rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-5663 
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to the query.
Problem types: description: SQL Injection Vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Fineract
Published: 2017-12-14T15:00:00.000Z
CVE-2017-5664 
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
Problem types: description: Security Constrainy Bypass
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
Published: 2017-06-06T14:00:00.000Z
CVE-2017-5665 
The splt_cue_export_to_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5666 
The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (invalid free and crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2017-5667 
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-16T15:00:00.000Z
CVE-2017-5668 
bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T14:00:00.000Z
CVE-2017-5669 
The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-24T15:00:00.000Z
CVE-2017-5670 
Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate attackers to obtain sensitive information by reading raw disk blocks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-04T16:00:00.000Z
CVE-2017-5671 
Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriting the /etc/shadow file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-29T14:00:00.000Z
CVE-2017-5672 
Kony Enterprise Mobile Management (EMM) before 4.2.5.2 has the vulnerability of disclosing the private key in clear-text when changing the parameters of the request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T15:00:00.000Z
CVE-2017-5673 
In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject (aka topic subject) accepts JavaScript, leading to XSS. Six files are affected: crypsis/layouts/message/item/default.php, crypsis/layouts/message/item/top/default.php, crypsis/layouts/message/item/bottom/default.php, crypsisb3/layouts/message/item/default.php, crypsisb3/layouts/message/item/top/default.php, and crypsisb3/layouts/message/item/bottom/default.php. This is fixed in 5.0.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-22T17:00:00.000Z
CVE-2017-5674 
A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-13T06:14:00.000Z
CVE-2017-5675 
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will be executed with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-13T06:14:00.000Z
CVE-2017-5677 
PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T18:00:00.000Z
CVE-2017-5681 
The RSA-CRT implementation in the Intel QuickAssist Technology (QAT) Engine for OpenSSL versions prior to 0.5.19 may allow remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.
Problem types: description: Information Disclosure
Affected products: vendor: Intel
product: Intel Quick Assist Technology
Published: 2017-03-07T18:00:00.000Z
CVE-2017-5682 
Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives, Intel Math Kernel Library, Intel Data Analytics Acceleration Library, and Intel Threading Building Blocks before 2017 Update 2 allows an attacker to launch a process with escalated privileges.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives, Intel Math Kernel Library, Intel Data Analytics Acceleration Library, Intel Threading Building Blocks Before 2017 Update 2
Published: 2017-02-28T19:00:00.000Z
CVE-2017-5683 
Privilege escalation in IntelHAXM.sys driver in the Intel Hardware Accelerated Execution Manager before version 6.0.6 allows a local user to gain system level access.
Problem types: description: Privilege Escalation
Affected products: vendor: Intel
product: Intel Hardware Accelerated Execution Manager
Published: 2017-04-04T14:00:00.000Z
CVE-2017-5684 
The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system to gain access to personal information.
Problem types: description: Information Disclosure
Affected products: vendor: Intel
product: Intel Compute Stick STK2MV64CC
Published: 2017-04-03T21:00:00.000Z
CVE-2017-5685 
The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system to gain access to personal information.
Problem types: description: Information Disclosure
Affected products: vendor: Intel
product: Intel NUC NUC6i7KYK
Published: 2017-04-03T21:00:00.000Z
CVE-2017-5686 
The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system to gain access to personal information.
Problem types: description: Information Disclosure
Affected products: vendor: Intel
product: Intel NUC NUC6i5SYSH/K, Intel NUC6i3SYSH/K
Published: 2017-04-03T21:00:00.000Z
CVE-2017-5688 
There is an escalation of privilege vulnerability in the Intel Solid State Drive Toolbox versions before 3.4.5 which allow a local administrative attacker to load and execute arbitrary code.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Solid State Drive Toolbox
Published: 2017-05-31T14:00:00.000Z
CVE-2017-5689 
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability
Published: 2017-05-02T14:00:00.000Z
CVE-2017-5691 
Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Processor Families, and Intel Xeon E3-1200 v5 and v6 Product Families.
Published: 2017-07-26T15:00:00.000Z
CVE-2017-5692 
Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local users to perform a denial of service attack.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Mobile, Desktop, Server, Workstation, and Embedded processors based on Intel Core and Atom Processors using an affected driver.
Published: 2018-08-01T15:00:00.000Z
CVE-2017-5693 
Firmware in the Intel Puma 5, 6, and 7 Series might experience resource depletion or timeout, which allows a network attacker to create a denial of service via crafted network traffic.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Puma 5, 6, and 7 Series
Published: 2018-07-31T19:00:00.000Z
CVE-2017-5694 
Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P, PSF109P allows local users to cause a denial of service via unspecified vectors.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Solid-State Drive Professional
Published: 2017-08-09T14:00:00.000Z
CVE-2017-5695 
Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware versions LSBG200, LSF031C, LSF036C, LBF010C, LSBG100, LSF031C, LSF036C, LBF010C, LSF031P, LSF036P, LBF010P, LSF031P, LSF036P, LBF010P, LSMG200, LSF031E, LSF036E, LSMG100, LSF031E, LSF036E, LSDG200, LSF031D, LSF036D allows local users to cause a denial of service via unspecified vectors.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Solid-State Drive Consumer, Professional, Embedded, Data Center
Published: 2017-08-09T14:00:00.000Z
CVE-2017-5696 
Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access.
