rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-9378 
BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T15:00:00.000Z
CVE-2017-9379 
Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T15:00:00.000Z
CVE-2017-9380 
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T15:00:00.000Z
CVE-2017-9381 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on the device using the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who navigates to an attacker controlled page to install or delete an application on the device. Note: The cross-site request forgery is a systemic issue across all other functionalities of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T17:27:34.000Z
CVE-2017-9382 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "file" as one of the service actions for a normal user to read a file that is stored under the /etc/cmh-lu folder. It retrieves the value from the "parameters" query string variable and then passes it to an internal function "FileUtils::ReadFileIntoBuffer" which is a library function that does not perform any sanitization on the value submitted and this allows an attacker to use directory traversal characters "../" and read files from other folders within the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:52:00.000Z
CVE-2017-9383 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "wget" as one of the service actions for a normal user to connect the device to an external website. It retrieves the parameter "URL" from the query string and then passes it to an internal function that uses the curl module on the device to retrieve the contents of the website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:41:42.000Z
CVE-2017-9384 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports and connect the device to Vera servers. This is primarily used as a method of communication between the device and Vera servers so the devices can be communicated with even when the user is not at home. One of the parameters retrieved by this specific script is "remote_host". This parameter is not sanitized by the script correctly and is passed in a call to "eval" to execute another script where remote_host is concatenated to be passed a parameter to the second script. This allows an attacker to escape from the executed command and then execute any commands of his/her choice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T17:06:52.000Z
CVE-2017-9385 
An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the /etc/cmh/cmh.conf file which can be extracted by an attacker using a directory traversal attack, and then log in to the device with the highest privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:37:18.000Z
CVE-2017-9386 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "get_file.sh" which allows a user to retrieve any file stored in the "cmh-ext" folder on the device. However, the "filename" parameter is not validated correctly and this allows an attacker to directory traverse outside the /cmh-ext folder and read any file on the device. It is necessary to create the folder "cmh-ext" on the device which can be executed by an attacker first in an unauthenticated fashion and then execute a directory traversal attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:31:01.000Z
CVE-2017-9387 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called relay.sh which is used for creating new SSH relays for the device so that the device connects to Vera servers. All the parameters passed in this specific script are logged to a log file called log.relay in the /tmp folder. The user can also read all the log files from the device using a script called log.sh. However, when the script loads the log files it displays them with content-type text/html and passes all the logs through the ansi2html binary which converts all the character text including HTML meta-characters correctly to be displayed in the browser. This allows an attacker to use the log files as a storing mechanism for the XSS payload and thus whenever a user navigates to that log.sh script, it enables the XSS payload and allows an attacker to execute his malicious payload on the user's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:13:37.000Z
CVE-2017-9388 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific request to and from from another website. This is primarily used as a method of communication between the device and Vera website when the user is logged in to the https://home.getvera.com and allows the device to communicate between the device and website. One of the parameters retrieved by this specific script is "url". This parameter is not sanitized by the script correctly and is passed in a call to "eval" to execute "curl" functionality. This allows an attacker to escape from the executed command and then execute any commands of his/her choice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T16:52:59.000Z
CVE-2017-9389 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device allows a user to install applications written in the Lua programming language. Also the interface allows any user to write his/her application in the Lua language. However, this functionality is not protected by authentication and this allows an attacker to run arbitrary Lua code on the device. The POST request is forwarded to LuaUPNP daemon on the device. This binary handles the received Lua code in the function "LU::JobHandler_LuaUPnP::RunLua(LU::JobHandler_LuaUPnP *__hidden this, LU::UPnPActionWrapper *)". The value in the "code" parameter is then passed to the function "LU::LuaInterface::RunCode(char const*)" which actually loads the Lua engine and runs the code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:26:35.000Z
CVE-2017-9390 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called connect.sh which is supposed to return a specific cookie for the user when the user is authenticated to https://home.getvera.com. One of the parameters retrieved by this script is "RedirectURL". However, the application lacks strict input validation of this parameter and this allows an attacker to execute the client-side code on this application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T19:04:34.000Z
CVE-2017-9391 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the service actions for a normal user to retrieve an image from a camera that is controlled by the controller. It seems that the "URL" parameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to overflow the buffer. The function "LU::Generic_IP_Camera_Manager::REQ_Image" is activated when the lu_request_image is passed as the "id" parameter in query string. This function then calls "LU::Generic_IP_Camera_Manager::GetUrlFromArguments" and passes a "pointer" to the function where it will be allowed to store the value from the URL parameter. This pointer is passed as the second parameter $a2 to the function "LU::Generic_IP_Camera_Manager::GetUrlFromArguments". However, neither the callee or the caller in this case performs a simple length check and as a result an attacker who is able to send more than 1336 characters can easily overflow the values stored on the stack including the $RA value and thus execute code on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T20:05:31.000Z
CVE-2017-9392 
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the service actions for a normal user to retrieve an image from a camera that is controlled by the controller. It seems that the "res" (resolution) parameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to overflow the buffer. The function "LU::Generic_IP_Camera_Manager::REQ_Image" is activated when the lu_request_image is passed as the "id" parameter in the query string. This function then calls "LU::Generic_IP_Camera_Manager::GetUrlFromArguments". This function retrieves all the parameters passed in the query string including "res" and then uses the value passed in it to fill up buffer using the sprintf function. However, the function in this case lacks a simple length check and as a result an attacker who is able to send more than 184 characters can easily overflow the values stored on the stack including the $RA value and thus execute code on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T20:12:38.000Z
CVE-2017-9393 
CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search.
