rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-3141 Windows service and uninstall paths are not quoted when BIND is installed
The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.
Problem types: description: This vulnerability exists in the installer delivered with BIND for Windows and not within BIND itself.  Non-Windows builds and installations are unaffected.  A manual installation of BIND where the service path is quoted when added would not be at risk.
Affected products: vendor: ISC
product: BIND 9
Credits: lang: en
value: ISC would like to thank John Page aka hyp3rlinx for reporting this issue.
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3142 An error in TSIG authentication can permit unauthorized zone transfers
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Problem types: description: An unauthorized AXFR (full zone transfer) permits an attacker to view the entire contents of a zone.  Protection of zone contents is often a commercial or business requirement. 
If accepted, a NOTIFY sets the zone refresh interval to 'now'.  If there is not already a refresh cycle in progress then named will initiate one by asking for the SOA RR from its list of masters.  If there is already a refresh cycle in progress, then named will queue the new refresh request.  If there is already a queued refresh request, the new NOTIFY will be discarded. Bogus notifications can't be used to force a zone transfer from a malicious server, but could trigger a high rate of zone refresh cycles.
Affected products: vendor: ISC
product: BIND 9
Credits: lang: en
value: ISC would like to thank Clément Berthaux from Synacktiv for reporting this issue.
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3143 An error in TSIG authentication can permit unauthorized dynamic updates
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
Problem types: description: A server that relies solely on TSIG keys with no other address-based ACL protection could be vulnerable to malicious zone content manipulation using this technique.

Note that the local update policy (configured with "update-policy local;" in named.conf) implicitly defines a key with a known key name (local-ddns) and default algorithm and no IP-based access controls on the zone updates.  In conjunction with this failure in TSIG verification, "update-policy local" is potentially very dangerous.
Affected products: vendor: ISC
product: BIND 9
Credits: lang: en
value: ISC would like to thank Clément Berthaux from Synacktiv for reporting this issue.
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3144 Failure to properly clean up closed OMAPI connections can exhaust available sockets
A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.
Problem types: description: By intentionally exploiting this vulnerability an attacker who is permitted to establish connections to the OMAPI control port can exhaust the pool of socket descriptors available to the DHCP server.