Problem types: description: Information Disclosure/Denial of Service
Affected products: vendor: Intel Corporation
product: Intel Graphics Driver
Published: 2018-01-18T01:00:00.000Z
CVE-2017-5697 
Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 11.6.25.1129 potentially allowing a remote attacker to hijack users web clicks via attacker's crafted web page.
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Active Mangement Technology
Published: 2017-06-14T12:00:00.000Z
CVE-2017-5698 
Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollback will not prevent upgrading to firmware version 11.6.x.1xxx which is vulnerable to CVE-2017-5689 and can be performed by a local user with administrative privileges.
Problem types: description: Escalation of Privilege
Affected products: vendor: Intel Corporation
product: Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology
Published: 2017-09-05T19:00:00.000Z
CVE-2017-5699 
Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: MinnowBoard 3
Published: 2018-01-18T02:00:00.000Z
CVE-2017-5700 
Insufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to bypass Administrator and User passwords via access to password storage.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: NUC Kits
Published: 2017-10-11T00:00:00.000Z
CVE-2017-5701 
Insecure platform configuration in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows an attacker with physical presence to run arbitrary code via unauthorized firmware modification during BIOS Recovery.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: NUC Kits
Published: 2017-10-11T00:00:00.000Z
CVE-2017-5703 
Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Intel 6th generation Intel Core Processors, Intel 7th generation Processors, Intel Xeon Scalable Processors, Intel Xeon Processor E3 v5 Family, Intel Xeon Processor E3 v6 Family, and Intel Atom Processor C Series.
Published: 2018-04-03T21:00:00.000Z
CVE-2017-5704 
Platform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7th Gen Intel Core Processor potentially exposes password information in memory to a local attacker with administrative privileges.
Problem types: description: Information disclosure
Affected products: vendor: Intel Corporation
product: Intel Core Processor
Published: 2018-07-10T21:00:00.000Z
CVE-2017-5705 
Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Manageability Engine
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5706 
Multiple buffer overflows in kernel in Intel Server Platform Services Firmware 4.0 allow attacker with local access to the system to execute arbitrary code.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Server Platform Services
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5707 
Multiple buffer overflows in kernel in Intel Trusted Execution Engine Firmware 3.0 allow attacker with local access to the system to execute arbitrary code.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Trusted Execution Engine
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5708 
Multiple privilege escalations in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow unauthorized process to access privileged content via unspecified vector.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Manageability Engine
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5709 
Multiple privilege escalations in kernel in Intel Server Platform Services Firmware 4.0 allows unauthorized process to access privileged content via unspecified vector.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Server Platform Services
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5710 
Multiple privilege escalations in kernel in Intel Trusted Execution Engine Firmware 3.0 allows unauthorized process to access privileged content via unspecified vector.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Trusted Execution Engine
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5711 
Multiple buffer overflows in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code with AMT execution privilege.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Active Management Technology
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5712 
Buffer overflow in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allows attacker with remote Admin access to the system to execute arbitrary code with AMT execution privilege.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Active Management Technology
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5715 
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Microprocessors with Speculative Execution
Published: 2018-01-04T13:00:00.000Z
CVE-2017-5717 
Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileges via local access.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Intel Graphics Driver
Published: 2017-12-12T20:00:00.000Z
CVE-2017-5719 
A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a local user.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Deep Learning Training Tool
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5721 
Insufficient input validation in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to execute arbitrary code via manipulation of memory.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: NUC Kits
Published: 2017-10-11T00:00:00.000Z
CVE-2017-5722 
Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows attackers with local or physical access to bypass enforcement of integrity protections via manipulation of firmware storage.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: NUC Kits
Published: 2017-10-11T00:00:00.000Z
CVE-2017-5727 
Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to elevate privileges via local access.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Intel Graphics Driver
Published: 2018-02-02T15:00:00.000Z
CVE-2017-5729 
Frame replay vulnerability in Wi-Fi subsystem in Intel Dual-Band and Tri-Band Wireless-AC Products allows remote attacker to replay frames via channel-based man-in-the-middle.
Problem types: description: Denial of Service
Affected products: vendor: Intel Corporation
product: Dual-Band Wireless-AC and Tri-Band Wireless-AC
Published: 2017-11-21T14:00:00.000Z
CVE-2017-5731 
Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Problem types: description: Escalation of Privilege, Denial of Service, Information Disclosure
Affected products: vendor: n/a
product: Tianocore
Published: 2019-10-28T14:47:35.000Z
CVE-2017-5736 
An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code as administrator.
Problem types: description: Elevation of Privilege
Affected products: vendor: Intel Corporation
product: Software Guard Extensions Platform Software Component
Published: 2018-03-20T20:00:00.000Z
CVE-2017-5738 
Escalation of privilege vulnerability in admin portal for Intel Unite App versions 3.1.32.12, 3.1.41.18 and 3.1.45.26 allows an attacker with network access to cause a denial of service and/or information disclosure.
Problem types: description: Escalation of privilege
Affected products: vendor: Intel Corporation
product: Unite App
Published: 2017-11-16T14:00:00.000Z
CVE-2017-5753 
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Most Modern Operating Systems
Published: 2018-01-04T13:00:00.000Z
CVE-2017-5754 
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Problem types: description: Information Disclosure
Affected products: vendor: Intel Corporation
product: Most Modern Operating Systems
Published: 2018-01-04T13:00:00.000Z
CVE-2017-5780 
A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Problem types: description: clickjacking
Affected products: vendor: Hewlett Packard Enterprise
product: Matrix Operating Environment
Published: 2018-02-15T22:00:00.000Z