rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-1000453 
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-02T17:00:00.000Z
CVE-2017-1000454 
CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-02T17:00:00.000Z
CVE-2017-1000455 
GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in "the store", violating a fundamental security assumption of GNU Guix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-02T17:00:00.000Z
CVE-2017-1000456 
freedesktop.org libpoppler 0.60.1 fails to validate boundaries in TextPool::addWord, leading to overflow in subsequent calculations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-02T18:00:00.000Z
CVE-2017-1000457 
Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or "Content Administrators" role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-02T18:00:00.000Z
CVE-2017-1000458 
Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-02T18:00:00.000Z
CVE-2017-1000459 
Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T00:00:00.000Z
CVE-2017-1000460 
In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000461 
Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality (that the browser intends to block).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000462 
BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000463 
Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T00:00:00.000Z
CVE-2017-1000465 
Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in disruption of service and execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T22:00:00.000Z
CVE-2017-1000466 
Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T01:00:00.000Z
CVE-2017-1000467 
LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T15:00:00.000Z
CVE-2017-1000469 
Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000470 
EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000471 
EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000472 
The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary files, via a crafted ZIP file, related to a "file path injection vulnerability".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000473 
Linux Dash up to version v2 is vulnerable to multiple command injection vulnerabilities in the way module names are parsed and then executed resulting in code execution on the server, potentially as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000474 
Soyket Chowdhury Vehicle Sales Management System version 2017-07-30 is vulnerable to multiple SQL Injecting in login/vehicle.php, login/profile.php, login/Actions.php, login/manage_employee.php, and login/sell.php scripts resulting in the expose of user's login credentials, SQL Injection and Stored XSS vulnerability, which leads to remote code executing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T22:00:00.000Z
CVE-2017-1000475 
FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Service allowing local users to launch processes with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T14:00:00.000Z
CVE-2017-1000476 
ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T18:00:00.000Z
CVE-2017-1000477 
XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T18:00:00.000Z
CVE-2017-1000478 
ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T18:00:00.000Z
CVE-2017-1000479 
pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under "possibly insecure" suspicions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T18:00:00.000Z
CVE-2017-1000480 
Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T18:00:00.000Z
CVE-2017-1000481 
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T18:00:00.000Z
CVE-2017-1000482 
A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T18:00:00.000Z
CVE-2017-1000483 
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T18:00:00.000Z
CVE-2017-1000484 
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000485 
Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesystem operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000486 
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000487 
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T20:00:00.000Z
CVE-2017-1000488 
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T16:00:00.000Z
CVE-2017-1000489 
Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T17:00:00.000Z
CVE-2017-1000490 
Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T17:00:00.000Z
CVE-2017-1000491 
Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T01:00:00.000Z
CVE-2017-1000492 
Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T01:00:00.000Z
CVE-2017-1000493 
Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T01:00:00.000Z
CVE-2017-1000494 
Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T14:00:00.000Z
CVE-2017-1000495 
QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T14:00:00.000Z
CVE-2017-1000496 
Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T14:00:00.000Z
CVE-2017-1000497 
Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T14:00:00.000Z
CVE-2017-1000498 
AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T14:00:00.000Z
CVE-2017-1000499 
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T14:00:00.000Z
CVE-2017-1000501 
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-03T15:00:00.000Z
CVE-2017-1000502 
Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of these agents now requires the 'Run Scripts' permission typically only granted to administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T23:00:00.000Z
CVE-2017-1000503 
A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related settings not being set to their usual strict default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T23:00:00.000Z
CVE-2017-1000504 
A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-24T23:00:00.000Z
CVE-2017-1000505 
In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new `File` objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and considered to be a call to the `new File(String)` constructor for the purpose of in-process script approval.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-25T18:00:00.000Z
CVE-2017-1000506 
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T23:00:00.000Z
CVE-2017-1000507 
Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T23:00:00.000Z
CVE-2017-1000508 
Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code . This vulnerability appears to have been fixed in 1.5.5 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T23:00:00.000Z
CVE-2017-1000509 
Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T23:00:00.000Z
CVE-2017-1000510 
Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T23:00:00.000Z
CVE-2017-1000600 
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-06T12:00:00.000Z
CVE-2017-1001000 
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T01:00:00.000Z
CVE-2017-1001001 
PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.
Problem types: description: XSS
Affected products: vendor: PluXml
product: PluXml
Published: 2017-11-01T17:00:00.000Z
CVE-2017-1001002 
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: math.js
product: math.js
Published: 2017-11-27T14:00:00.000Z
CVE-2017-1001003 
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
Problem types: cwe_id: CWE-88
description: CWE-88: Argument Injection or Modification
Affected products: vendor: math.js
product: math.js
Published: 2017-11-27T14:00:00.000Z
CVE-2017-1001004 
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: typed-function
product: typed-function
Published: 2017-11-27T14:00:00.000Z
CVE-2017-1002000 
Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content.
Problem types: description: Unrestricted File Upload
Affected products: vendor: jenova12345
product: mobile-friendly-app-builder-by-easytouch
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002001 
Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.
Problem types: description: Unrestricted File Upload
Affected products: vendor: Invedion
product: mobile-app-builder-by-wappress
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002002 
Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/
Problem types: description: Unrestricted File Upload
Affected products: vendor: Invedion
product: webapp-builder
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002003 
Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.
Problem types: description: Unrestricted File Upload
Affected products: vendor: invedion
product: wp2android-turn-wp-site-into-android-app
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002004 
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query.
Problem types: description: SQL Injection
Affected products: vendor: ITFlux
product: DTracker
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002005 
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.
Problem types: description: SQL Injection
Affected products: vendor: ITFlux
product: DTracker
Published: 2017-09-14T13:00:00.000Z
CVE-2017-1002006 
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
Problem types: description: Content Injection
Affected products: vendor: ITFlux
product: DTracker
Published: 2017-09-14T13:00:00.000Z