rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-3093 
Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the bitmap representation module. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Adobe Digital Editions 4.5.4 and earlier.
Published: 2017-06-20T17:00:00.000Z
CVE-2017-3094 
Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF processing engine. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Adobe Digital Editions 4.5.4 and earlier.
Published: 2017-06-20T17:00:00.000Z
CVE-2017-3095 
Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF parsing engine. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Adobe Digital Editions 4.5.4 and earlier.
Published: 2017-06-20T17:00:00.000Z
CVE-2017-3096 
Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the character code mapping module. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Adobe Digital Editions 4.5.4 and earlier.
Published: 2017-06-20T17:00:00.000Z
CVE-2017-3097 
Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading functions in the installer plugin. A successful exploitation could lead to arbitrary code execution.
Problem types: description: Insecure Library Loading (DLL hijacking)
Affected products: vendor: n/a
product: Adobe Digital Editions 4.5.4 and earlier.
Published: 2017-06-20T17:00:00.000Z
CVE-2017-3098 
Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that could be abused to read and write arbitrary files to the server.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Adobe Captivate 9 and earlier.
Published: 2017-06-20T17:00:00.000Z
CVE-2017-3099 
Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Adobe Flash Player 26.0.0.131 and earlier.
Published: 2017-07-14T05:00:00.000Z
CVE-2017-3100 
Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Adobe Flash Player 26.0.0.131 and earlier.
Published: 2017-07-14T05:00:00.000Z
CVE-2017-3101 
Adobe Connect versions 9.6.1 and earlier have a clickjacking vulnerability. Successful exploitation could lead to a clickjacking attack.
Problem types: description: Clickjacking
Affected products: vendor: n/a
product: Adobe Connect 9.6.1 and earlier.
Published: 2017-07-14T05:00:00.000Z
CVE-2017-3102 
Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation could lead to a reflected cross-site scripting attack.
Problem types: description: Cross-site scripting
Affected products: vendor: n/a
product: Adobe Connect 9.6.1 and earlier.
Published: 2017-07-14T05:00:00.000Z
CVE-2017-3103 
Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to a stored cross-site scripting attack.
Problem types: description: Cross-site scripting
Affected products: vendor: n/a
product: Adobe Connect 9.6.1 and earlier.
Published: 2017-07-14T05:00:00.000Z
CVE-2017-3104 
Adobe RoboHelp has a cross-site scripting (XSS) vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2.
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: n/a
product: Adobe RoboHelp RH2017.0.1 and earlier versions
Published: 2017-12-01T08:00:00.000Z
CVE-2017-3105 
Adobe RoboHelp has an Open Redirect vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2.
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: n/a
product: Adobe RoboHelp RH2017.0.1 and earlier versions
Published: 2017-12-01T08:00:00.000Z
CVE-2017-3106 
Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Type Confusion
Affected products: vendor: Adobe Systems Incorporated
product: Flash Player
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3107 
Adobe Experience Manager 6.3 and earlier has a misconfiguration vulnerability.
Problem types: description: Misconfiguration
Affected products: vendor: Adobe Systems Incorporated
product: Experience Manager
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3108 
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability.
Problem types: description: Malicious file execution
Affected products: vendor: Adobe Systems Incorporated
product: Experience Manager
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3109 
An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Adobe Experience Manager has a reflected cross-site scripting vulnerability in the HtmlRendererServlet.
Problem types: description: Reflected cross-site scripting
Affected products: vendor: n/a
product: Adobe Experience Manager 6.3, 6.2, 6.1, 6.0
Published: 2017-12-09T06:00:00.000Z
CVE-2017-3110 
Adobe Experience Manager 6.1 and earlier has a sensitive data exposure vulnerability.
Problem types: description: Sensitive Data Exposure
Affected products: vendor: Adobe Systems Incorporated
product: Experience Manager
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3111 
An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain circumstances.
Problem types: description: Sensitive token in HTTP GET request
Affected products: vendor: n/a
product: Adobe Experience Manager 6.3, 6.2, 6.1, 6.0
Published: 2017-12-09T06:00:00.000Z
CVE-2017-3112 
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of AdobePSDK metadata. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Flash Player 27.0.0.183 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-3113 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in JavaScript engine when creating large strings. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3114 
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of providing language- and region- or country- specific functionality. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Flash Player 27.0.0.183 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-3115 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an information disclosure vulnerability when handling links in a PDF document.
