rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-6295 
NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past the end, or before the beginning, of the intended buffer; and may lead to denial of service or information disclosure. This issue is rated as high.
Problem types: description: Denial of Service
Affected products: vendor: Nvidia Corporation
product: SHIELD TV
Published: 2018-03-06T16:00:00.000Z
CVE-2017-6296 
NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of privileges. This issue is rated as moderate.
Problem types: description: Denial of Service
Affected products: vendor: Nvidia Corporation
product: SHIELD TV
Published: 2018-03-06T16:00:00.000Z
CVE-2017-6297 
The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-6298 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "1 of 9. Null Pointer Deref / calloc return value not checked."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6299 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "2 of 9. Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6300 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "3 of 9. Buffer Overflow in version field in lib/tnef-types.h."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6301 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "4 of 9. Out of Bounds Reads."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6302 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "5 of 9. Integer Overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6303 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "6 of 9. Invalid Write and Integer Overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6304 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "7 of 9. Out of Bounds read."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6305 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "8 of 9. Out of Bounds read and write."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6306 
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6307 
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6308 
An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6309 
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6310 
An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid read and write operations, controlled by an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T04:23:00.000Z
CVE-2017-6311 
gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T02:00:00.000Z
CVE-2017-6312 
Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out-of-bounds read, related to compiler optimizations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T02:00:00.000Z
CVE-2017-6313 
Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T02:00:00.000Z
CVE-2017-6314 
The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T02:00:00.000Z
CVE-2017-6315 
Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T17:00:00.000Z
CVE-2017-6316 
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-20T04:00:00.000Z
CVE-2017-6317 
Memory leak in the add_shader_program function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via vectors involving the sprog variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6318 
saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2017-6319 
The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T01:00:00.000Z
CVE-2017-6320 
A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell commands and gain root privileges. The vulnerability stems from unsanitized data being processed in a system call when the delete_assessment command is issued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-18T14:00:00.000Z
CVE-2017-6323 
The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.
Problem types: description: XXE
Affected products: vendor: Symantec Corporation
product: ITMS
Published: 2018-04-16T18:00:00.000Z
CVE-2017-6324 
The Symantec Messaging Gateway, when processing a specific email attachment, can allow a malformed or corrupted Word file with a potentially malicious macro through despite the administrator having the 'disarm' functionality enabled. This constitutes a 'bypass' of the disarm functionality resident to the application.
Problem types: description: Disarm Bypass
Affected products: vendor: Symantec Corporation
product: Messaging Gateway
Published: 2017-06-26T21:00:00.000Z
CVE-2017-6325 
The Symantec Messaging Gateway can encounter a file inclusion vulnerability, which is a type of vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. This file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application.
Problem types: description: Local File Inclusion
Affected products: vendor: Symantec Corporation
product: Messaging Gateway
Published: 2017-06-26T21:00:00.000Z
CVE-2017-6326 
The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process.
Problem types: description: Remote Code Execution
Affected products: vendor: Symantec Corporation
product: Messaging Gateway
Published: 2017-06-26T21:00:00.000Z
CVE-2017-6327 
The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges.
Problem types: description: Code Execution
Affected products: vendor: Symantec Corporation
product: Messaging Gateway
Published: 2017-08-11T20:00:00.000Z
CVE-2017-6328 
The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.
Problem types: description: CSRF
Affected products: vendor: Symantec Corporation
product: Messaging Gateway
Published: 2017-08-11T20:00:00.000Z
CVE-2017-6329 
Symantec VIP Access for Desktop prior to 2.2.4 can be susceptible to a DLL Pre-Loading vulnerability. These types of issues occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, the application will generally follow a specific search path to locate the DLL. The exploitation of the vulnerability manifests as a simple file write (or potentially an over-write) which results in a foreign executable running under the context of the application.
Problem types: description: DLL Pre-Loading
Affected products: vendor: Symantec Corporation
product: VIP Access for Desktop
Published: 2017-08-21T20:00:00.000Z
CVE-2017-6330 
Symantec Encryption Desktop before SED 10.4.1MP2 can allow remote attackers to cause a denial of service (resource consumption) via crafted web requests."
Problem types: description: Denial of Service (DoS)
Affected products: vendor: Symantec Corporation
product: Symantec Encryption Desktop
Published: 2017-09-13T14:00:00.000Z
CVE-2017-6331 
Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real time protection for the application that is run on servers and clients.
Problem types: description: Tamper-protection bypass
Affected products: vendor: Symantec Corporation
product: Symantec Endpoint Protection
Published: 2017-11-06T23:00:00.000Z
CVE-2017-6334 
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6335 
The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T14:00:00.000Z
CVE-2017-6338 
Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 allow an authenticated, remote user with low privileges like 'Reports Only' or 'Auditor' to change FTP Access Control Settings, create or modify reports, or upload an HTTPS Decryption Certificate and Private Key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-05T16:00:00.000Z
CVE-2017-6339 
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority (CA) and dynamically generates digital certificates that are sent to client browsers to complete a secure passage for HTTPS connections. It also allows administrators to upload their own certificates signed by a root CA. An attacker with low privileges can download the current CA certificate and Private Key (either the default ones or ones uploaded by administrators) and use those to decrypt HTTPS traffic, thus compromising confidentiality. Also, the default Private Key on this appliance is encrypted with a very weak passphrase. If an appliance uses the default Certificate and Private Key provided by Trend Micro, an attacker can simply download these and decrypt the Private Key using the default/weak passphrase.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-05T16:00:00.000Z
CVE-2017-6340 
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that allows any authenticated, remote user (even with low privileges like 'Auditor') to create or modify reports, and consequently take advantage of this XSS vulnerability. The JavaScript is executed when victims visit reports or auditlog pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-05T16:00:00.000Z
CVE-2017-6341 
Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-6342 
An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically logs in as admin. This allows sniffing sensitive information identified in CVE-2017-6341 without prior knowledge of the password. This is a different vulnerability than CVE-2013-6117.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-6343 
The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the corresponding password, a different vulnerability than CVE-2013-6117.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-6344 
XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-6345 
The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T20:00:00.000Z
CVE-2017-6346 
Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that makes PACKET_FANOUT setsockopt system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T20:00:00.000Z
CVE-2017-6347 
The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data layout, which allows local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted system calls, as demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP transmission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T20:00:00.000Z
CVE-2017-6348 
The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T20:00:00.000Z
CVE-2017-6349 
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-6350 
An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T07:25:00.000Z
CVE-2017-6351 
The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account. This account is not documented, nor is the DEBUG feature or the use of telnetd on port tcp/5885.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6353 
net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T20:00:00.000Z
CVE-2017-6355 
Integer overflow in the vrend_create_shader function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (process crash) via crafted pkt_length and offlen values, which trigger an out-of-bounds access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T02:00:00.000Z
CVE-2017-6356 
Palo Alto Networks Terminal Services (aka TS) Agent 6.0, 7.0, and 8.0 before 8.0.1 uses weak permissions for unspecified resources, which allows attackers to obtain sensitive session information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2017-6359 
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T16:00:00.000Z
CVE-2017-6360 
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T16:00:00.000Z
CVE-2017-6361 
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T16:00:00.000Z
CVE-2017-6362 
Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-07T13:00:00.000Z
CVE-2017-6363 
In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T04:06:43.000Z
CVE-2017-6366 
Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the host_name parameter to dnslookup.cgi. NOTE: this issue can be combined with CVE-2017-6334 to execute arbitrary code remotely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z