deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7389
Published: 2017-04-01
Description: Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97310; https://github.com/gunet/openeclass/issues/11; http://www.securityfocus.com/bid/97310
CVE: CVE-2017-7390
Published: 2017-04-01
Description: A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data (mail) passed to the 'SocialNetwork-andrea/app/template/pw_forgot.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97312; https://github.com/andreas83/SocialNetwork/issues/84; http://www.securityfocus.com/bid/97312
CVE: CVE-2017-7391
Published: 2017-04-01
Description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97311; https://github.com/dweeves/magmi-git/issues/522; https://github.com/dweeves/magmi-git/pull/525
CVE: CVE-2017-7392
Published: 2017-04-01
Description: In TigerVNC 1.7.1 (SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt), an unauthenticated client can cause a small memory leak in the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/97305; https://access.redhat.com/errata/RHSA-2017:2000; https://github.com/TigerVNC/tigervnc/pull/441
CVE: CVE-2017-7393
Published: 2017-04-01
Description: In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: http://www.securityfocus.com/bid/97305; https://access.redhat.com/errata/RHSA-2017:2000; https://github.com/TigerVNC/tigervnc/pull/438
CVE: CVE-2017-7394
Published: 2017-04-01
Description: In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97305; https://access.redhat.com/errata/RHSA-2017:2000; https://github.com/TigerVNC/tigervnc/pull/440
CVE: CVE-2017-7395
Published: 2017-04-01
Description: In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://www.securityfocus.com/bid/97305; https://access.redhat.com/errata/RHSA-2017:2000; https://github.com/TigerVNC/tigervnc/pull/436
CVE: CVE-2017-7396
Published: 2017-04-01
Description: In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/97305; https://access.redhat.com/errata/RHSA-2017:2000; https://github.com/TigerVNC/tigervnc/pull/436
CVE: CVE-2016-7585
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves mishandling of DMA in the "EFI" component. It allows physically proximate attackers to discover the FileVault 2 encryption password via a crafted Thunderbolt adapter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2367
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/97130; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2376
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/97129; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2377
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97129; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2378
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during drag-and-drop actions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97129; http://www.securitytracker.com/id/1038137; https://support.apple.com/HT207600
CVE: CVE-2017-2379
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Carbon" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted .dfont file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97137; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207601
CVE: CVE-2017-2380
Published: 2017-04-02
Description: An issue was discovered in certain Apple products.  iOS before 10.3 is affected.  The issue involves the Simple Certificate Enrollment Protocol (SCEP) implementation in the "Profiles" component.  It allows remote attackers to bypass cryptographic protection mechanisms by leveraging DES support.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.securityfocus.com/bid/97138; https://support.apple.com/HT207617; http://www.securityfocus.com/bid/97138
CVE: CVE-2017-2381
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "sudo" component. It allows remote authenticated users to gain privileges by leveraging membership in the admin group on a network directory server.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2382
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS Server before 5.3 is affected. The issue involves the "Wiki Server" component. It allows remote attackers to enumerate user accounts via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97128; http://www.securitytracker.com/id/1038144; https://support.apple.com/HT207604
CVE: CVE-2017-2383
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. The issue involves cleartext client-certificate transmission in the "APNs Server" component. It allows man-in-the-middle attackers to track users via correlation with this certificate.
