rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-4916 
VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Successful exploitation of this issue may allow host users with normal user privileges to trigger a denial-of-service in a Windows host machine.
Problem types: description: NULL pointer dereference
Affected products: vendor: VMware
product: Workstation Pro/Player
Published: 2017-05-22T14:00:00.000Z
CVE-2017-4917 
VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained.
Problem types: description: Information Disclosure
Affected products: vendor: VMware
product: vSphere Data Protection (VDP)
Published: 2017-06-07T17:00:00.000Z
CVE-2017-4918 
VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.
Problem types: description: Command injection vulnerability
Affected products: vendor: VMware
product: Horizon View Client for Mac
Published: 2017-06-08T19:00:00.000Z
CVE-2017-4919 
VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.
Problem types: description: Unauthorized Access Heap buffer-overflow vulnerability
Affected products: vendor: VMware
product: VMware vCenter Server
Published: 2017-07-28T22:00:00.000Z
CVE-2017-4920 
The implementation of the OSPF protocol in VMware NSX-V Edge 6.2.x prior to 6.2.8 and NSX-V Edge 6.3.x prior to 6.3.3 doesn't correctly handle the link-state advertisement (LSA). A rogue LSA may exploit this issue resulting in continuous sending of LSAs between two routers eventually going in loop or loss of connectivity.
Problem types: description: Denial of Service
Affected products: vendor: VMware
product: NSX-V Edge
Published: 2017-12-05T21:00:00.000Z
CVE-2017-4921 
VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-01T16:00:00.000Z
CVE-2017-4922 
VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical information when the service gets restarted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-01T16:00:00.000Z
CVE-2017-4923 
VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-01T16:00:00.000Z
CVE-2017-4924 
VMware ESXi (ESXi 6.5 without patch ESXi650-201707101-SG), Workstation (12.x before 12.5.7) and Fusion (8.x before 8.5.8) contain an out-of-bounds write vulnerability in SVGA device. This issue may allow a guest to execute code on the host.
Problem types: description: Out-of-bounds write vulnerability
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2017-09-15T13:00:00.000Z
CVE-2017-4925 
VMware ESXi 6.5 without patch ESXi650-201707101-SG, ESXi 6.0 without patch ESXi600-201706101-SG, ESXi 5.5 without patch ESXi550-201709101-SG, Workstation (12.x before 12.5.3), Fusion (8.x before 8.5.4) contain a NULL pointer dereference vulnerability. This issue occurs when handling guest RPC requests. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.
Problem types: description: NULL pointer dereference vulnerability
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2017-09-15T13:00:00.000Z
CVE-2017-4926 
VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.
Problem types: description: Stored XSS
Affected products: vendor: VMware
product: vCenter Server
Published: 2017-09-15T13:00:00.000Z
CVE-2017-4927 
VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service.
Problem types: description: LDAP denial of service vulnerability
Affected products: vendor: VMware
product: vCenter Server
Published: 2017-11-17T14:00:00.000Z
CVE-2017-4928 
The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure.
Problem types: description: Server-side request forgery and carriage return line feed injection issues
Affected products: vendor: VMware
product: vSphere Web Client
Published: 2017-11-17T14:00:00.000Z
CVE-2017-4929 
VMware NSX Edge (6.2.x before 6.2.9 and 6.3.x before 6.3.5) contains a moderate Cross-Site Scripting (XSS) issue which may lead to information disclosure.
Problem types: description: Cross-Site Scripting (XSS) vulnerability
Affected products: vendor: VMware
product: NSX Edge
Published: 2017-11-17T14:00:00.000Z
CVE-2017-4930 
VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add a malicious URL to an enrolled device's 'Links' page. Successful exploitation of this issue could result in an unsuspecting AWC user being redirected to a malicious URL.
Problem types: description: Stored XSS vulnerability
Affected products: vendor: VMware
product: VMware AirWatch Console (AWC)
Published: 2017-11-16T21:00:00.000Z
CVE-2017-4931 
VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious content.
Problem types: description: CSV file integrity vulnerability
Affected products: vendor: VMware
product: VMware AirWatch Console (AWC)
Published: 2017-11-16T21:00:00.000Z
CVE-2017-4932 
VMware AirWatch Launcher for Android prior to 3.2.2 contains a vulnerability that could allow an escalation of privilege from the launcher UI context menu to native UI functionality and privilege. Successful exploitation of this issue could result in an escalation of privilege.
