rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-15947 
Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp, formgb.asp, and msggb.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-28T00:00:00.000Z
CVE-2017-15948 
Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-28T00:00:00.000Z
CVE-2017-15949 
Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log_id parameter to admin/editgroup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-28T00:00:00.000Z
CVE-2017-15950 
Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the "Destination directory" field, either within an XML document or through use of passive mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T14:00:00.000Z
CVE-2017-15951 
The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-28T02:00:00.000Z
CVE-2017-15953 
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-28T21:00:00.000Z
CVE-2017-15954 
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-28T21:00:00.000Z
CVE-2017-15955 
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUE (.cue) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-28T21:00:00.000Z
CVE-2017-15956 
ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15957 
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15958 
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15959 
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-2007-6576.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15960 
Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15961 
iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15962 
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15963 
iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15964 
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15965 
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15966 
The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15967 
Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the edit parameter to admin/template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15968 
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15969 
PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_catalog/category.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15970 
PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15971 
Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email field, a related issue to CVE-2017-15972.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15972 
SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email field, a related issue to CVE-2017-15971.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15973 
Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15974 
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15975 
Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15976 
ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15977 
Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15978 
AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15979 
Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15980 
US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15981 
Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15982 
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15983 
MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15984 
Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15985 
Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15986 
CPA Lead Reward Script allows SQL Injection via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15987 
Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15988 
Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15989 
Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15990 
Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15991 
Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15992 
Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15993 
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-31T07:00:00.000Z
CVE-2017-15994 
rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T06:00:00.000Z
CVE-2017-15996 
elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T17:00:00.000Z
CVE-2017-15997 
In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T17:00:00.000Z
CVE-2017-15998 
In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T17:00:00.000Z
CVE-2017-15999 
In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash value is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T17:00:00.000Z
CVE-2017-16000 
SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-29T17:00:00.000Z
CVE-2017-16001 
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T17:00:00.000Z
CVE-2017-16003 
windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: windows-build-tools node module
Published: 2018-05-29T20:00:00.000Z
CVE-2017-16005 
Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: HackerOne
product: http-signature node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16006 
Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: remarkable node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16007 
node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: HackerOne
product: node-jose node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16008 
i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: i18next node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16009 
ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: ag-grid node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16010 
i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but is not. This vulnerability affects i18next 2.0.0 and later.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: i18next node module
Published: 2018-05-29T20:00:00.000Z
CVE-2017-16013 
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: hapi node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16014 
Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causing a denial of service.
Problem types: cwe_id: CWE-703
description: Improper Check or Handling of Exceptional Conditions (CWE-703)
Affected products: vendor: HackerOne
product: http-proxy node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16015 
Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting
Problem types: cwe_id: CWE-80
description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
Affected products: vendor: HackerOne
product: forms node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16016 
Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: sanitize-html node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16017 
sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: sanitize-html node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16018 
Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: restify node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16019 
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: gitbook node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16020 
Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: HackerOne
product: summit node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16021 
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: uri-js node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16022 
Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: Morris.js node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16023 
Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values, which can be used to create a denial of service attack.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: decamelize node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16024 
The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.
Problem types: cwe_id: CWE-377
description: Insecure Temporary File (CWE-377)
Affected products: vendor: HackerOne
product: sync-exec node module
Published: 2018-06-04T19:00:00.000Z