rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-3188 The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal
The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, the filenames of its contents are not properly checked, allowing for writing files to arbitrary directories on the file system. These archives may be uploaded directly via the administrator panel, or using the CSRF vulnerability (CVE-2017-3187). An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: docCMS
product: Administration Panel
Credits: lang: en
value: Thanks to:

[1]SafeDog Penetration and Defense Lab:darong tong
[2]SafeDog Penetration and Defense Lab:yong cai
[3]shaohong wu 

for reporting these vulnerabilities.
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3189 The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload
The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle contains. This vulnerability combined with the path traversal vulnerability (CVE-2017-3188) can lead to remote command execution with the permissions of the user running the dotCMS application. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: docCMS
product: Administration Panel
Credits: lang: en
value: Thanks to:

[1]SafeDog Penetration and Defense Lab:darong tong
[2]SafeDog Penetration and Defense Lab:yong cai
[3]shaohong wu 

for reporting these vulnerabilities.
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3190 
Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Flash Seats
product: Flash Seats Mobile App
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3191 
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages such as tools_admin.asp without credentials.
Problem types: cwe_id: CWE-294
description: CWE-294: Authentication Bypass by Capture-replay
Affected products: vendor: D-Link
product: DIR-130
vendor: D-Link
product: DIR-330
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3192 
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: D-Link
product: DIR-130
vendor: D-Link
product: DIR-330
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3193 
Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability in the web administration interface HNAP service.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: D-Link
product: DIR-850L and potentially others
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3194 
Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Pandora Media, Inc.
product: Pandora iOS App
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3195 
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Commvault
product: Service Pack 6
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3196 
PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outside of its typical bounds on the driver's receipt of network packets. Local attackers can exploit this issue to execute arbitrary code with SYSTEM privileges.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Printing Communications Assoc., Inc. (PCAUSA)
product: ASUS PCE-AC56 WLAN Card Utilities
Published: 2017-12-15T14:00:00.000Z
CVE-2017-3197 GIGABYTE BRIX UEFI firmware fails to securely implement BIOS write protection
GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_BWP, and PRx features. As a result, the BIOS is not protected from arbitrary write access and may permit modifications to the SPI flash.
Problem types: cwe_id: CWE-693
description: CWE-693: Protection Mechanism Failure
Affected products: vendor: GIGABYTE
product: GB-BSi7H-6500
vendor: GIGABYTE
product: GB-BXi7-5775
Published: 2018-07-09T19:00:00.000Z
CVE-2017-3198 GIGABYTE BRIX UEFI firmware is not cryptographically signed
GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: GIGABYTE
product: GB-BSi7H-6500
vendor: GIGABYTE
product: GB-BXi7-5775
Published: 2018-07-09T19:00:00.000Z
CVE-2017-3199 GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization
The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: GraniteDS
product: Framework
Published: 2018-06-11T17:00:00.000Z
CVE-2017-3200 The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code control
The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.
Problem types: cwe_id: CWE-913
description: CWE-913: Improper Control of Dynamically-Managed Code Resources
Affected products: vendor: GraniteDS
product: Framework
Published: 2018-06-11T17:00:00.000Z
CVE-2017-3201 Flamingo amf-serializer by Exadel, version 2.2.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization
The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Exadel
product: Flamingo amf-serializer
Published: 2018-06-11T17:00:00.000Z
CVE-2017-3202 The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code control
The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.
Problem types: cwe_id: CWE-913
description: CWE-913: Improper Control of Dynamically-Managed Code Resources
Affected products: vendor: Exadel
product: Flamingo amf-serializer
Published: 2018-06-11T17:00:00.000Z
CVE-2017-3203 Pivotal/Spring Spring-flex's Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization
The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Pivotal/Spring
product: Spring-flex
Published: 2018-06-11T17:00:00.000Z
CVE-2017-3204 
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: Go
product: SSH library
Published: 2017-04-04T14:00:00.000Z
CVE-2017-3206 The Action Message Format (AMF3) deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages
The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Exadel
product: Flamingo amf-serializer
Published: 2018-06-11T17:00:00.000Z
CVE-2017-3207 WebORB for Java by Midnight Coders, version 5.1.1.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization
The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Midnight Coders
product: WebORB for Java
Published: 2018-06-11T17:00:00.000Z
CVE-2017-3208 
The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T17:00:00.000Z
CVE-2017-3209 The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user
The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: DBPOWER
product: U818A WiFi Quadcopter Drone
