rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-6010 
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-16T11:00:00.000Z
CVE-2017-6011 
An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" source file. This affects icotool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-16T11:00:00.000Z
CVE-2017-6013 
Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T01:55:00.000Z
CVE-2017-6014 
In Wireshark 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, causing continuous attempts to read the same zero length packet. This will quickly exhaust all system memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T07:45:00.000Z
CVE-2017-6015 
Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, but not privileged local user to execute arbitrary code with elevated privileges on the system. CVSS v3 base score: 8.8, CVSS vector string: (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Rockwell Automation has released a new version of FactoryTalk Activation, Version 4.01, which addresses the identified vulnerability. Rockwell Automation recommends upgrading to the latest version of FactoryTalk Activation, Version 4.01 or later.
Problem types: cwe_id: CWE-428
description: Unquoted search path or element CWE-428
Affected products: vendor: Rockwell Automation
product: FactoryTalk Activation
Published: 2018-05-11T13:00:00.000Z
CVE-2017-6016 
An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. The following versions are affected: Versions 4.1 and prior versions released before January 20, 2017. An Improper Access Control vulnerability has been identified, which may allow an authenticated user to modify application files to escalate privileges.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: n/a
product: LCDS Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA
Published: 2017-05-19T02:43:00.000Z
CVE-2017-6017 
A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMXP342000, BMXP3420102, BMXP3420102CL, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H. A remote attacker could send a specially crafted set of packets to the PLC causing it to freeze, requiring the operator to physically press the reset button on the PLC in order to recover.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: Schneider Electric Modicon M340 PLC
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6018 
An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCom module (integrated as part number 8713142U), software versions prior to Version 012U000040, and SpaceStation (part number 8713140U) with installed SpaceCom module (part number 8713160U), software versions prior to Version 012U000040. The web server of the affected product accepts untrusted input which could allow attackers to redirect the request to an unintended URL contained within untrusted input.
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: n/a
product: B. Braun Medical SpaceCom
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6019 
An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the device may cause it to reboot.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: Schneider Electric Conext ComBox
Published: 2017-04-07T22:00:00.000Z
CVE-2017-6020 
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are not calling for absolute path sequences outside of their privilege level.
Problem types: cwe_id: CWE-22
description: Path traversal CWE-22
Affected products: vendor: LCDS - LeÃ£o Consultoria e Desenvolvimento de Sistemas LTDA ME
product: LAquis SCADA software
Published: 2018-04-17T14:00:00.000Z
CVE-2017-6021 
In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build 77.5882) and prior, an attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server that can cause the ClearSCADA server process and ClearSCADA communications driver processes to terminate. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: Schneider Electric SE
product: ClearSCADA
Published: 2018-05-14T14:00:00.000Z
CVE-2017-6022 
A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. They use hard-coded passwords to access the BD Kiestra Database, which could be leveraged to compromise the confidentiality of limited PHI/PII information stored in the BD Kiestra Database.
Problem types: cwe_id: CWE-259
description: CWE-259
Affected products: vendor: n/a
product: BD Kiestra PerformA and KLA Journal Service
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6023 
An issue was discovered in Fatek Automation PLC Ethernet Module. The affected Ether_cfg software configuration tool runs on the following Fatek PLCs: CBEH versions prior to V3.6 Build 170215, CBE versions prior to V3.6 Build 170215, CM55E versions prior to V3.6 Build 170215, and CM25E versions prior to V3.6 Build 170215. A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution or crash the affected device.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: Fatek Automation PLC Ethernet Module
Published: 2017-03-16T03:49:00.000Z
CVE-2017-6024 
A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V28.013; ControlLogix 5580 controllers V29.011; CompactLogix 5380 controllers V28.011; and CompactLogix 5380 controllers V29.011. This vulnerability may allow an attacker to cause a denial of service condition by sending a series of specific CIP-based commands to the controller.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: Rockwell Automation ControlLogix 5580 and CompactLogix 5380
Published: 2017-05-06T00:00:00.000Z
CVE-2017-6025 
A Stack Buffer Overflow issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web Server Versions 2.3 and prior. A malicious user could overflow the stack buffer by providing overly long strings to functions that handle the XML. Because the function does not verify string size before copying to memory, the attacker may then be able to crash the application or run arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: 3S-Smart Software Solutions GmbH CODESYS Web Server
Published: 2017-05-19T02:43:00.000Z
CVE-2017-6026 
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.
