rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-1002007 
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
Problem types: description: Content Injection
Affected products: vendor: ITFlux
product: DTracker
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002008 
Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.
Problem types: description: Path Traversal
Affected products: vendor: William DeAngelis
product: membership-simplified-for-oap-members-only
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002009 
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002010 
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.
Problem types: description: SQL Injection
Affected products: vendor: ontraport
product: Membership Simplified
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002011 
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database.
Problem types: description: Stored XSS
Affected products: vendor: Anblik
product: image-gallery-with-slideshow
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002012 
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement.
Problem types: description: SQL Injection
Affected products: vendor: Anblik
product: image-gallery-with-slideshow
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002013 
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.
Problem types: description: SQL Injection
Affected products: vendor: Anblik
product: image-gallery-with-slideshow
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002014 
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter.
Problem types: description: SQL Injection
Affected products: vendor: Anblik
product: image-gallery-with-slideshow
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002015 
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter.
Problem types: description: SQL Injection
Affected products: vendor: Anblik
product: image-gallery-with-slideshow
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002016 
Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files.
Problem types: description: Path Traversal
Affected products: vendor: daozhao
product: flickr-picture-backup
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002017 
Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.
Problem types: description: Stored XSS
Affected products: vendor: Bob Cares
product: gift-certificate-creator
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002018 
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
Problem types: description: SQL Injection
Affected products: vendor: Binny V A
product: eventr
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002019 
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
Problem types: description: SQL Injection
Affected products: vendor: Binny V A
product: eventr
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002020 
Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.
Problem types: description: SQL Injection
Affected products: vendor: Binny V A
product: surveys
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002021 
Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query.
Problem types: description: SQL Injection
Affected products: vendor: Binny V A
product: surveys
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002022 
Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.
Problem types: description: SQL Injection
Affected products: vendor: Binny V A
product: surveys
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002023 
Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php
Problem types: description: SQL Injection
Affected products: vendor: Daisy Themes
product: Easy Team Manager
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002024 
Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upload files.
Problem types: description: Arbitrary File Upload
Affected products: vendor: Kind Editor Inc.
product: Kind Editor
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002025 
Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement.
Problem types: description: SQL Injection
Affected products: vendor: Romal Patel
product: add-edit-delete-listing-for-member-module
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002026 
Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
Problem types: description: SQL Injection
Affected products: vendor: Event Espresso
product: Event Expresso Free
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002027 
Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php.
Problem types: description: SQL Injection
Affected products: vendor: rkdevelopers
product: rk-responsive-contact-form
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002028 
Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.
Problem types: description: SQL Injection
Affected products: vendor: Angry Byte
product: wordpress-gallery-transformation
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002100 
Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.
Problem types: description: Insecure Permissions
Affected products: vendor: Kubernetes
product: Kubernetes
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002101 
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.
Problem types: description: handled symbolic links insecurely
Affected products: vendor: Kubernetes
product: Kubernetes
Credits: lang: en
value: Reported by Maxim Ivanov
Published: 2018-03-13T17:00:00.000Z
CVE-2017-1002102 
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
Problem types: description: handled symbolic links insecurely
Affected products: vendor: Kubernetes
product: Kubernetes
Credits: lang: en
value: Reported by Joel Smith of Red Hat
Published: 2018-03-13T17:00:00.000Z
CVE-2017-1002150 
python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: Fedora Project Infrastructure
product: Python-Fedora
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002151 
Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: Pagure Project
product: Pagure
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002152 
Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: Fedora Project Infrastructure
product: Bodhi
Published: 2019-01-10T21:00:00.000Z
CVE-2017-1002153 
Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Koji Project
product: Koji
Published: 2017-10-06T17:00:00.000Z
CVE-2017-1002157 
modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.
Problem types: cwe_id: CWE-242
description: CWE-242
Affected products: vendor: Fedora Modularity
product: modulemd
Published: 2019-01-10T21:00:00.000Z
CVE-2017-1002201 
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: http://haml.info/
product: haml
Published: 2019-10-15T17:35:57.000Z
CVE-2017-10000 
Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. While the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics.  While the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics.
Affected products: vendor: Oracle Corporation
product: Hospitality Reporting and Analytics
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10001 
Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Core). The supported version that is affected is 1.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony First Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony First Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Simphony First Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony First Edition. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony First Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Hospitality Simphony First Edition accessible data as well as  unauthorized update, insert or delete access to some of Oracle Hospitality Simphony First Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony First Edition.
Affected products: vendor: Oracle Corporation
product: Hospitality Simphony First Edition
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10002 
Vulnerability in the Oracle Hospitality Inventory Management component of Oracle Hospitality Applications (subcomponent: Settings and Config). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Inventory Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Inventory Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Inventory Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Hospitality Inventory Management accessible data as well as  unauthorized read access to a subset of Oracle Hospitality Inventory Management accessible data.
Affected products: vendor: Oracle Corporation
product: Hospitality Inventory Management
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10003 
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Network Services Library). The supported version that is affected is 10. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 4.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).
Problem types: description: Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Solaris accessible data as well as  unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris.
Affected products: vendor: Oracle Corporation
product: Solaris Operating System
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10004 
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Problem types: description: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris.  Successful attacks of this vulnerability can result in takeover of Solaris.
Affected products: vendor: Oracle Corporation
product: Solaris Operating System
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10005 
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Problem types: description: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as  unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data.
Affected products: vendor: Oracle Corporation
product: FLEXCUBE Private Banking
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10006 
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Private Banking accessible data.
Affected products: vendor: Oracle Corporation
product: FLEXCUBE Private Banking
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10007 
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data.
Affected products: vendor: Oracle Corporation
product: FLEXCUBE Private Banking
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10008 
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data.
Affected products: vendor: Oracle Corporation
product: FLEXCUBE Private Banking
Published: 2017-08-08T15:00:00.000Z
CVE-2017-10009 
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data.
Affected products: vendor: Oracle Corporation
product: FLEXCUBE Private Banking
Published: 2017-08-08T15:00:00.000Z