CVSS Score: 3.1 (LOW)
References: http://www.securityfocus.com/bid/97175; http://www.securitytracker.com/id/1038157; https://support.apple.com/HT207599
CVE: CVE-2017-2384
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves mishandling of deletion within the SQLite subsystem of the "Safari" component. It allows local users to identify the web-site visits that occurred in Private Browsing mode.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97138; http://www.securitytracker.com/id/1038139; https://support.apple.com/HT207617
CVE: CVE-2017-2385
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "Safari Login AutoFill" component. It allows local users to obtain access to locked keychain items via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97136; http://www.securitytracker.com/id/1038137; https://support.apple.com/HT207600
CVE: CVE-2017-2386
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/97130; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2388
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "IOFireWireFamily" component. It allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2389
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof an HTTP authentication sheet or cause a denial of service via a crafted web site.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/97129; http://www.securitytracker.com/id/1038137; https://support.apple.com/HT207600
CVE: CVE-2017-2390
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves symlink mishandling in the "libarchive" component. It allows local users to change arbitrary directory permissions via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.securityfocus.com/bid/97137; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207601
CVE: CVE-2017-2391
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. Pages before 6.1, Numbers before 4.1, and Keynote before 7.1 on macOS and Pages before 3.1, Numbers before 3.1, and Keynote before 3.1 on iOS are affected. The issue involves the "Export" component. It allows users to bypass iWork PDF password protection by leveraging use of 40-bit RC4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326
References: http://www.securityfocus.com/bid/97126; http://www.securitytracker.com/id/1038134; http://www.securitytracker.com/id/1038135
CVE: CVE-2017-2392
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2393
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Safari Reader" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97138; http://www.securitytracker.com/id/1038139; https://support.apple.com/HT207617
CVE: CVE-2017-2394
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97130; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2395
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97130; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2396
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97130; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2397
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Accounts" component. It allows physically proximate attackers to discover an Apple ID by reading an iCloud authentication prompt on the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97138; http://www.securitytracker.com/id/1038139; https://support.apple.com/HT207617
CVE: CVE-2017-2398
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97147; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2399
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Pasteboard" component. It allows physically proximate attackers to read the pasteboard by leveraging the use of an encryption key derived only from the hardware UID (rather than that UID in addition to the user passcode).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-326
References: http://www.securityfocus.com/bid/97138; http://www.securitytracker.com/id/1038139; https://support.apple.com/HT207617
CVE: CVE-2017-2400
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "SafariViewController" component. It allows attackers to obtain sensitive information by leveraging the SafariViewController's incorrect synchronization of Safari cache clearing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97138; http://www.securitytracker.com/id/1038139; https://support.apple.com/HT207617
CVE: CVE-2017-2401
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97137; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207601
CVE: CVE-2017-2402
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves mishandling of profile uninstall actions in the "MCX Client" component when a profile has multiple payloads. It allows remote attackers to bypass intended access restrictions by leveraging Active Directory certificate trust that should not have remained.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2403
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Printing" component. A format-string vulnerability allows remote attackers to execute arbitrary code via a crafted ipp: or ipps: URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2404
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Quick Look" component. It allows remote attackers to trigger telephone calls to arbitrary numbers via a tel: URL in a PDF document, as exploited in the wild in October 2016.
CVSS Score: 3.3 (LOW)
CWE: CWE-601
References: http://www.securityfocus.com/bid/97138; http://www.securitytracker.com/id/1038139; https://support.apple.com/HT207617
CVE: CVE-2017-2405
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97129; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2406
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "FontParser" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97137; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207601
CVE: CVE-2017-2407
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "FontParser" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97137; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207601
CVE: CVE-2017-2408
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "IOATAFamily" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2409
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Menus" component. It allows attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted app.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2410
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2412
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle attackers to modify the client-server data stream to iTunes sandbox web services by leveraging use of cleartext HTTP.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: http://www.securityfocus.com/bid/97138; http://www.securitytracker.com/id/1038139; https://support.apple.com/HT207617
CVE: CVE-2017-2413
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "QuickTime" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted media file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97140; http://www.securitytracker.com/id/1038138; https://support.apple.com/HT207615
CVE: CVE-2017-2414
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "DataAccess" component. It allows remote attackers to access Exchange traffic in opportunistic circumstances by leveraging a mistake in typing an e-mail address.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97138; http://www.securitytracker.com/id/1038139; https://support.apple.com/HT207617
CVE: CVE-2017-2415
Published: 2017-04-02
Description: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code by leveraging an unspecified "type confusion."
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/97143; http://www.securitytracker.com/id/1038137; https://security.gentoo.org/glsa/201706-15