Problem types: cwe_id: CWE-330
description: CWE-330
Affected products: vendor: n/a
product: Schneider Electric Modicon PLCs
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6027 
An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web Server Versions 2.3 and prior. A specially crafted web server request may allow the upload of arbitrary files (with a dangerous type) to the CODESYS Web Server without authorization which may allow remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: n/a
product: 3S-Smart Software Solutions GmbH CODESYS Web Server
Published: 2017-05-19T02:43:00.000Z
CVE-2017-6028 
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials could then be used to log into the web application.
Problem types: cwe_id: CWE-522
description: CWE-522
Affected products: vendor: n/a
product: Schneider Electric Modicon PLCs
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6029 
A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Certec EDV GmbH atvise scada
Published: 2017-05-06T00:00:00.000Z
CVE-2017-6030 Schneider Electric Modicon PLCs Predictable Value Range from Previous Values
A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The affected products generate insufficiently random TCP initial sequence numbers that may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections.
Problem types: cwe_id: CWE-343
description: CWE-343
Affected products: vendor: Schneider Electric
product: Modicon M221
default_status: unaffected
vendor: Schneider Electric
product: Modicon M241
default_status: unaffected
vendor: Schneider Electric
product: Modicon M251
default_status: unaffected
Credits: lang: en
value: David Formby and Raheem Beyah of Georgia Tech and Fortiphyd Logic, Inc. reported the identified vulnerabilities.
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6031 
A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution.
Problem types: cwe_id: CWE-644
description: CWE-644
Affected products: vendor: n/a
product: Certec EDV GmbH atvise scada
Published: 2017-05-06T00:00:00.000Z
CVE-2017-6032 
A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks.
Problem types: cwe_id: CWE-657
description: CWE-657
Affected products: vendor: n/a
product: Schneider Electric Modicon Modbus Protocol
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6033 
A DLL Hijacking issue was discovered in Schneider Electric Interactive Graphical SCADA System (IGSS) Software, Version 12 and previous versions. The software will execute a malicious file if it is named the same as a legitimate file and placed in a location that is earlier in the search path.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: n/a
product: Schneider Electric Interactive Graphical SCADA System Software
Published: 2017-04-07T22:00:00.000Z
CVE-2017-6034 Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replay
An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download.
Problem types: cwe_id: CWE-294
description: CWE-294
Affected products: vendor: Schneider Electric
product: Modicon Modbus Protocol
default_status: unaffected
Credits: lang: en
value: Eran Goldstein of CRITIFENCE reported the identified vulnerabilities.
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6035 
A Stack-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. This vulnerability causes a buffer overflow, which could result in denial of service when a malicious project file is run on the system.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: Wecon Technologies LEVI Studio HMI Editor
Published: 2017-04-27T00:00:00.000Z
CVE-2017-6036 
A Server-Side Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web server receives a request, but does not sufficiently verify that the request is being sent to the expected destination.
Problem types: cwe_id: CWE-918
description: CWE-918
Affected products: vendor: n/a
product: Belden Hirschmann GECKO
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6037 
A Heap-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. This vulnerability causes a buffer overflow when a maliciously crafted project file is run by the system.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: n/a
product: Wecon Technologies LEVI Studio HMI Editor
Published: 2017-04-27T00:00:00.000Z
CVE-2017-6038 
A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: n/a
product: Belden Hirschmann GECKO
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6039 
A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow unauthorized access to the device.
