information disclosure vulnerability in visualizer/EffectVisualizer.cpp in libeffects in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31781965.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95232; https://android.googlesource.com/platform/frameworks/av/+/557bd7bfe6c4895faee09e46fc9b5304a956c8b7; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0397
Published: 2017-01-12
Description: An information disclosure vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32377688.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95232; https://android.googlesource.com/platform/frameworks/av/+/7a3246b870ddd11861eda2ab458b11d723c7f62c; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0399
Published: 2017-01-12
Description: An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32588756.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95226; https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0400
Published: 2017-01-12
Description: An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32584034.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95226; https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0401
Published: 2017-01-12
Description: An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32588016.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95226; https://android.googlesource.com/platform/frameworks/av/+/321ea5257e37c8edb26e66fe4ee78cca4cd915fe; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2017-0402
Published: 2017-01-12
Description: An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32436341.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95226; https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac; https://android.googlesource.com/platform/hardware/qcom/audio/+/d72ea85c78a1a68bf99fd5804ad9784b4102fe57
CVE: CVE-2017-0403
Published: 2017-01-12
Description: An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32402548.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/95274; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95274
CVE: CVE-2017-0404
Published: 2017-01-12
Description: An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32510733.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/95281; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95281
CVE: CVE-2016-7790
Published: 2017-01-12
Description: Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploader_paste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/09/22/6; http://www.securityfocus.com/bid/93119; http://www.openwall.com/lists/oss-security/2016/09/22/6
CVE: CVE-2016-7791
Published: 2017-01-12
Description: Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?install_sample=../../files/exploit', which leads to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/09/29/11; http://www.securityfocus.com/bid/93119; http://www.openwall.com/lists/oss-security/2016/09/29/11
CVE: CVE-2016-8221
Published: 2017-01-12
Description: Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules (IOMs), certain log files viewable by authenticated users may contain passwords for internal administrative LXCA accounts with temporary passwords that are used internally by LXCA code.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/95417; https://support.lenovo.com/us/en/product_security/LEN_10605; http://www.securityfocus.com/bid/95417
CVE: CVE-2016-8605
Published: 2017-01-12
Description: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-275
References: http://www.openwall.com/lists/oss-security/2016/10/12/1; http://www.securityfocus.com/bid/93510; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABAA77BQJGNKOOBRV4DK/
CVE: CVE-2016-8606
Published: 2017-01-12
Description: The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/10/12/2; http://www.securityfocus.com/bid/93514; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QTAGSDCTYXTABAA77BQJGNKOOBRV4DK/
CVE: CVE-2015-6501
Published: 2017-01-12
Description: Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the string parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/93845; https://puppet.com/security/cve/CVE-2015-6501; http://www.securityfocus.com/bid/93845
CVE: CVE-2016-10027
Published: 2017-01-12
Description: Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2016/12/22/12; http://www.securityfocus.com/bid/95129; https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-security-advisory-2016-11-22
CVE: CVE-2016-3149
Published: 2017-01-12
Description: Barco ClickShare CSC-1 devices with firmware before 01.09.03 and CSM-1 devices with firmware before 01.06.02 allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/139713/Barco-ClickShare-XSS-Remote-Code-Execution-Path-Traversal.html; http://www.securityfocus.com/archive/1/539754/100/0/threaded; http://www.securityfocus.com/bid/94323
CVE: CVE-2016-3150
Published: 2017-01-12
Description: Cross-site scripting (XSS) vulnerability in wallpaper.php in the Base Unit in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with firmware before 01.06.02, and CSE-200 devices with firmware before 01.03.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/139713/Barco-ClickShare-XSS-Remote-Code-Execution-Path-Traversal.html; http://www.securityfocus.com/archive/1/539754/100/0/threaded; http://www.securityfocus.com/bid/94330
CVE: CVE-2016-3151
Published: 2017-01-12
Description: Directory traversal vulnerability in the wallpaper parsing functionality in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with firmware before 01.06.02, and CSE-200 devices with firmware before 01.03.02 allows remote attackers to read /etc/shadow via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/139713/Barco-ClickShare-XSS-Remote-Code-Execution-Path-Traversal.html; http://www.securityfocus.com/archive/1/539754/100/0/threaded; http://www.securityfocus.com/bid/94330
CVE: CVE-2016-3152
Published: 2017-01-12
Description: Barco ClickShare CSC-1 devices with firmware before 01.09.03 allow remote attackers to obtain the root password by downloading and extracting the firmware image.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://packetstormsecurity.com/files/139713/Barco-ClickShare-XSS-Remote-Code-Execution-Path-Traversal.html; http://www.securityfocus.com/archive/1/539754/100/0/threaded; http://www.securityfocus.com/bid/94326
CVE: CVE-2016-5715
Published: 2017-01-12
Description: Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txt; http://packetstormsecurity.com/files/139302/Puppet-Enterprise-Web-Interface-Open-Redirect.html; http://www.securityfocus.com/archive/1/539618/100/0/threaded
CVE: CVE-2016-5737
Published: 2017-01-12
Description: The Gerrit configuration in the Openstack Puppet module for Gerrit (aka puppet-gerrit) improperly marks text/html as a safe mimetype, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a crafted review.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/06/22/2; http://www.securityfocus.com/bid/91352; https://github.com/openstack-infra/puppet-gerrit/commit/8573c2ee172f66c1667de49685c88fdc8883ca8b
CVE: CVE-2016-6492
Published: 2017-01-12
Description: The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges via a crafted application that makes an MT6573FDVTIOC_T_SET_FDCONF_CMD IOCTL call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/138113/MediaTek-Driver-Privilege-Escalation.html; http://www.securityfocus.com/archive/1/539058/100/0/threaded; http://www.securityfocus.com/bid/92207
CVE: CVE-2016-9299
Published: 2017-01-12
Description: The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-90
References: http://www.openwall.com/lists/oss-security/2016/11/12/4; http://www.openwall.com/lists/oss-security/2016/11/14/9; http://www.securityfocus.com/bid/94281
CVE: CVE-2016-10135
Published: 2017-01-13
Description: An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any application that resides on the device. Namely, the com.mediatek.mtklogger.framework.LogReceiver and com.mediatek.mtklogger.framework.MTKLoggerService application components are exported since they contain an intent filter, are not protected by a custom permission, and do not explicitly set the android:exported attribute to false. Therefore, these components are exported by default and are thus accessible to any third party application by using android.content.Intent object for communication. These application components can be used to start and stop the logs using Intent objects with embedded data. The available logs are the GPS log, modem log, network log, and mobile log. The base directory that contains the directories for the 4 types of logs is /sdcard/mtklog which makes them accessible to apps that require the READ_EXTERNAL_STORAGE permission. The GPS log contains the GPS coordinates of the user as well as a timestamp for the coordinates. The modem log contains AT commands and their parameters which allow the user's outgoing and incoming calls and text messages to be obtained. The network log is a tcpdump network capture. The mobile log contains the Android log, which is not available to third-party apps as of Android 4.1. The LG ID is LVE-SMP-160019.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96846; https://lgsecurity.lge.com/security_updates.html; http://www.securityfocus.com/bid/96846