deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-16793
Published: 2017-11-12
Description: The wav_convert2mono function in lib/wav.c in SWFTools 0.9.2 does not properly validate WAV data, which allows remote attackers to cause a denial of service (incorrect malloc and heap-based buffer overflow) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/matthiaskramm/swftools/issues/47; https://github.com/matthiaskramm/swftools/issues/47
CVE: CVE-2017-16794
Published: 2017-11-12
Description: The png_load function in lib/png.c in SWFTools 0.9.2 does not properly validate a multiplication of width and bits-per-pixel values, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an erroneous png_load call that occurs because of incorrect integer data types in png2swf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/matthiaskramm/swftools/issues/50; https://github.com/matthiaskramm/swftools/issues/50
CVE: CVE-2017-16796
Published: 2017-11-12
Description: In SWFTools 0.9.2, the png_load function in lib/png.c does not check the return value of a realloc call, which allows remote attackers to cause a denial of service (invalid write and application crash) or possibly have unspecified other impact via vectors involving an IDAT tag in a crafted PNG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/matthiaskramm/swftools/issues/51; https://github.com/matthiaskramm/swftools/issues/51
CVE: CVE-2017-16797
Published: 2017-11-12
Description: In SWFTools 0.9.2, the png_load function in lib/png.c does not properly validate an alloclen_64 multiplication of width and height values, which allows remote attackers to cause a denial of service (integer overflow, heap-based buffer overflow, and application crash) or possibly have unspecified other impact via a crafted PNG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://github.com/matthiaskramm/swftools/issues/51; https://github.com/matthiaskramm/swftools/issues/51
CVE: CVE-2017-16798
Published: 2017-11-12
Description: In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md; https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md
CVE: CVE-2017-16799
Published: 2017-11-12
Description: In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1_name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md; https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md
CVE: CVE-2017-13782
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a /dev/dtracehelper attack involving the dtrace_dif_variable and dtrace_getarg functions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/172827/Apple-XNU-Kernel-Memory-Exposure.html; http://www.securitytracker.com/id/1039710; https://lgtm.com/blog/apple_xnu_dtrace_CVE-2017-13782
CVE: CVE-2017-13783
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13784
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13785
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13786
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "APFS" component. It does not properly restrict the DMA mapping time of FileVault decryption buffers, which allows attackers to read cleartext APFS data via a crafted Thunderbolt adapter.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13788
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13789
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. Safari before 11.0.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1039706; https://support.apple.com/HT208223; http://www.securitytracker.com/id/1039706
CVE: CVE-2017-13790
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. Safari before 11.0.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1039706; https://support.apple.com/HT208223; http://www.securitytracker.com/id/1039706
CVE: CVE-2017-13791
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13792
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13793
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13794
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13795
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13796
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13797
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/HT208219; https://support.apple.com/HT208222; https://support.apple.com/HT208223
CVE: CVE-2017-13798
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13799
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://support.apple.com/HT208219; https://support.apple.com/HT208220
CVE: CVE-2017-13800
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "APFS" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13801
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Dictionary Widget" component. It allows attackers to read local files if pasted text is used in a search.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13802
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13803
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039703; https://security.gentoo.org/glsa/201712-01; https://support.apple.com/HT208219
CVE: CVE-2017-13804
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involves the "StreamingZip" component. It allows remote attackers to write to unintended pathnames via a crafted ZIP archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1039703; https://support.apple.com/HT208219; https://support.apple.com/HT208220
CVE: CVE-2017-13805
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. iOS before 11.1 is affected. The issue involves the "Siri" component. It allows physically proximate attackers to obtain sensitive information via a Siri request for private-content notifications that should not have been available in the lock-screen state.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: http://www.securitytracker.com/id/1039703; https://support.apple.com/HT208222; http://www.securitytracker.com/id/1039703
CVE: CVE-2017-13807
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Audio" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a crafted QuickTime file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13808
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Remote Management" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13809
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "AppleScript" component. It allows remote attackers to execute arbitrary code via a crafted AppleScript file that is mishandled by osadecompile.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13810
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Kernel" component. It allows local users to obtain sensitive information by leveraging an error in packet counters.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13811
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "fsck_msdos" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13812
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "libarchive" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted archive file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13813
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "libarchive" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13814
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13815
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the third-party "file" product. Versions before 5.31 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13816
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "libarchive" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13817
Published: 2017-11-13
Description: An out-of-bounds read issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Kernel" component. It allows local users to bypass intended memory-read restrictions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13818
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13819
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "HelpViewer" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML by bypassing the Same Origin Policy for quarantined HTML documents.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13820
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "ATS" component. It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted font.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13821
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "CFString" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710
CVE: CVE-2017-13822
Published: 2017-11-13
Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Quick Look" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1039710; https://support.apple.com/HT208221; http://www.securitytracker.com/id/1039710