rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-14909 
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a count value that is read from a file is not properly validated.
Problem types: description: Integer Overflow to Buffer Overflow in GPS
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2017-12-05T19:00:00.000Z
CVE-2017-14910 
In Snapdragon Automobile, Snapdragon IoT and Snapdragon Mobile MDM9206 MDM9607, MDM9650, S820A, S820Am, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, SD 835, and SD 845, a buffer overread is possible if there are no newlines in an input file.
Problem types: description: Buffer Over-read in Sphinx
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon IoT, Snapdragon Mobile
Published: 2018-02-23T23:00:00.000Z
CVE-2017-14911 
In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 625, SD 650/52, SD 820, SD 835, it is possible for the XBL loader to skip the authentication of device config.
Problem types: description: Improper Authentication in Boot
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile
Published: 2018-03-30T15:00:00.000Z
CVE-2017-14912 
In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile [VERSION]: MDM9206, MDM9607, MDM9650, MSM8909W, SD 200, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 835, the attributes of buffers in Secure Display were not marked properly.
Problem types: description: Improper Access Control in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon IoT, Snapdragon Mobile
Published: 2018-03-30T15:00:00.000Z
CVE-2017-14913 
In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, SD 625, SD 650/52, SD 835, SD 845, DDR address input validation is being improperly truncated.
Problem types: description: Improper Input Validation in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon IoT, Snapdragon Mobile
Published: 2018-03-30T15:00:00.000Z
CVE-2017-14914 
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, handles in the global client structure can become stale.
Problem types: description: Use After Free in Storage
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2017-12-05T19:00:00.000Z
CVE-2017-14915 
In Android before 2018-01-05 on Qualcomm Snapdragon Mobile SD 625, SD 650/52, SD 835, accessing SPCOM functions with a compromised client structure can result in a Use After Free condition.
Problem types: description: Use After Free in Secure Processor
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-03-30T15:00:00.000Z
CVE-2017-14916 
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated.
Problem types: description: Buffer Copy without Checking Size of Input in Secure Processor
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2017-12-05T19:00:00.000Z
CVE-2017-14917 
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated.
Problem types: description: Integer Overflow to Buffer Overflow in Secure Processor
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2017-12-05T19:00:00.000Z
CVE-2017-14918 
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the GPS location wireless interface, a Use After Free condition can occur.
Problem types: description: Use After Free in GPS
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2017-12-05T19:00:00.000Z
CVE-2017-14919 
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T19:00:00.000Z
CVE-2017-14920 
Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14921 
Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14922 
Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14923 
Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14924 
Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14925 
Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php. For example, an attacker could assign administrator privileges to every unauthenticated user of the site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14926 
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14927 
In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14928 
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14929 
In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill, Gfx::doTilingPatternFill and Gfx::drawForm calls (aka a Gfx.cc infinite loop), a different vulnerability than CVE-2017-14519.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T07:00:00.000Z
CVE-2017-14930 
Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T08:00:00.000Z
CVE-2017-14931 
ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted JPEG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T08:00:00.000Z
CVE-2017-14932 
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T08:00:00.000Z
CVE-2017-14933 
read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T08:00:00.000Z
CVE-2017-14934 
process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file that contains a negative size value in a CU structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T08:00:00.000Z
CVE-2017-14935 
Pulse Secure Pulse One On-Premise 2.0.1649 and below does not properly validate requests, which allows remote users to query and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T08:00:00.000Z
CVE-2017-14937 
The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (or the OBD connector). This affects the airbag control units (aka pyrotechnical control units or PCUs) of unspecified passenger vehicles manufactured in 2014 or later, when the ignition is on and the speed is less than 6 km/h. Specifically, there are only 256 possible key pairs, and authentication attempts have no rate limit. In addition, at least one manufacturer's interpretation of the ISO 26021 standard is that it must be possible to calculate the key directly (i.e., the other 255 key pairs must not be used). Exploitation would typically involve an attacker who has already gained access to the CAN bus, and sends a crafted Unified Diagnostic Service (UDS) message to detonate the pyrotechnical charges, resulting in the same passenger-injury risks as in any airbag deployment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-20T14:00:00.000Z
CVE-2017-14938 
_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T18:00:00.000Z
CVE-2017-14939 
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T18:00:00.000Z
CVE-2017-14940 
scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T18:00:00.000Z
CVE-2017-14941 
Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-01T03:00:00.000Z
CVE-2017-14942 
Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T19:00:00.000Z
CVE-2017-14943 
Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field in JSON data to ManageSubscriber.aspx/GetSubscriber. NOTE: this software is independently deployed at multiple municipal transit systems; it is not found exclusively on the "webwatch.(REDACTED).com" server mentioned in the reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-10T06:00:00.000Z
CVE-2017-14944 
Inedo ProGet before 4.7.14 does not properly address dangerous package IDs during package addition, aka PG-1060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T19:00:00.000Z
CVE-2017-14945 
Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Possible Stack Corruption starting at KERNELBASE!RaiseException+0x0000000000000068."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T20:00:00.000Z
CVE-2017-14946 
Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at mupdfnet64!mIncrementalSaveFile+0x000000000000344e."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T20:00:00.000Z
CVE-2017-14947 
Artifex GSView 6.0 Beta on Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Access Violation on Block Data Move starting at mupdfnet64!mIncrementalSaveFile+0x0000000000193359."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T20:00:00.000Z
CVE-2017-14948 
Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code (remote). The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to mount a ROP attack: if the HTTP header field CONTENT_TYPE starts with ''boundary=' followed by more than 256 characters, a buffer overflow would be triggered, potentially causing code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-14T17:03:25.000Z
CVE-2017-14949 
Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-30T18:00:00.000Z
CVE-2017-14952 
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T16:00:00.000Z
CVE-2017-14953 
HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor states that this is not a vulnerability, but more an increase to the attack surface of the product
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-01T17:00:00.000Z
CVE-2017-14954 
The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to obtain sensitive information, and bypass the KASLR protection mechanism, via a crafted system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-01T03:00:00.000Z
CVE-2017-14955 
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-01T05:00:00.000Z
CVE-2017-14956 
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T18:00:00.000Z
CVE-2017-14957 
Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can (for example) change global settings or create/delete posts. It is also possible to execute JavaScript against unauthenticated users of the blog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-01T15:00:00.000Z
CVE-2017-14958 
lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-01T15:00:00.000Z
CVE-2017-14960 
xDashboard in OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 has SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-04T17:00:00.000Z
CVE-2017-14961 
In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x8300000c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-15T16:00:00.000Z
CVE-2017-14962 
In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Out of Bounds Write vulnerability because of not validating input values from IOCtl 0x83000058, a related issue to CVE-2017-17112.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T18:00:00.000Z
CVE-2017-14963 
In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000058.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T18:00:00.000Z
CVE-2017-14964 
In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x8300005c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T18:00:00.000Z
CVE-2017-14965 
In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x830000cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T18:00:00.000Z
CVE-2017-14966 
In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x830000c0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T18:00:00.000Z
CVE-2017-14967 
In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000080.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T18:00:00.000Z
CVE-2017-14968 
In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x830000c4, a related issue to CVE-2017-17113.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T18:00:00.000Z
CVE-2017-14969 
In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000084, a related issue to CVE-2017-17114.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T18:00:00.000Z
CVE-2017-14970 
In lib/ofp-util.c in Open vSwitch (OvS) before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor disputes the relevance of this report, stating "it can only be triggered by an OpenFlow controller, but OpenFlow controllers have much more direct and powerful ways to force Open vSwitch to allocate memory, such as by inserting flows into the flow table."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-01T20:00:00.000Z
CVE-2017-14971 
Infocus Mondopad 2.2.08 is vulnerable to a Hashed Credential Disclosure vulnerability. The attacker provides a crafted Microsoft Office document containing a link that has a UNC pathname associated with an attacker-controller server. In one specific scenario, the attacker provides an Excel spreadsheet, and the attacker-controller server receives the victim's NetNTLMv2 hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-09T05:00:00.000Z
CVE-2017-14972 
InFocus Mondopad 2.2.08 is vulnerable to authentication bypass when accessing uploaded files by entering Control-Alt-Delete, and then using Task Manager to reach a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-09T05:00:00.000Z
CVE-2017-14973 
IDenticard Two-Reader Controller Configuration Manager 1.18.8 (396) is vulnerable to Stored Cross-Site Scripting (XSS) via the notes field in /~user_handler?file=logged_in.shtm (aka the edit user page).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-09T05:00:00.000Z