rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-3647 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Problem types: description: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Affected products: vendor: Oracle Corporation
product: MySQL Server
Published: 2017-08-08T15:00:00.000Z
CVE-2017-3648 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Problem types: description: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Affected products: vendor: Oracle Corporation
product: MySQL Server
Published: 2017-08-08T15:00:00.000Z
CVE-2017-3649 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-08T15:00:00.000Z
CVE-2017-3650 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: C API). Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Problem types: description: Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server accessible data.
Affected products: vendor: Oracle Corporation
product: MySQL Server
Published: 2017-08-08T15:00:00.000Z
CVE-2017-3651 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Server accessible data.
Affected products: vendor: Oracle Corporation
product: MySQL Server
Published: 2017-08-08T15:00:00.000Z
CVE-2017-3652 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Problem types: description: Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Server accessible data as well as  unauthorized read access to a subset of MySQL Server accessible data.
Affected products: vendor: Oracle Corporation
product: MySQL Server
Published: 2017-08-08T15:00:00.000Z
CVE-2017-3653 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).
Problem types: description: Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Server accessible data.
Affected products: vendor: Oracle Corporation
product: MySQL Server
Published: 2017-08-08T15:00:00.000Z
CVE-2017-3718 
Improper setting of device configuration in system firmware for Intel(R) NUC kits may allow a privileged user to potentially enable escalation of privilege via physical access.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel(R) NUC
Published: 2019-01-10T20:00:00.000Z
CVE-2017-3730 Bad (EC)DHE parameters cause a client crash
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
Problem types: description: NULL pointer deference
Affected products: vendor: OpenSSL
product: OpenSSL
Credits: lang: en
value: Guido Vranken
Published: 2017-05-04T19:00:00.000Z
CVE-2017-3731 Truncated packet could crash via OOB read
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
Problem types: description: out-of-bounds read
Affected products: vendor: OpenSSL
product: OpenSSL
Credits: lang: en
value: Robert Święcki of Google
Published: 2017-05-04T19:00:00.000Z
CVE-2017-3732 BN_mod_exp may produce incorrect results on x86_64
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem.
Problem types: description: carry-propagating bug
Affected products: vendor: OpenSSL
product: OpenSSL
Credits: lang: en
value: OSS-Fuzz project
Published: 2017-05-04T19:00:00.000Z
CVE-2017-3733 Encrypt-Then-Mac renegotiation crash
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.
Problem types: description: protocol error
Affected products: vendor: OpenSSL
product: OpenSSL
Credits: lang: en
value: Joe Orton (Red Hat)
Published: 2017-05-04T19:00:00.000Z
CVE-2017-3735 
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
Problem types: description: out of bounds read
Affected products: vendor: OpenSSL Software Foundation
product: OpenSSL
Published: 2017-08-28T19:00:00.000Z
CVE-2017-3736 
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.
Problem types: description: carry-propagating bug
Affected products: vendor: OpenSSL Software Foundation
product: OpenSSL
Published: 2017-11-02T17:00:00.000Z
CVE-2017-3737 
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.
Problem types: description: Unauthenticated read/unencrypted write
Affected products: vendor: OpenSSL Software Foundation
product: OpenSSL
Published: 2017-12-07T16:00:00.000Z
CVE-2017-3738 
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.
Problem types: description: carry-propagating bug
Affected products: vendor: OpenSSL Software Foundation
product: OpenSSL
Published: 2017-12-07T16:00:00.000Z
CVE-2017-3740 
In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controller, which could cause a denial of service attack on the system or the ability to alter hardware functionality.
Problem types: description: Denial of Service
Affected products: vendor: Lenovo Group Ltd.
product: Active Protection System
Published: 2017-06-03T00:00:00.000Z
CVE-2017-3741 
In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly. This issue only affects ThinkPad X1 Carbon 5th generation.
Problem types: description: Alter trackpoint functionality
Affected products: vendor: Lenovo Group Ltd.
product: Power Management Driver
Published: 2017-06-03T00:00:00.000Z
CVE-2017-3742 
In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files, the password for this ad-hoc connection will be stored in a user-readable location. An attacker with read access to the user's contents could connect to the Connect2 hotspot and see the contents of files while they are being transferred between the two systems.
