rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-8276 
Improper authorization involving a fuse in TrustZone in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016.
Problem types: description: Improper Authorization in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2019-01-18T22:00:00.000Z
CVE-2017-8277 
In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function msm_dba_register_client, if the client registers failed, it would be freed. However the client was not removed from list. Use-after-free would occur when traversing the list next time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T15:00:00.000Z
CVE-2017-8278 
In all Qualcomm products with Android releases from CAF using the Linux kernel, while reading audio data from an unspecified driver, a buffer overflow or integer overflow could occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T15:00:00.000Z
CVE-2017-8279 
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, missing race condition protection while updating msg mask table can lead to buffer over-read. Also access to freed memory can happen while updating msg_mask information.
Problem types: description: Time-of-check Time-of-use (TOCTOU) Race Condition in Core
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2017-11-16T22:00:00.000Z
CVE-2017-8280 
In all Qualcomm products with Android releases from CAF using the Linux kernel, during the wlan calibration data store and retrieve operation, there are some potential race conditions which lead to a memory leak and a buffer overflow during the context switch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T15:00:00.000Z
CVE-2017-8281 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition can allow access to already freed memory while querying event status via DCI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T15:00:00.000Z
CVE-2017-8282 
XnView Classic for Windows Version 2.40 allows user-assisted remote attackers to execute code via a crafted .mov file that is mishandled during the opening of a directory in "Browser" mode, because of a "User Mode Write AV near NULL" in XnView.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-05T19:00:00.000Z
CVE-2017-8283 
dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-26T05:28:00.000Z
CVE-2017-8284 
The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-26T14:00:00.000Z
CVE-2017-8287 
FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T00:00:00.000Z
CVE-2017-8288 
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T00:00:00.000Z
CVE-2017-8289 
Stack-based buffer overflow in the ipv6_addr_from_str function in sys/net/network_layer/ipv6/addr/ipv6_addr_from_str.c in RIOT prior to 2017-04-25 allows local attackers, and potentially remote attackers, to cause a denial of service or possibly have unspecified other impact via a malformed IPv6 address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T01:41:00.000Z
CVE-2017-8290 
A potential Buffer Overflow Vulnerability (from a BB Code handling issue) has been identified in TeamSpeak Server version 3.0.13.6 (08/11/2016 09:48:33), it enables the users to Crash any WINDOWS Client that clicked into a Vulnerable Channel of a TeamSpeak Server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-06T16:00:00.000Z
CVE-2017-8291 
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T01:41:00.000Z
CVE-2017-8294 
libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T14:00:00.000Z
CVE-2017-8295 
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-04T14:00:00.000Z
CVE-2017-8296 
kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T15:00:00.000Z
CVE-2017-8297 
A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple PHP File Manager" component).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T15:00:00.000Z
CVE-2017-8298 
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T16:00:00.000Z
CVE-2017-8301 
LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T17:00:00.000Z
CVE-2017-8302 
Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dsp_nextn.cfm, admin/core/views/cusers/inc/dsp_search_form.cfm, admin/core/views/cusers/inc/dsp_users_list.cfm, admin/core/views/cusers/list.cfm, and admin/core/views/cusers/listusers.cfm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T19:00:00.000Z
CVE-2017-8303 
An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T18:00:00.000Z
CVE-2017-8304 
An issue was discovered on Accellion FTA devices before FTA_9_12_180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T18:00:00.000Z
CVE-2017-8305 
The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's strlcpy is used only on systems with a C library (e.g., glibc) that lacks its own strlcpy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T21:00:00.000Z
CVE-2017-8307 
In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also exploitable in conjunction with CVE-2017-8308 when Avast Self-Defense is enabled. The vulnerability allows for Denial of Service attacks and hiding traces of a possible attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T20:00:00.000Z
CVE-2017-8308 
In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T20:00:00.000Z
CVE-2017-8309 
Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-23T03:56:00.000Z
CVE-2017-8310 
Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file.
Problem types: description: Allows attacker to read data beyond allocated memory and potentially crash the process (causing a denial of service)
Affected products: vendor: VideoLAN
product: VLC
Published: 2017-05-23T21:00:00.000Z
CVE-2017-8311 
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.
Problem types: description: Allows attacker to execute arbitrary code.
Affected products: vendor: VideoLAN
product: VLC
Published: 2017-05-23T21:00:00.000Z
CVE-2017-8312 
Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file.
Problem types: description: Allows attacker to read heap uninitialized data (potentially beyond allocated data - depends on heap implementation).
Affected products: vendor: VideoLAN
product: VLC
Published: 2017-05-23T21:00:00.000Z
CVE-2017-8313 
Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file.