Once exhausted, the server will not accept additional connections, potentially denying access to legitimate connections from the server operator.  While the server will continue to receive and service DHCP client requests, the operator can be blocked from the ability to use OMAPI to control server state, add new lease reservations, etc.
Affected products: vendor: ISC
product: ISC DHCP
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3145 Improper fetch cleanup sequencing in the resolver can cause named to crash
BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.
Problem types: description: While this bug has existed in BIND since 9.0.0, there are no known code paths leading to it in ISC releases prior to those containing the fix for CVE-2017-3137.  Thus while all instances of BIND ought to be patched, only ISC versions [9.9.9-P8 to 9.9.11, 9.10.4-P8 to 9.10.6, 9.11.0-P5 to 9.11.2, 9.9.9-S10 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, and 9.12.0a1 to 9.12.0rc1] acting as DNSSEC validating resolvers are currently known to crash due to this bug.  The known crash is an assertion failure in netaddr.c.
Affected products: vendor: ISC
product: BIND 9
Credits: lang: en
value: ISC would like to thank Jayachandran Palanisamy of Cygate AB for making us aware of this vulnerability.
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3150 
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.
Problem types: description: Use of insecure cookies
Affected products: vendor: Apache Software Foundation
product: Apache Atlas
Published: 2017-08-29T20:00:00.000Z
CVE-2017-3151 
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.
Problem types: description: Persistent XSS vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Atlas
Published: 2017-08-29T20:00:00.000Z
CVE-2017-3152 
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.
Problem types: description: DOM XSS threat
Affected products: vendor: Apache Software Foundation
product: Apache Atlas
Published: 2017-08-29T20:00:00.000Z
CVE-2017-3153 
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.
Problem types: description: Reflected XSS vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Atlas
Published: 2017-08-29T20:00:00.000Z
CVE-2017-3154 
Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
Problem types: description: Stack trace in error response
Affected products: vendor: Apache Software Foundation
product: Apache Atlas
Published: 2017-08-29T20:00:00.000Z
CVE-2017-3155 
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.
Problem types: description: XFS - cross frame scripting vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Atlas
Published: 2017-08-29T20:00:00.000Z
CVE-2017-3156 
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
Problem types: description: Timing attack
Affected products: vendor: Apache Software Foundation
product: Apache CXF
Published: 2017-08-10T18:00:00.000Z
CVE-2017-3157 
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache OpenOffice
Published: 2017-11-20T20:00:00.000Z
CVE-2017-3158 
A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.
Problem types: description: Buffer Overflow
Affected products: vendor: Apache Software Foundation
product: Apache Guacamole
Published: 2018-01-18T20:00:00.000Z
CVE-2017-3159 
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
Problem types: description: Java deserialization
Affected products: vendor: Apache Software Foundation
product: Apache Camel
Published: 2017-03-07T15:00:00.000Z
CVE-2017-3160 
After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip
Problem types: description: Man-in-the-Middle vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Cordova Android
Published: 2018-02-01T21:00:00.000Z
CVE-2017-3161 
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.
Problem types: description: XSS
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Published: 2017-04-26T20:00:00.000Z
CVE-2017-3162 
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.
Problem types: description: Unchecked parameter in query string
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Published: 2017-04-26T20:00:00.000Z
CVE-2017-3163 
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache Solr
Published: 2017-08-30T14:00:00.000Z
CVE-2017-3164 
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.
Problem types: description: Server Side Request Forgery
Affected products: vendor: Apache Software Foundation
product: Apache Solr
Published: 2019-03-08T21:00:00.000Z
CVE-2017-3165 
In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to be a proof-of-concept exploit using this vulnerability.
Problem types: description: Cross-site scripting
Affected products: vendor: Apache Software Foundation
product: Apache Brooklyn
Published: 2017-09-13T16:00:00.000Z
CVE-2017-3166 
In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file.
Problem types: description: Privilege escalation
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Published: 2017-11-13T14:00:00.000Z
CVE-2017-3167 
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
Problem types: cwe_id: CWE-287
description: Authentication Bypass (CWE-287)
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Published: 2017-06-20T01:00:00.000Z
CVE-2017-3169 
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.
Problem types: cwe_id: CWE-476
description: Denial of Service (CWE-476)
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Published: 2017-06-20T01:00:00.000Z
CVE-2017-3180 Multiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scripting
Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The products and versions that are affected include the following: TIBCO Silver Fabric Enabler for Spotfire Web Player 2.1.2 and earlier TIBCO Spotfire Analyst 7.5.0 TIBCO Spotfire Analyst 7.6.0 TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Analytics Platform for AWS Marketplace 7.0.2 and earlier TIBCO Spotfire Automation Services 6.5.3 and earlier TIBCO Spotfire Automation Services 7.0.0, and 7.0.1 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 6.5.3 and earlier TIBCO Spotfire Deployment Kit 7.0.0, and 7.0.1 TIBCO Spotfire Deployment Kit 7.5.0 TIBCO Spotfire Deployment Kit 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 6.5.2 and earlier TIBCO Spotfire Desktop 7.0.0, and 7.0.1 TIBCO Spotfire Desktop 7.5.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.0.1 and earlier TIBCO Spotfire Desktop Language Packs 7.5.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 TIBCO Spotfire Professional 6.5.3 and earlier TIBCO Spotfire Professional 7.0.0 and 7.0.1 TIBCO Spotfire Web Player 6.5.3 and earlier TIBCO Spotfire Web Player 7.0.0 and 7.0.1
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: TIBCO
product: Silver Fabric Enabler for Spotfire Web Player
vendor: TIBCO
product: Spotfire Analyst
vendor: TIBCO
product: Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO
product: Spotfire Automation Services 6
vendor: TIBCO
product: Spotfire Connectors
vendor: TIBCO
product: Spotfire Deployment Kit
vendor: TIBCO
product: Spotfire Desktop
vendor: TIBCO
product: Spotfire Desktop Developer Edition
vendor: TIBCO
product: Spotfire Desktop Language Packs
vendor: TIBCO
product: Spotfire Professional
vendor: TIBCO
product: Spotfire Web Player
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3181 Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query
Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: TIBCO
product: Spotfire Analyst
vendor: TIBCO
product: Spotfire Connectors
vendor: TIBCO
product: Spotfire Deployment Kit
vendor: TIBCO
product: Spotfire Desktop
vendor: TIBCO
product: Spotfire Desktop Developer Edition
vendor: TIBCO
product: Spotfire Desktop Language Packs
vendor: TIBCO
product: Spotfire Web Player Client
vendor: TIBCO
product: Spotfire Client
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3182 On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attack
On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attack. ThreatMetrix is a security library for mobile applications, which aims to provide fraud prevention and device identity capabilities. The ThreatMetrix SDK versions prior to 3.2 do not validate SSL certificates on the iOS platform. An affected application will communicate with https://h-sdk.online-metrix.net, regardless of whether the connection is secure or not. An attacker on the same network as or upstream from the iOS device may be able to view or modify ThreatMetrix network traffic that should have been protected by HTTPS.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: ThreatMetrix
product: SDK
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3183 Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions
Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Sage XRT Treasury is a business finance management application. Database user access privileges are determined by the USER_CODE field associated with the querying user. By modifying the USER_CODE value to match that of a privileged user, a low-privileged, authenticated user may gain privileged access to the SQL database. A remote, authenticated user can submit specially crafted SQL queries to gain privileged access to the application database.
Problem types: cwe_id: CWE-639
description: CWE-639
Affected products: vendor: Sage
product: XRT Treasury
Credits: lang: en
value: Thanks to Victor Portal Gonzalez of Deloitte Spain for reporting this vulnerability.
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3184 
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unauthenticated, remote attacker can exploit this vulnerability by directly accessing the http://x.x.x.x/setup/setup_maintain_firmware-default.html page. This will allow an attacker to perform a factory reset on the device, leading to a denial of service condition or the ability to make use of default credentials (CVE-2017-3186).
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: ACTi Corporation
product: ACTi D, B, I, and E series cameras
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3185 
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources.
Problem types: cwe_id: CWE-598
description: CWE-598: Information Exposure Through Query Strings in GET Request
Affected products: vendor: ACTi Corporation
product: ACTi D, B, I, and E series cameras
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3186 
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take complete control of a device using default admin credentials.
Problem types: cwe_id: CWE-521
description: CWE-521: Weak Password Requirements
Affected products: vendor: ACTi Corporation
product: ACTi D, B, I, and E series cameras
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3187 The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery
The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: docCMS
product: Administration Panel
Credits: lang: en
value: Thanks to:

[1]SafeDog Penetration and Defense Lab:darong tong
[2]SafeDog Penetration and Defense Lab:yong cai
[3]shaohong wu 

for reporting these vulnerabilities.
Published: 2018-07-24T15:00:00.000Z