rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-11160 
Multiple untrusted search path vulnerabilities in installer in Synology Assistant before 6.1-15163 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T19:00:00.000Z
CVE-2017-11161 
Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command (CWE-89)
Affected products: vendor: Synology
product: Synology Photo Station
Published: 2017-09-08T14:00:00.000Z
CVE-2017-11162 
Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory (CWE-22)
Affected products: vendor: Synology
product: Synology Photo Station
Published: 2017-09-08T14:00:00.000Z
CVE-2017-11163 
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-10T18:00:00.000Z
CVE-2017-11164 
In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-11T00:00:00.000Z
CVE-2017-11165 
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T12:00:00.000Z
CVE-2017-11166 
The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-10T18:00:00.000Z
CVE-2017-11167 
FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo() input value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T13:00:00.000Z
CVE-2017-11169 
Privilege Escalation on iBall iB-WRA300N3GT iB-WRA300N3GT_1.1.1 devices allows remote authenticated users to obtain root privileges by leveraging a guest/user/normal account to submit a modified privilege parameter to /form2userconfig.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-13T09:00:00.000Z
CVE-2017-11170 
The ReadTGAImage function in coders\tga.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via invalid colors data in the header of a TGA or VST file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-11T20:00:00.000Z
CVE-2017-11171 
Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-11T20:00:00.000Z
CVE-2017-11173 
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T03:00:00.000Z
CVE-2017-11174 
In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T21:00:00.000Z
CVE-2017-11175 
In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T18:00:00.000Z
CVE-2017-11176 
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-11T23:00:00.000Z
CVE-2017-11177 
TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T17:00:00.000Z
CVE-2017-11178 
In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T00:00:00.000Z
CVE-2017-11179 
FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T00:00:00.000Z
CVE-2017-11180 
FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (1) the User-Agent header of an HTTP request or (2) the username entered on the login screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T00:00:00.000Z
CVE-2017-11181 
In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T00:00:00.000Z
CVE-2017-11182 
In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T00:00:00.000Z
CVE-2017-11183 
front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-28T05:00:00.000Z
CVE-2017-11184 
SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-28T05:00:00.000Z
CVE-2017-11185 
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T17:00:00.000Z
CVE-2017-11187 
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T14:00:00.000Z
CVE-2017-11188 
The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T15:00:00.000Z
CVE-2017-11189 
unrarlib.c in unrar-free 0.0.1 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash), which could be relevant if unrarlib is used as library code for a long-running application. NOTE: one of the several test cases in the references may be the same as what was separately reported as CVE-2017-14121.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T16:00:00.000Z
CVE-2017-11190 
unrarlib.c in unrar-free 0.0.1, when _DEBUG_LOG mode is enabled, might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via an RAR archive containing a long filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T16:00:00.000Z
CVE-2017-11191 
FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier session. NOTE: Vendor states that issue does not exist in product and does not recognize this report as a valid security concern
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T19:00:00.000Z
CVE-2017-11193 
Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T20:00:00.000Z
CVE-2017-11194 
Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel, the certid parameter of adminservercacertdetails.cgi is reflected in the application's response and is not properly sanitized, allowing an attacker to inject tags. An attacker could come up with clever payloads to make the system run commands such as ping, ping6, traceroute, nslookup, arp, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T20:00:00.000Z
CVE-2017-11195 
Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T20:00:00.000Z
CVE-2017-11196 
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-12T20:00:00.000Z
CVE-2017-11197 
In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the "add printer" option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-03T00:00:00.000Z
CVE-2017-11198 
Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get_image.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web script or HTML via the folder, id, or name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T01:00:00.000Z
CVE-2017-11200 
SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T01:00:00.000Z
CVE-2017-11201 
application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T01:00:00.000Z
CVE-2017-11202 
FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs, a different vulnerability than CVE-2017-11180.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T01:00:00.000Z
CVE-2017-11209 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability that occurs when reading a JPEG file embedded within XML Paper Specification (XPS) file. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11210 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the font parsing, where the font is embedded in the XML Paper Specification (XPS) file. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11211 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability in the JPEG parser. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Heap Overflow
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11212 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to text output. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11213 
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer due to an integer overflow; the computation is part of the abstraction that creates an arbitrarily sized transparent or opaque bitmap image. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Integer Overflow causes Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Flash Player 27.0.0.183 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-11214 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to rendering a path. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11215 
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: n/a
product: Adobe Flash Player 27.0.0.183 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-11216 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to bitmap transformations. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11217 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to drawing of Unicode text strings. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11218 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in XFA event management. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11219 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA rendering engine. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11220 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability in an internal data structure. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Heap Overflow
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11221 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable type confusion vulnerability in the annotation functionality. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Type Confusion
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11222 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the Product Representation Compact (PRC) engine. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11223 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the core of the XFA engine. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11224 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA layout engine. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11225 
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: n/a
product: Adobe Flash Player 27.0.0.183 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-11226 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image processing engine when processing JPEG 2000 (JP2) code stream data. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11227 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) private data. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11228 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing JPEG 2000 (JP2) code stream data. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-11229 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has a security bypass vulnerability when manipulating Forms Data Format (FDF).
Problem types: description: Security Bypass
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z