Problem types: description: Allows attacker to read data beyond allocated memory and potentially crash the process (causing a denial of service).
Affected products: vendor: VideoLAN
product: VLC
Published: 2017-05-23T21:00:00.000Z
CVE-2017-8314 
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
Problem types: description: Allows arbitrary file write on disk
Affected products: vendor: XBMC Foundation
product: Kodi (XBMC)
Published: 2017-05-23T21:00:00.000Z
CVE-2017-8315 
Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnerability by implementing malicious code on Androidmanifest.xml.
Problem types: description: Local Privilege Escalation
Affected products: vendor: Check Point Software Technologies Ltd.
product: Eclipse
Published: 2018-04-20T19:00:00.000Z
CVE-2017-8316 
IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both Androidmanifest.xml.
Problem types: description: XEE in XML parser
Affected products: vendor: JetBrains
product: IntelliJ IDEA
Published: 2018-08-03T15:00:00.000Z
CVE-2017-8325 
The iw_process_cols_to_intermediate function in imagew-main.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-29T20:00:00.000Z
CVE-2017-8326 
libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image, related to imagew-bmp.c and imagew-util.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-29T20:00:00.000Z
CVE-2017-8327 
The bmpr_read_uncompressed function in imagew-bmp.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-29T20:00:00.000Z
CVE-2017-8328 
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross site request forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface to change a user's password. Also this is a systemic issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T20:15:16.000Z
CVE-2017-8329 
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of setting a name for the wireless network. These values are stored by the device in NVRAM (Non-volatile RAM). It seems that the POST parameters passed in this request to set up names on the device do not have a string length check on them. This allows an attacker to send a large payload in the "mssid_1" POST parameter. The device also allows a user to view the name of the Wifi Network set by the user. While processing this request, the device calls a function at address 0x00412CE4 (routerSummary) in the binary "webServer" located in Almond folder, which retrieves the value set earlier by "mssid_1" parameter as SSID2 and this value then results in overflowing the stack set up for this function and allows an attacker to control $ra register value on the stack which allows an attacker to control the device by executing a payload of an attacker's choice. If the firmware version AL-R096 is dissected using binwalk tool, we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "goahead" is the one that has the vulnerable function that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function sub_00420F38 in IDA pro is identified to be receiving the values sent in the POST parameter "mssid_1" at address 0x0042BA00 and then sets in the NVRAM at address 0x0042C314. The value is later retrieved in the function at address 0x00412EAC and this results in overflowing the buffer as the function copies the value directly on the stack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T19:50:09.000Z
CVE-2017-8330 
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a UPnP functionality for devices to interface with the router and interact with the device. It seems that the "NewInMessage" SOAP parameter passed with a huge payload results in crashing the process. If the firmware version AL-R096 is dissected using binwalk tool, we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "miniupnpd" is the one that has the vulnerable function that receives the values sent by the SOAP request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function WscDevPutMessage at address 0x0041DBB8 in IDA pro is identified to be receiving the values sent in the SOAP request. The SOAP parameter "NewInMesage" received at address 0x0041DC30 causes the miniupnpd process to finally crash when a second request is sent to the same process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T20:43:19.000Z
CVE-2017-8331 
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding new port forwarding rules to the device. It seems that the POST parameters passed in this request to set up routes on the device can be set in such a way that would result in passing commands to a "system" API in the function and thus result in command injection on the device. If the firmware version AL-R096 is dissected using binwalk tool, we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "goahead" is the one that has the vulnerable function that recieves the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function sub_43C280in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "ip_address" is extracted at address 0x0043C2F0. The POST parameter "ipaddress" is concatenated at address 0x0043C958 and this is passed to a "system" function at address 0x00437284. This allows an attacker to provide the payload of his/her choice and finally take control of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T19:56:41.000Z
CVE-2017-8332 
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking key words passing in the web traffic to prevent kids from watching content that might be deemed unsafe using the web management interface. It seems that the device does not implement any cross-site scripting protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a stored cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T20:23:50.000Z
CVE-2017-8333 
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding new routes to the device. It seems that the POST parameters passed in this request to set up routes on the device can be set in such a way that would result in passing commands to a "popen" API in the function and thus result in command injection on the device. If the firmware version AL-R096 is dissected using binwalk tool, we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "goahead" is the one that has the vulnerable function that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function sub_00420F38 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "dest" is extracted at address 0x00420FC4. The POST parameter "dest is concatenated in a route add command and this is passed to a "popen" function at address 0x00421220. This allows an attacker to provide the payload of his/her choice and finally take control of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T19:53:27.000Z
CVE-2017-8334 
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking IP addresses using the web management interface. It seems that the device does not implement any cross-site scripting forgery protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T20:18:50.000Z