rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-9505 
Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.
Problem types: description: Access Restriction Bypass
Affected products: vendor: Atlassian
product: Confluence Server
Published: 2017-06-15T16:00:00.000Z
CVE-2017-9506 
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
Problem types: description: Server-Side Request Forgery
Affected products: vendor: Atlassian
product: Atlassian OAuth Plugin
Published: 2017-08-23T19:00:00.000Z
CVE-2017-9507 
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Atlassian Crucible
Published: 2017-08-24T17:00:00.000Z
CVE-2017-9508 
Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Atlassian Fisheye and Crucible
Published: 2017-08-24T17:00:00.000Z
CVE-2017-9509 
The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Atlassian Crucible
Published: 2017-08-24T17:00:00.000Z
CVE-2017-9510 
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Atlassian
product: Atlassian Fisheye
Published: 2017-08-24T17:00:00.000Z
CVE-2017-9511 
The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.
Problem types: description: Path Traversal
Affected products: vendor: Atlassian
product: Atlassian Fisheye and Crucible
Published: 2017-08-24T18:00:00.000Z
CVE-2017-9512 
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.
Problem types: description: Improper Access Control
Affected products: vendor: Atlassian
product: Atlassian Fisheye and Crucible
Published: 2017-08-24T17:00:00.000Z
CVE-2017-9513 
Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although they will not receive notifications for the issue, via missing permission checks.
Problem types: cwe_id: CWE-284
description: Improper Access Control (CWE-284)
Affected products: vendor: Atlassian
product: Activity Streams
Published: 2018-01-29T19:00:00.000Z
CVE-2017-9514 
Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.
Problem types: description: Remote Code Execution
Affected products: vendor: Atlassian
product: Bamboo
Published: 2017-10-12T13:00:00.000Z
CVE-2017-9516 
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T13:00:00.000Z
CVE-2017-9517 
atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T14:00:00.000Z
CVE-2017-9518 
atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T14:00:00.000Z
CVE-2017-9519 
atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T14:00:00.000Z
CVE-2017-9520 
The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted DEX file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T14:00:00.000Z
CVE-2017-9521 
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows remote attackers to execute arbitrary code via a specific (but unstated) exposed service. NOTE: the scope of this CVE does NOT include the concept of "Unnecessary Services" in general; the scope is only a single service that is unnecessarily exposed, leading to remote code execution. The details of that service might be disclosed at a later date.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9522 
The Time Warner firmware on Technicolor TC8717T devices sets the default Wi-Fi passphrase to a combination of the SSID and BSSID, which makes it easier for remote attackers to obtain network access by reading a beacon frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-31T03:00:00.000Z
CVE-2017-9523 
The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-09T00:00:00.000Z
CVE-2017-9524 
The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-06T16:00:00.000Z
CVE-2017-9525 
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-09T16:00:00.000Z
CVE-2017-9526 
In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-11T02:00:00.000Z
CVE-2017-9527 
The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-11T17:00:00.000Z
CVE-2017-9528 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!FPX_GetScanDevicePropertyGroup+0x0000000000000f53."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9529 
XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to a "User Mode Write AV starting at Xfpx+0x0000000000004efd."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9530 
IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or execute arbitrary code via a crafted file, related to "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at ntdll_77df0000!LdrpResCompareResourceNames+0x0000000000000150."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9531 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX+0x000000000000176c."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9532 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX+0x0000000000001555."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9533 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!DE_Decode+0x0000000000000a9b."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9534 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!GetPlugInInfo+0x0000000000017426."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9535 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX!GetPlugInInfo+0x0000000000016e53."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9536 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "Read Access Violation on Control Flow starting at FPX!FPX_GetScanDevicePropertyGroup+0x00000000000014eb."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-9537 
Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T14:00:00.000Z
CVE-2017-9538 
The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a "Cannot exit above the top directory" error message throughout the entire web application) via a ".." in the path field. In other words, the denial of service is caused by an incorrect implementation of a directory-traversal protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T14:00:00.000Z
CVE-2017-9542 
D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the password field. Successful exploitation of this issue allows an attacker to take control of the affected device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-11T23:00:00.000Z
CVE-2017-9543 
register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9544 
There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1. By sending an overly long username string to registresult.htm for registering the user, an attacker may be able to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9545 
The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of service (buffer over-read) via a crafted mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-27T06:00:00.000Z
CVE-2017-9546 
admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service (inability to save revisions) via XSS sequences in a revision name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9547 
admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching an Edit Page action and entering the Navigation Title or Page Title of a page that is scheduled for future publication (aka a pending page change).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9548 
admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication (aka a pending page change).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9551 
Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload, e.g. XSS code, to be saved as their name in the usr_registration table. The values are then emailed to the the user and administrator and if accepted become part of the new user's account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T16:00:00.000Z
CVE-2017-9552 
A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by "synophoto_dsm_user --auth USERNAME PASSWORD", and local users are able to obtain credentials by sniffing "/proc/*/cmdline".
Problem types: cwe_id: CWE-522
description: Insufficiently Protected Credentials (CWE-522)
Affected products: vendor: Synology
product: Synology Photo Station
Published: 2017-06-13T13:00:00.000Z
CVE-2017-9553 
A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mechanism via the crafted version parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-24T20:00:00.000Z
CVE-2017-9554 
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-24T20:00:00.000Z
CVE-2017-9555 
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation (CWE-79)
Affected products: vendor: Synology
product: Synology Photo Station
Published: 2017-08-24T19:00:00.000Z
CVE-2017-9556 
Cross-site scripting (XSS) vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the title parameter.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation (CWE-79)
Affected products: vendor: Synology
product: Synology Video Station
Published: 2017-08-11T20:00:00.000Z
CVE-2017-9557 
register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to discover passwords by sending the username parameter in conjunction with an empty password parameter, and reading the HTML source code of the response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T15:00:00.000Z
CVE-2017-9558 
The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9559 
The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9560 
The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9561 
The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9562 
The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9563 
The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9564 
The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9565 
The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9566 
The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9567 
The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9568 
The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9569 
The Citizens Bank (TX) cbtx-on-the-go/id892396102 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9570 
The mount-vernon-bank-trust-mobile-banking/id542706679 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9571 
The Citizens Community Bank (TN) ccb-mobile-banking/id610030469 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9572 
The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z
CVE-2017-9573 
The North Adams State Bank (Ursa) nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T12:00:00.000Z