Problem types: description: Privilege escalation
Affected products: vendor: VMware
product: VMware AirWatch Launcher for Android (AWL)
Published: 2017-11-16T21:00:00.000Z
CVE-2017-4933 
VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this issue could result in remote code execution in a virtual machine via the authenticated VNC session. Note: In order for exploitation to be possible in ESXi, VNC must be manually enabled in a virtual machine's .vmx configuration file. In addition, ESXi must be configured to allow VNC traffic through the built-in firewall.
Problem types: description: Heap overflow via authenticated VNC session
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2017-12-20T15:00:00.000Z
CVE-2017-4934 
VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a heap buffer-overflow vulnerability in VMNAT device. This issue may allow a guest to execute code on the host.
Problem types: description: Heap buffer-overflow vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2017-11-17T14:00:00.000Z
CVE-2017-4935 
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds write vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View Client.
Problem types: description: Out-of-bounds write vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-11-17T14:00:00.000Z
CVE-2017-4936 
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-11-17T14:00:00.000Z
CVE-2017-4937 
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View Client.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-11-17T14:00:00.000Z
CVE-2017-4938 
VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a guest RPC NULL pointer dereference vulnerability. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.
Problem types: description: NULL pointer dereference vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2017-11-17T14:00:00.000Z
CVE-2017-4939 
VMware Workstation (12.x before 12.5.8) installer contains a DLL hijacking issue that exists due to some DLL files loaded by the application improperly. This issue may allow an attacker to load a DLL file of the attacker's choosing that could execute arbitrary code.
Problem types: description: DLL hijacking vulnerability
Affected products: vendor: VMware
product: Workstation
Published: 2017-11-17T21:00:00.000Z
CVE-2017-4940 
The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker can exploit this vulnerability by injecting Javascript, which might get executed when other users access the Host Client.
Problem types: description: Stored cross-site scripting vulnerability
Affected products: vendor: VMware
product: ESXi
Published: 2017-12-20T15:00:00.000Z
CVE-2017-4941 
VMware ESXi (6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this issue could result in remote code execution in a virtual machine via the authenticated VNC session. Note: In order for exploitation to be possible in ESXi, VNC must be manually enabled in a virtual machine's .vmx configuration file. In addition, ESXi must be configured to allow VNC traffic through the built-in firewall.
Problem types: description: Stack overflow via authenticated VNC session
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2017-12-20T15:00:00.000Z
CVE-2017-4942 
VMware AirWatch Console (AWC) contains a Broken Access Control vulnerability. Successful exploitation of this issue could result in end-user device details being disclosed to an unauthorized administrator.
Problem types: description: Broken Access Control
Affected products: vendor: VMware
product: Airwatch Console
Published: 2017-12-13T02:00:00.000Z
CVE-2017-4943 
VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: VMware
product: vCenter Server Appliance (vCSA)
Published: 2017-12-20T15:00:00.000Z
CVE-2017-4945 
VMware Workstation (14.x and 12.x) and Fusion (10.x and 8.x) contain a guest access control vulnerability. This issue may allow program execution via Unity on locked Windows VMs. VMware Tools must be updated to 10.2.0 for each VM to resolve CVE-2017-4945. VMware Tools 10.2.0 is consumed by Workstation 14.1.0 and Fusion 10.1.0 by default.
Problem types: description: Guest access control vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2018-01-05T14:00:00.000Z
CVE-2017-4946 
The VMware V4H and V4PA desktop agents (6.x before 6.5.1) contain a privilege escalation vulnerability. Successful exploitation of this issue could result in a low privileged windows user escalating their privileges to SYSTEM.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: VMware
product: vRealize Operations for Horizon (V4H)
vendor: VMware
product: vRealize Operations for Published Applications (V4PA)
Published: 2018-01-05T14:00:00.000Z
CVE-2017-4947 
VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.