Problem types: cwe_id: CWE-259
description: CWE-259
Affected products: vendor: n/a
product: Phoenix Broadband Technologies LLC PowerAgent SC3 Site Controller
Published: 2017-06-02T14:00:00.000Z
CVE-2017-6040 
An Information Exposure issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. Non-sensitive information can be obtained anonymously.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Belden Hirschmann GECKO
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6041 
An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. This vulnerability allows an attacker to modify the operation and upload firmware changes without detection.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: n/a
product: Marel Food Processing Systems
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6042 
A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: n/a
product: Sierra Wireless AirLink Raven XE and XT
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6043 
A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. The client does not properly validate the input or limit the amount of resources that are utilized by an attacker, which can be used to consume more resources than are available.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: Trihedral VTScada
Published: 2017-06-21T19:00:00.000Z
CVE-2017-6044 
An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Several files and directories can be accessed without authentication, which may allow a remote attacker to perform sensitive functions including arbitrary file upload, file download, and device reboot.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Sierra Wireless AirLink Raven XE and XT
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6045 
An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server application to unauthenticated users. These files may contain sensitive configuration information.
Problem types: cwe_id: CWE-548
description: CWE-548
Affected products: vendor: n/a
product: Trihedral VTScada
Published: 2017-06-21T19:00:00.000Z
CVE-2017-6046 
An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Sensitive information is insufficiently protected during transmission and vulnerable to sniffing, which could lead to information disclosure.
Problem types: cwe_id: CWE-522
description: CWE-522
Affected products: vendor: n/a
product: Sierra Wireless AirLink Raven XE and XT
Published: 2017-06-30T02:35:00.000Z
CVE-2017-6047 
Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentication.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287
Affected products: vendor: Detcon
product: Sitewatch Gateway
Published: 2019-04-02T19:39:32.000Z
CVE-2017-6048 
A Command Injection issue was discovered in Satel Iberia SenNet Data Logger and Electricity Meters: SenNet Optimal DataLogger V5.37c-1.43c and prior, SenNet Solar Datalogger V5.03-1.56a and prior, and SenNet Multitask Meter V5.21a-1.18b and prior. Successful exploitation of this vulnerability could result in the attacker breaking out of the jailed shell and gaining full access to the system.
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: n/a
product: Satel Iberia SenNet Data Logger and Electricity Meters
Published: 2017-05-19T02:43:00.000Z
CVE-2017-6049 
Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL.
Problem types: cwe_id: CWE-256
description: PLAINTEXT STORAGE OF A PASSWORD CWE-256
Affected products: vendor: Detcon
product: Sitewatch Gateway
Published: 2019-04-02T19:39:25.000Z
CVE-2017-6050 
A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user input, which may allow for an unauthenticated attacker to remotely execute arbitrary code in the form of SQL queries.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: n/a
product: Ecava IntegraXor
Published: 2017-06-21T19:00:00.000Z
CVE-2017-6051 
An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: n/a
product: BLF-Tech LLC VisualView HMI
Published: 2017-05-08T17:00:00.000Z
CVE-2017-6052 
A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified endpoints.
Problem types: cwe_id: CWE-300
description: CWE-300
Affected products: vendor: n/a
product: Hyundai Motor America Blue Link
Published: 2017-04-26T14:00:00.000Z
CVE-2017-6053 
A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JavaScript code supplied by the attacker to execute within the user's browser.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Trihedral VTScada
Published: 2017-06-21T19:00:00.000Z
CVE-2017-6054 
A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-coded decryption password to protect sensitive user information.
Problem types: cwe_id: CWE-321
description: CWE-321
Affected products: vendor: n/a
product: Hyundai Motor America Blue Link
Published: 2017-04-26T14:00:00.000Z
CVE-2017-6055 
XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T20:00:00.000Z
CVE-2017-6056 
It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T07:45:00.000Z
CVE-2017-6058 
Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2017-6059 
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T20:00:00.000Z