rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-0885 
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages.
Problem types: cwe_id: CWE-209
description: Information Exposure Through an Error Message (CWE-209)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-04-05T20:00:00.000Z
CVE-2017-0886 
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service.
Problem types: cwe_id: CWE-674
description: Uncontrolled Recursion (CWE-674)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-04-05T20:00:00.000Z
CVE-2017-0887 
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator.
Problem types: cwe_id: CWE-807
description: Reliance on Untrusted Inputs in a Security Decision (CWE-807)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-04-05T20:00:00.000Z
CVE-2017-0888 
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information.
Problem types: cwe_id: CWE-451
description: User Interface (UI) Misrepresentation of Critical Information (CWE-451)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-04-05T20:00:00.000Z
CVE-2017-0889 
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: thoughtbot
product: paperclip ruby gem
Published: 2017-11-13T17:00:00.000Z
CVE-2017-0890 
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-05-08T20:00:00.000Z
CVE-2017-0891 
Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-05-08T20:00:00.000Z
CVE-2017-0892 
Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-05-08T20:00:00.000Z
CVE-2017-0893 
Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-05-08T20:00:00.000Z
CVE-2017-0894 
Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.
Problem types: cwe_id: CWE-285
description: Information Exposure Through Directory Listing (CWE-285)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-05-08T20:00:00.000Z
CVE-2017-0895 
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
Problem types: cwe_id: CWE-285
description: Information Exposure Through Directory Listing (CWE-285)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2017-05-08T20:00:00.000Z
CVE-2017-0896 
Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: Zulip
product: Zulip Server
Published: 2017-06-02T17:00:00.000Z
CVE-2017-0897 
ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.
Problem types: cwe_id: CWE-330
description: Use of Insufficiently Random Values (CWE-330)
Affected products: vendor: EllisLab
product: ExpressionEngine
Published: 2017-06-22T21:00:00.000Z
CVE-2017-0898 
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.
Problem types: cwe_id: CWE-134
description: Format String Vulnerability (CWE-134)
Affected products: vendor: HackerOne
product: Ruby
Published: 2017-09-15T19:00:00.000Z
CVE-2017-0899 
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Problem types: cwe_id: CWE-150
description: Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)
Affected products: vendor: HackerOne
product: RubyGems
Published: 2017-08-31T20:00:00.000Z
CVE-2017-0900 
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-31T20:00:00.000Z
CVE-2017-0901 
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'&#219;&#170;) (CWE-22)
Affected products: vendor: HackerOne
product: RubyGems
Published: 2017-08-31T20:00:00.000Z
CVE-2017-0902 
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
Problem types: cwe_id: CWE-350
description: Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)
Affected products: vendor: HackerOne
product: RubyGems
Published: 2017-08-31T20:00:00.000Z
CVE-2017-0903 
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data (CWE-502)
Affected products: vendor: HackerOne
product: RubyGems
Published: 2017-10-11T18:00:00.000Z
CVE-2017-0904 
The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.
Problem types: cwe_id: CWE-242
description: Use of Inherently Dangerous Function (CWE-242)
Affected products: vendor: jtdowney
product: private_address_check ruby gem
Published: 2017-11-13T17:00:00.000Z
CVE-2017-0905 
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: Recurly
product: recurly ruby gem
Published: 2017-11-13T17:00:00.000Z
CVE-2017-0906 
The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: Recurly
product: recurly python module
Published: 2017-11-13T17:00:00.000Z
CVE-2017-0907 
The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF) (CWE-918)
Affected products: vendor: Recurly
product: recurly-api-client .NET library
Published: 2017-11-13T17:00:00.000Z
CVE-2017-0909 
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
Problem types: cwe_id: CWE-184
description: Incomplete Blacklist (CWE-184)
Affected products: vendor: HackerOne
product: private_address_check ruby gem
Published: 2017-11-16T22:00:00.000Z
CVE-2017-0910 
In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization (CWE-863)
Affected products: vendor: Zulip
product: Zulip Server
Published: 2017-11-27T16:00:00.000Z
CVE-2017-0911 
Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service.
Problem types: cwe_id: CWE-360
description: Trust of System Event Data (CWE-360)
Affected products: vendor: Twitter
product: Twitter Kit for iOS
Published: 2018-02-09T22:00:00.000Z
CVE-2017-0912 
Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization, it is possible to inject arbitrary HTML code by manipulating the uploaded filename. Successful exploitation requires valid credentials to an account with "Edit" access to "Scheduling".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2017-0913 
Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with "Edit" access to "System Customization".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2017-0914 
Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a GitLab instance's database.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0915 
Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution.
Problem types: cwe_id: CWE-77
description: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0916 
Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution.
Problem types: cwe_id: CWE-77
description: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0917 
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0918 
Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution.
Problem types: cwe_id: CWE-23
description: Relative Path Traversal (CWE-23)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0919 
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2017-0920 
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance.
Problem types: cwe_id: CWE-639
description: Authorization Bypass Through User-Controlled Key (CWE-639)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-22T15:00:00.000Z
CVE-2017-0921 
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2017-0922 
Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on any board object.
Problem types: cwe_id: CWE-639
description: Authorization Bypass Through User-Controlled Key (CWE-639)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0923 
Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0924 
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0925 
Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.
Problem types: cwe_id: CWE-522
description: Insufficiently Protected Credentials (CWE-522)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0926 
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0927 
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: GitLab
product: GitLab Community and Enterprise Editions
Published: 2018-03-21T20:00:00.000Z
CVE-2017-0928 
html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.
Problem types: cwe_id: CWE-642
description: External Control of Critical State Data (CWE-642)
Affected products: vendor: HackerOne
product: html-janitor node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-0929 
DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-03T21:00:00.000Z
CVE-2017-0930 
augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: augustine node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-0931 
html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: html-janitor node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-0932 
Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation on the input of the Feature functionality. An attacker with access to an operator (read-only) account and ssh connection to the devices could escalate privileges to admin (root) access in the system.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: Ubiquiti Networks
product: EdgeRouter X
Published: 2018-03-22T14:00:00.000Z
CVE-2017-0933 
Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-only) account could lure an admin (root) user to access the attacker-controlled page, allowing the attacker to gain admin privileges in the system.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CWE-352)
Affected products: vendor: Ubiquiti Networks
product: EdgeRouter X
Published: 2018-03-22T14:00:00.000Z
CVE-2017-0934 
Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: Ubiquiti Networks
product: EdgeRouter X
Published: 2018-03-22T14:00:00.000Z
CVE-2017-0935 
Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management (CWE-269)
Affected products: vendor: Ubiquiti Networks
product: EdgeRouter X
Published: 2018-03-22T14:00:00.000Z
CVE-2017-0936 
Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.
Problem types: cwe_id: CWE-639
description: Authorization Bypass Through User-Controlled Key (CWE-639)
Affected products: vendor: Nextcloud
product: Nextcloud Server
Published: 2018-03-28T20:00:00.000Z
CVE-2017-0938 
Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: airMAX, EdgeMAX
Published: 2019-02-12T22:00:00.000Z
CVE-2017-1000001 
FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T20:00:00.000Z
CVE-2017-1000002 
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-13T20:00:00.000Z