Problem types: description: Information Disclosure
Affected products: vendor: CA Technologies
product: Identity Manager
Published: 2017-09-22T14:00:00.000Z
CVE-2017-9394 
A stored cross-site scripting vulnerability in CA Identity Governance 12.6 allows remote authenticated attackers to display HTML or execute script in the context of another user.
Problem types: cwe_id: CWE-79
description: Cross-Site Scripting (XSS) (CWE-79)
Affected products: vendor: CA Technologies
product: CA Identity Governance
Published: 2017-11-14T21:00:00.000Z
CVE-2017-9403 
In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T19:00:00.000Z
CVE-2017-9404 
In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T19:00:00.000Z
CVE-2017-9405 
In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T19:00:00.000Z
CVE-2017-9406 
In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T19:00:00.000Z
CVE-2017-9407 
In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T19:00:00.000Z
CVE-2017-9408 
In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T19:00:00.000Z
CVE-2017-9409 
In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-02T19:00:00.000Z
CVE-2017-9412 
The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-27T06:00:00.000Z
CVE-2017-9413 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or (2) update Internet Radio Settings via the urlRedirectCustomUrl parameter to networkSettings.view.  NOTE: These vulnerabilities can be exploited to conduct server-side request forgery (SSRF) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T18:00:00.000Z
CVE-2017-9414 
Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting (XSS) attacks or possibly have unspecified other impact via the name parameter to playerSettings.view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T16:00:00.000Z
CVE-2017-9415 
Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2017-9416 
Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-03T23:00:00.000Z
CVE-2017-9417 
Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-03T23:00:00.000Z
CVE-2017-9418 
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T13:00:00.000Z
CVE-2017-9419 
Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-15T19:00:00.000Z
CVE-2017-9420 
Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T19:00:00.000Z
CVE-2017-9421 
Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using a gathered token via a POST request to /oauth/token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-24T13:00:00.000Z
CVE-2017-9424 
IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-22T16:00:00.000Z
CVE-2017-9425 
The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T04:00:00.000Z
CVE-2017-9426 
ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T04:00:00.000Z
CVE-2017-9427 
SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a crafted table name at admin/developer/modules/designer/ and the injection is visible at admin/dashboard/vitals-statistics/integrity/check/?external=true.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-04T14:00:00.000Z
CVE-2017-9428 
A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary files via ..\ sequences in the directory parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-04T14:00:00.000Z
CVE-2017-9429 
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-13T18:00:00.000Z
CVE-2017-9430 
Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv[0]. An example threat model is a web application that launches dnstracer with an untrusted name string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T11:12:00.000Z
CVE-2017-9431 
Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T02:47:00.000Z
CVE-2017-9432 
Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T02:47:00.000Z
CVE-2017-9433 
Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in lib/MsWrd1Parser.cxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T02:47:00.000Z
CVE-2017-9434 
Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T14:00:00.000Z
CVE-2017-9435 
Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T14:00:00.000Z
CVE-2017-9436 
TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T14:00:00.000Z
CVE-2017-9437 
Openbravo Business Suite 3.0 is affected by SQL injection. This vulnerability could allow remote authenticated attackers to inject arbitrary SQL code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T14:00:00.000Z
CVE-2017-9438 
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T17:00:00.000Z
CVE-2017-9439 
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T18:00:00.000Z
CVE-2017-9440 
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T18:00:00.000Z
CVE-2017-9441 
Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in manifest.json. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-05T19:00:00.000Z