deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14835
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the page method of XFA Layout objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5027.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-879; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-14836
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the modDate attribute of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5028.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-880; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-14837
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the pageSpan method of XFA Layout objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5029.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-881; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16571
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of references to the app object from FormCalc. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5072.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-882; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16572
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within FormCalc's closeDoc method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5073.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-883; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16573
Published: 2017-12-20
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of LZWDecode filters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5078.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-884; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16574
Published: 2017-12-20
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of Image filters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5079.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-885; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16575
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA's bind element. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5091.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-886; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16576
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within XFA's field element. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5092.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-887; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16577
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the alignment attribute of Field objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5094.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-888; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16578
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the picture elements within XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5216.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-889; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16579
Published: 2017-12-20
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5244.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-890; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16580
Published: 2017-12-20
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ImageField node of XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5281.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-891; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16581
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the author attribute of the Document object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5282.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-892; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16582
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the clearItems XFA method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5288.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-893; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16583
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the datasets element of XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5289.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-894; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16584
Published: 2017-12-20
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within util.printf. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5290.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-895; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16585
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the app.response method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5294.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-896; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16586
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAnnot method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5295.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-897; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16587
Published: 2017-12-20
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5296.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-898; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16588
Published: 2017-12-20
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SOT markers. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-4976.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-856; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-16589
Published: 2017-12-20
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of the yTsiz member of SIZ markers. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-4977.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://zerodayinitiative.com/advisories/ZDI-17-857; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-4933
Published: 2017-12-20
Description: VMware ESXi (6.5 before ESXi[PII_REDACTED]01-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this issue could result in remote code execution in a virtual machine via the authenticated VNC session. Note: In order for exploitation to be possible in ESXi, VNC must be manually enabled in a virtual machine's .vmx configuration file. In addition, ESXi must be configured to allow VNC traffic through the built-in firewall.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securitytracker.com/id/1040024; http://www.securitytracker.com/id/1040025; https://www.vmware.com/security/advisories/VMSA-2017-0021.html
CVE: CVE-2017-4940
Published: 2017-12-20
Description: The ESXi Host Client in VMware ESXi (6.5 before ESXi[PII_REDACTED]03-SG, 5.5 before ESXi[PII_REDACTED]03-SG and 5.5 before ESXi[PII_REDACTED]02-SG) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker can exploit this vulnerability by injecting Javascript, which might get executed when other users access the Host Client.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1040024; https://www.vmware.com/security/advisories/VMSA-2017-0021.html; http://www.securitytracker.com/id/1040024
CVE: CVE-2017-4941
Published: 2017-12-20
Description: VMware ESXi (6.0 before ESXi[PII_REDACTED]01-SG, 5.5 ESXi[PII_REDACTED]01-SG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this issue could result in remote code execution in a virtual machine via the authenticated VNC session. Note: In order for exploitation to be possible in ESXi, VNC must be manually enabled in a virtual machine's .vmx configuration file. In addition, ESXi must be configured to allow VNC traffic through the built-in firewall.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040024; http://www.securitytracker.com/id/1040025; https://www.vmware.com/security/advisories/VMSA-2017-0021.html
CVE: CVE-2017-4943
Published: 2017-12-20
Description: VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securitytracker.com/id/1040026; https://www.vmware.com/security/advisories/VMSA-2017-0021.html; http://www.securitytracker.com/id/1040026
CVE: CVE-2017-17752
Published: 2017-12-20
Description: Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/43378/; https://www.exploit-db.com/exploits/43378/
CVE: CVE-2017-16818
Published: 2017-12-20
Description: RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://bugzilla.redhat.com/show_bug.cgi?id=1515872; https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6VJA32U7HKGDRJQDJVM7JBYWD4T7BJL/
CVE: CVE-2017-17476
Published: 2017-12-20
Description: Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://github.com/OTRS/otrs/commit/26707eaaa791648e6c7ad6aeaa27efd70e7c66eb; https://github.com/OTRS/otrs/commit/36e3be99cfe8a9e09afa1b75fdc39f3e28f561fc; https://github.com/OTRS/otrs/commit/720c73fbf53e476ca7dfdf2ae1d4d3d2aad2b953
CVE: CVE-2017-12072
Published: 2017-12-20
Description: Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/en-global/support/security/Synology_SA_17_80; https://www.synology.com/en-global/support/security/Synology_SA_17_80