rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-9989 
IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120555.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2017-07-05T18:00:00.000Z
CVE-2016-9990 
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998824.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: iNotes
Published: 2017-03-31T18:00:00.000Z
CVE-2016-9991 
IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 121314.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling Order Management
Published: 2017-06-08T21:00:00.000Z
CVE-2016-9992 
IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1992067.
Problem types: description: Data Manipulation
Affected products: vendor: IBM Corporation
product: Kenexa LCMS Premier on Cloud
Published: 2017-03-01T21:00:00.000Z
CVE-2016-9993 
IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1992067.
Problem types: description: Data Manipulation
Affected products: vendor: IBM Corporation
product: Kenexa LCMS Premier on Cloud
Published: 2017-03-01T21:00:00.000Z
CVE-2016-9994 
IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1976805.
Problem types: description: Data Manipulation
Affected products: vendor: IBM Corporation
product: Kenexa LCMS Premier on Cloud
Published: 2017-03-01T21:00:00.000Z
CVE-2016-9997 
SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-17T03:34:00.000Z
CVE-2016-9998 
SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-17T03:34:00.000Z
CVE-2017-0001 
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0005, CVE-2017-0025, and CVE-2017-0047.
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft Corporation
product: Windows GDI
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0002 
Microsoft Edge allows remote attackers to bypass the Same Origin Policy via vectors involving the about:blank URL and data: URLs, aka "Microsoft Edge Elevation of Privilege Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-10T21:00:00.000Z
CVE-2017-0003 
Microsoft Word 2016 and SharePoint Enterprise Server 2016 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-10T21:00:00.000Z
CVE-2017-0004 
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to cause a denial of service (reboot) via a crafted authentication request, aka "Local Security Authority Subsystem Service Denial of Service Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-10T21:00:00.000Z
CVE-2017-0005 
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047.
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft Corporation
product: Windows GDI
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0006 
Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0019, CVE-2017-0020, CVE-2017-0030, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Office
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0007 
Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without invalidating associated signatures, aka "PowerShell Security Feature Bypass Vulnerability."
Problem types: description: Security Feature Bypass
Affected products: vendor: Microsoft Corporation
product: Device Guard
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0008 
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009 and CVE-2017-0059.
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft Corporation
product: Internet Explorer
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0009 
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0011, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068.
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft Corporation
product: Browser
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0010 
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Browser
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0011 
Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068.
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft Corporation
product: Edge
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0012 
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerability." This vulnerability is different from those described in CVE-2017-0033 and CVE-2017-0069.
Problem types: description: Spoofing
Affected products: vendor: Microsoft Corporation
product: Browsers
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0014 
The Windows Graphics Component in Microsoft Office 2010 SP2; Windows Server 2008 R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component Remote Code Execution Vulnerability." This vulnerability is different from that described in CVE-2017-0108.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Windows Graphics Component
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0015 
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Browser
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0016 
Microsoft Windows 10 Gold, 1511, and 1607; Windows 8.1; Windows RT 8.1; Windows Server 2012 R2, and Windows Server 2016 do not properly handle certain requests in SMBv2 and SMBv3 packets, which allows remote attackers to execute arbitrary code via a crafted SMBv2 or SMBv3 packet to the Server service, aka "SMBv2/SMBv3 Null Dereference Denial of Service Vulnerability."
Problem types: description: Denial of Service
Affected products: vendor: Microsoft Corporation
product: SMBv2/SMBv3
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0017 
The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0065, and CVE-2017-0068.
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft Corporation
product: Edge
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0018 
Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0037 and CVE-2017-0149.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Internet Explorer
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0019 
Microsoft Word 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0020, CVE-2017-0030, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Office
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0020 
Microsoft Excel 2016, Excel 2010 SP2, Excel 2013 RT SP1, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0030, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Office
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0021 
Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute arbitrary code on a target OS, aka "Hyper-V System Data Structure Vulnerability." This vulnerability is different from that described in CVE-2017-0095.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Hyper-V vSMB
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0022 
Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft Corporation
product: XML Core Services
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0023 
The PDF library in Microsoft Edge; Windows 8.1; Windows Server 2012 and R2; Windows RT 8.1; and Windows 10, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: PDF
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0024 
The kernel-mode drivers in Microsoft Windows 10 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0026, CVE-2017-0056, CVE-2017-0078, CVE-2017-0079, CVE-2017-0080, CVE-2017-0081, and CVE-2017-0082.
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft Corporation
product: Win32k
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0025 
The kernel-mode drivers in Microsoft Windows Vista; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0005, and CVE-2017-0047.
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft Corporation
product: Windows GDI
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0026 
The kernel-mode drivers in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0056, CVE-2017-0078, CVE-2017-0079, CVE-2017-0080, CVE-2017-0081, and CVE-2017-0082.
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft Corporation
product: Win32k
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0027 
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka "Microsoft Office Information Disclosure Vulnerability."
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft Corporation
product: Office
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0028 
A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka "Scripting Engine Memory Corruption Vulnerability."
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Microsoft ChakraCore
Published: 2017-07-14T18:00:00.000Z
CVE-2017-0029 
Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 RT SP1, and Word 2016 allow remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Microsoft Office Denial of Service Vulnerability."
Problem types: description: Denial of Service
Affected products: vendor: Microsoft Corporation
product: Office
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0030 
Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Office
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0031 
Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, and Word 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0030, CVE-2017-0052, and CVE-2017-0053.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Office
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0032 
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Browser
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0033 
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerability." This vulnerability is different from those described in CVE-2017-0012 and CVE-2017-0069.
Problem types: description: Spoofing
Affected products: vendor: Microsoft Corporation
product: Browser
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0034 
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Edge
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0035 
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Browser
Published: 2017-03-17T00:00:00.000Z
CVE-2017-0037 
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft Corporation
product: Internet Browser
Published: 2017-02-26T23:30:00.000Z