Problem types: description: Disclosure of ad-hoc wifi network key stored in user-readable location
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Connect2
Published: 2017-07-17T19:00:00.000Z
CVE-2017-3743 
If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing.
Problem types: description: Sensitive information disclosure
Affected products: vendor: Lenovo Group Ltd.
product: ToolsCenter
Published: 2017-06-20T00:00:00.000Z
CVE-2017-3744 
In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands.
Problem types: description: Disclosure of login credentials to user with local privileges
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo System x IMM2
Published: 2017-06-20T00:00:00.000Z
CVE-2017-3745 
In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts with administrative privileges. This is an issue only for users who have used local authentication with LXCA and not remote authentication against external LDAP or ADFS servers.
Problem types: description: Disclosure of credentials to a non-administrative user
Affected products: vendor: Lenovo Group Ltd.
product: XClarity Administrator
Published: 2017-06-20T00:00:00.000Z
CVE-2017-3746 
ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerability that could allow a local user to execute arbitrary code with administrative or system level privileges.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: ThinkPad USB 3.0 Ethernet Adapter Driver
Published: 2017-08-28T20:00:00.000Z
CVE-2017-3747 
Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not affected) that could allow an attacker with local privileges on a system to alter registry keys.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Nerve Center
Published: 2017-06-29T15:00:00.000Z
CVE-2017-3748 
On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user (commonly known as 'rooting' or "jail breaking" a device).
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Vibe and Lenovo China-only Moto Mobile Phones
Published: 2017-06-29T15:00:00.000Z
CVE-2017-3749 
On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Vibe and Lenovo China-only Moto Mobile Phones
Published: 2017-06-29T15:00:00.000Z
CVE-2017-3750 
On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3749.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Vibe and Lenovo China-only Moto Mobile Phones
Published: 2017-06-29T15:00:00.000Z
CVE-2017-3751 
An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0. This could allow an attacker with local privileges to execute code with administrative privileges.
Problem types: description: Privilege Escalation
Affected products: vendor: Lenovo Group Ltd.
product: ThinkPad Compact USB Keyboard with TrackPoint Driver
Published: 2017-08-10T00:00:00.000Z
CVE-2017-3752 
An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. Exploitation of these implementation flaws may result in attackers being able to erase or alter the routing tables of one or many routers, switches, or other devices that support OSPF within a routing domain.
Problem types: description: Erasure or alteration of routing tables within a routing domain
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo and IBM Switch Products
Published: 2017-08-09T21:00:00.000Z
CVE-2017-3753 
A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V.
Problem types: description: Execution of code in System Management Mode by an attacker with local administrative access
Affected products: vendor: Lenovo Group Ltd.
product: Desktop and Notebook BIOS
Published: 2017-08-10T00:00:00.000Z
CVE-2017-3754 
Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to flash the BIOS with an arbitrary image and potentially run malicious BIOS code.
Problem types: description: BIOS Write Protections Improperly Configured
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Notebook BIOS
Published: 2017-07-17T19:00:00.000Z
CVE-2017-3756 
A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with local privileges could execute code with administrative privileges via an unquoted service path.
Problem types: description: Privilege Escalation
Affected products: vendor: Lenovo Group Ltd.
product: ThinkPad Active Protection System
Published: 2017-08-18T19:00:00.000Z
CVE-2017-3757 
An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges.
Problem types: description: Privilege escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo ElanTech Touchpad driver
Published: 2017-08-28T20:00:00.000Z
CVE-2017-3758 
Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code execution.
Problem types: description: Remote code execution
Affected products: vendor: Lenovo Group Ltd.
product: Service Framework application
Published: 2017-10-17T20:00:00.000Z
CVE-2017-3759 
The Lenovo Service Framework Android application accepts some responses from the server without proper validation. This exposes the application to man-in-the-middle attacks leading to possible remote code execution.
Problem types: description: Remote code execution
Affected products: vendor: Lenovo Group Ltd.
product: Service Framework application
Published: 2017-10-17T20:00:00.000Z
CVE-2017-3760 
The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded applications and/or data. This exposes the application to man-in-the-middle attacks leading to possible remote code execution.
Problem types: description: Remote code execution
Affected products: vendor: Lenovo Group Ltd.
product: Service Framework application
Published: 2017-10-17T20:00:00.000Z