Problem types: description: Deserialization vulnerability via Xenon
Affected products: vendor: VMware
product: vRealize Automation
default_status: unaffected
vendor: VMware
product: vSphere Integrated Containers
default_status: unaffected
Published: 2018-01-29T16:00:00.000Z
CVE-2017-4948 
VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in TPView.dll. On Workstation, this issue in conjunction with other bugs may allow a guest to leak information from host or may allow for a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this issue in conjunction with other bugs may allow a View desktop to leak information from host or may allow for a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Problem types: description: Out-of-bounds read
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon Client for Windows
Published: 2018-01-05T14:00:00.000Z
CVE-2017-4949 
VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default.
Problem types: description: Use-after-free vulnerability
Affected products: vendor: VMware
product: Workstation Pro / Player
vendor: VMware
product: Fusion
Published: 2018-01-11T14:00:00.000Z
CVE-2017-4950 
VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 mode for VMNAT is not enabled by default.
Problem types: description: Integer-overflow vulnerability
Affected products: vendor: VMware
product: Workstation Pro / Player
vendor: VMware
product: Fusion
Published: 2018-01-11T14:00:00.000Z
CVE-2017-4951 
VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking users into installing a malicious application on their devices.
Problem types: description: Cross Site Request Forgery
Affected products: vendor: VMware
product: AirWatch Console
Published: 2018-01-29T16:00:00.000Z
CVE-2017-4952 
VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information disclosure.
Problem types: description: Authentication bypass vulnerability
Affected products: vendor: VMware
product: VMware Xenon
Published: 2018-05-02T14:00:00.000Z
CVE-2017-4955 
An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.65, 1.7.x versions prior to 1.7.48, 1.8.x versions prior to 1.8.28, and 1.9.x versions prior to 1.9.5. Several credentials were present in the logs for the Notifications errand in the PCF Elastic Runtime tile.
Problem types: description: Credentials in Elastic Runtime Notifications errand log
Affected products: vendor: n/a
product: PCF Elastic Runtime
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4959 
An issue was discovered in Pivotal PCF Elastic Runtime 1.8.x versions prior to 1.8.29 and 1.9.x versions prior to 1.9.7. Pivotal Cloud Foundry deployments using the Pivotal Account application are vulnerable to a flaw which allows an authorized user to take over the account of another user, causing account lockout and potential escalation of privileges.
Problem types: description: Pivotal Cloud Foundry account authorization vulnerability
Affected products: vendor: n/a
product: PCF Elastic Runtime
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4960 
An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.
Problem types: description: DOS
Affected products: vendor: n/a
product: Cloud Foundry Foundation Cloud Foundry release v247 - v252, UAA stand-alone release v3.9.0 - v3.11.0, UAA Bosh Release v21 - v26
Published: 2017-03-10T01:00:00.000Z
CVE-2017-4961 
An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions. In certain cases an authenticated Director user can provide a malicious checksum that could allow them to escalate their privileges on the Director VM, aka "BOSH Director Shell Injection Vulnerabilities."
Problem types: description: BOSH Director Shell Injection Vulnerabilities
Affected products: vendor: n/a
product: Cloud Foundry Foundation BOSH Release
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4963 
An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external SAML or OpenID Connect based identity providers.
Problem types: description: Session Fixation for UAA External Authentication
Affected products: vendor: n/a
product: Cloud Foundry Foundation
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4964 
Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs created by the director, aka a "CPI code injection vulnerability."
Problem types: description: CPI code injection vulnerability
Affected products: vendor: n/a
product: Cloud Foundry Foundation BOSH Azure CPI Release v22
Published: 2017-04-06T19:00:00.000Z
CVE-2017-4965 
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.
Problem types: description: XSS vulnerabilities in RabbitMQ management UI
Affected products: vendor: n/a
product: Pivotal RabbitMQ
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4966 
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser's local storage without expiration, making it possible to retrieve them using a chained attack.
Problem types: description: local storage of credentials
Affected products: vendor: n/a
product: Pivotal RabbitMQ
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4967 
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.
Problem types: description: XSS vulnerabilities in RabbitMQ management UI
Affected products: vendor: n/a
product: Pivotal RabbitMQ
Published: 2017-06-13T06:00:00.000Z
CVE-2017-4969 
The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotas for tasks.
Problem types: description: Authenticated developer users to exceed memory and disk quotas for tasks
Affected products: vendor: n/a
product: Cloud Foundry Cloud Controller cf-release versions prior to v255
Published: 2017-04-20T22:00:00.000Z