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3210 Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the component pdiservice.exe with NT AUTHORITY/SYSTEM permissions. This component is also read/writable by all Authenticated Users. This allows local authenticated attackers to run arbitrary code with SYSTEM privileges. The following applications have been identified by Portrait Displays as affected: Fujitsu DisplayView Click: Version 6.0 and 6.01. The issue was fixed in Version 6.3. Fujitsu DisplayView Click Suite: Version 5. The issue is addressed by patch in Version 5.9. HP Display Assistant: Version 2.1. The issue was fixed in Version 2.11. HP My Display: Version 2.0. The issue was fixed in Version 2.1. Philips Smart Control Premium: Versions 2.23, 2.25. The issue was fixed in Version 2.26.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: Portrait Display
product: SDK
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3211 Centire Yopify leaks customer information
Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without user authorization.
Problem types: cwe_id: CWE-213
description: CWE-213 Intentional Information Exposure
Affected products: vendor: Centire
product: Yopify
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability was discovered by Oliver Keyes, a Rapid7, Inc. senior data scientist.
Published: 2020-01-15T17:05:26.627Z
CVE-2017-3212 
The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: lack of X.509 certificate validation
Affected products: vendor: n/a
product: Space Coast Credit Union Mobile
Published: 2017-05-05T07:04:00.000Z
CVE-2017-3213 
The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: lack of X.509 certificate validation
Affected products: vendor: n/a
product: Think Mutual Bank Mobile Banking
Published: 2017-05-05T07:04:00.000Z
CVE-2017-3214 
The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary.
Problem types: cwe_id: CWE-312
description: CWE-312
Affected products: vendor: Milwaukee Tool
product: ONE-KEY
Published: 2017-06-20T00:00:00.000Z
CVE-2017-3215 
The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with a user_id can be used to perform user actions.
Problem types: cwe_id: CWE-613
description: CWE-613
Affected products: vendor: Milwaukee Tool
product: ONE-KEY
Published: 2017-06-20T00:00:00.000Z
CVE-2017-3216 
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Huawei Technologies
product: BM2022
vendor: Huawei Technologies
product: HES-309M
vendor: Huawei Technologies
product: HES-319M
vendor: Huawei Technologies
product: HES-319M2W
vendor: Huawei Technologies
product: HES-339M
vendor: Green Packet
product: OX350
vendor: ZTE
product: OX-330P
vendor: ZyXEL
product: MAX218M
vendor: ZyXEL
product: MAX218M1W
vendor: ZyXEL
product: MAX218MW
vendor: ZyXEL
product: MAX308M
vendor: ZyXEL
product: MAX318M
vendor: ZyXEL
product: MAX338M
vendor: MADA
product: Soho Wireless Router
Published: 2017-06-20T00:00:00.000Z
CVE-2017-3217 CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface by the integrator / reseller
CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface by the integrator / reseller. This interface must be password protected, otherwise, the attacker only needs to know the phone number of the device (via an IMSI Catcher, for example) to send administrative commands to the device. These commands can be used to provide ongoing, real-time access to the device and can configure parameters such as IP addresses, firewall rules, and passwords.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: CalAmp
product: LMU 3030 OBD-II
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3218 
Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.
Problem types: cwe_id: CWE-295
description: CWE-295
cwe_id: CWE-311
description: CWE-311
Affected products: vendor: Samsung
product: Magician
Published: 2017-06-21T20:00:00.000Z
CVE-2017-3219 
Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash.
Problem types: cwe_id: CWE-311
description: CWE-311
Affected products: vendor: Acronis
product: True Image
Published: 2017-06-21T20:00:00.000Z
CVE-2017-3221 
Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwords.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Inmarsat
product: AmosConnect
Published: 2017-07-22T20:00:00.000Z
CVE-2017-3222 
Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microsoft Windows host platform with SYSTEM privileges by abusing AmosConnect Task Manager.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Inmarsat
product: AmosConnect
Published: 2017-07-22T20:00:00.000Z
CVE-2017-3223 Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow
Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow. Dahua IP camera products include an application known as Sonia (/usr/bin/sonia) that provides the web interface and other services for controlling the IP camera remotely. Versions of Sonia included in firmware versions prior to DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 do not validate input data length for the 'password' field of the web interface. A remote, unauthenticated attacker may submit a crafted POST request to the IP camera's Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution. The issue was originally identified by the researcher in firmware version DH_IPC-HX1X2X-Themis_EngSpnFrn_N_V2.400.0000.30.R.20160803.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Dahua
product: IP Camera
Credits: lang: en
value: Thanks to Ilya Smith of Positive Technologies for reporting this vulnerability.
Published: 2018-07-24T15:00:00.000Z
CVE-2017-3224 Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages)
Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a 'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the erasure or alteration of the routing tables of routers within the routing domain, creating a denial of service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages).
Problem types: cwe_id: CWE-354
description: CWE-354
Affected products: vendor: Open Shortest Path First (OSPF)
product: Protocol
Published: 2018-07-24T15:00:00.000Z