rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-14797 
Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories) by leveraging the ability to sniff HTTP traffic on the local intranet network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-30T03:00:00.000Z
CVE-2017-14798 local privilege escalation in SUSE postgresql init script
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
Problem types: description: creation of directory could follow symlinks
cwe_id: CWE-61
description: CWE-61
Affected products: vendor: suse
product: postgresql-init
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2018-03-01T19:00:00.000Z
CVE-2017-14799 XSS Vulnerability with ESP URL
A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page.
Problem types: description: cross site scripting attack in the login parameter handling due to incorrect quoting
Affected products: vendor: NetIQ
product: Access Manager
Published: 2018-03-01T19:00:00.000Z
CVE-2017-14800 Reflected xss on Access Manager iManager UI
A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users.
Problem types: description: reflected cross site scripting attack
Affected products: vendor: NetIQ
product: Access Manager
Published: 2018-03-01T19:00:00.000Z
CVE-2017-14801 Reflected xss in Admin Console REST interface
Reflected XSS in the NetIQ Access Manager before 4.3.3 allowed attackers to reflect back xss into the called page using the url parameter.
Problem types: description: Reflected cross site scripting
cwe_id: CWE-79
description: CWE-79
Affected products: vendor: NetIQ
product: Access Manager
Published: 2018-03-02T20:00:00.000Z
CVE-2017-14802 Unvalidated Redirect in NetIQ Access Manager after upgrading to NAM 4.3 AC and IDP URLs
Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third party sites.
Problem types: description: redirect to untrusted sites
cwe_id: CWE-601
description: CWE-601
Affected products: vendor: NetIQ
product: Access Manager
Published: 2018-03-02T20:00:00.000Z
CVE-2017-14803 
In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system.
Problem types: description: Directory Traversal Information Disclosure Vulnerability
Affected products: vendor: Micro Focus
product: NetIQ Access Manager
Published: 2018-01-20T00:00:00.000Z
CVE-2017-14804 package builds could use directory traversal to write outside of target area
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
Problem types: description: Insufficient pathname checking could use to bypass directory restrictions.
cwe_id: CWE-22
description: CWE-22
Affected products: vendor: SUSE
product: build
Credits: lang: en
value: Marcus Hüwe
Published: 2018-03-01T19:00:00.000Z
CVE-2017-14806 Insecure handling of repodata and packages in SUSE Studio onlite
A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Studio onsite susestudio-common version 1.3.17-56.6.3 and prior versions.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: SUSE
product: Studio onsite
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2020-01-27T09:45:15.863Z
CVE-2017-14807 SQL injection in ui-server/app/models/diary_entry.rb in SUSE Studio onsite
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects: SUSE Studio onsite susestudio-ui-server version 1.3.17-56.6.3 and prior versions.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SUSE
product: Studio onsite
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2020-01-27T09:45:16.257Z
CVE-2017-14818 
This vulnerability allows remote attackers to disclose sensitive on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-4982.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14819 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the channel number member of the cdef box. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5011.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14820 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the tile index of the SOT marker in JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5012.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14821 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of the xTsiz member of SIZ markers. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5013.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14822 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of the xOsiz member of SIZ markers. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5014.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14823 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the signer method of XFA's Signature objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-5015.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14824 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the insert method of XFAScriptObject objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5016.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14825 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the remove method of XFAScriptObject objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5017.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14826 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the formNodes method of XFA Node objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5018.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14827 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the append method of XFA Node objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5019.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14828 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the w method of XFA Layout objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5020.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14829 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the openList method of XFAScriptObject objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5021.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14830 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the setFocus method of XFAScriptObject objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5022.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14831 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the author attribute of Circle Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5023.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14832 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the style attribute of Caret Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5024.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14833 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the style attribute of Text Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5025.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14834 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the style attribute of FileAttachment annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5026.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14835 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the page method of XFA Layout objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5027.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14836 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the modDate attribute of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5028.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14837 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the pageSpan method of XFA Layout objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5029.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-14838 
TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14839 
TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14840 
TeamWork TicketPlus allows Arbitrary File Upload in updateProfile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14841 
Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14842 
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14843 
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14844 
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14845 
Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14846 
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14847 
Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T20:00:00.000Z
CVE-2017-14848 
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T21:00:00.000Z
CVE-2017-14849 
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-28T00:00:00.000Z