Problem types: description: Information Disclosure
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3116 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the MakeAccessible plugin when parsing TrueType font data. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3117 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable heap overflow vulnerability in the plugin that handles links within the PDF. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Heap Overflow
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3118 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has a security bypass vulnerability related to execution of malicious attachments.
Problem types: description: Security Bypass
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3119 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in Acrobat/Reader 11.0.19 engine. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3120 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA parsing engine when handling certain types of internal instructions. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3121 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the Enhanced Metafile Format (EMF) parser. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3122 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to Bezier curves. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3123 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data drawing position definition. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3124 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the picture exchange (PCX) file format parsing module. Successful exploitation could lead to arbitrary code execution.
Problem types: description: Memory Corruption
Affected products: vendor: Adobe Systems Incorporated
product: Acrobat Reader
Published: 2017-08-11T19:00:00.000Z
CVE-2017-3125 
An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker.
Problem types: description: Information leak
Affected products: vendor: Fortinet
product: FortiMail
Published: 2017-04-12T15:00:00.000Z
CVE-2017-3126 
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter.
Problem types: description: Open redirect
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiAnalyzer, FortiManager
Published: 2017-05-26T22:00:00.000Z
CVE-2017-3127 
A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation.
Problem types: description: Execution of unauthorized code or commands
Affected products: vendor: n/a
product: n/a
Published: 2017-06-01T14:00:00.000Z
CVE-2017-3128 
A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label parameter.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiOS
Published: 2017-05-23T17:00:00.000Z
CVE-2017-3129 
A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiWeb
Published: 2017-05-26T22:00:00.000Z
CVE-2017-3130 
An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by inspecting FortiOS IKE VendorID packets.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiOS
Published: 2017-08-10T21:00:00.000Z
CVE-2017-3131 
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiOS
Published: 2017-09-12T02:00:00.000Z
CVE-2017-3132 
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiOS
Published: 2017-09-12T02:00:00.000Z
CVE-2017-3133 
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiOS
Published: 2017-09-12T02:00:00.000Z
CVE-2017-3134 
An escalation of privilege vulnerability in Fortinet FortiWLC-SD versions 8.2.4 and below allows attacker to gain root access via the CLI command 'copy running-config'.
Problem types: description: Escalation of privilege
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiWLC-SD
Published: 2017-05-26T22:00:00.000Z
CVE-2017-3135 Combination of DNS64 and RPZ Can Lead to Crash
Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.
Problem types: description: Servers utilizing both DNS64 and RPZ are potentially susceptible to encountering this condition.  When this condition occurs, it will result in either an INSIST assertion failure (and subsequent abort) or an attempt to read through a NULL pointer.  On most platforms a NULL pointer read leads to a segmentation fault (SEGFAULT), which causes the process to be terminated.

Only servers which are configured to simultaneously use both Response Policy Zones (RPZ) and DNS64 (a method for synthesizing AAAA records from A records) can be affected by this vulnerability.
Affected products: vendor: ISC
product: BIND 9
Credits: lang: en
value: ISC would like to thank Ramesh Damodaran(Infoblox) and Aliaksandr Shubnik (Infoblox) for reporting the issue and assisting us in the investigation.
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3136 An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"
A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.
Problem types: description: Servers are at risk if they are configured to use DNS64 and if the option "break-dnssec yes;" is in use.
Affected products: vendor: ISC
product: BIND 9
Credits: lang: en
value: ISC would like to thank Oleg Gorokhov of Yandex for making us aware of this vulnerability.
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3137 A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.
Problem types: description: A server which is performing recursion can be forced to exit with an assertion failure if it can be caused to receive a response containing CNAME or DNAME resource records with certain ordering.  An attacker can cause a denial of service by exploiting this condition.  Recursive resolvers are at highest risk but authoritative servers are theoretically vulnerable if they perform recursion.
Affected products: vendor: ISC
product: BIND 9
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3138 named exits with a REQUIRE assertion failure if it receives a null command string on its control channel
named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9.
Problem types: description: The BIND control channel is not configured by default, but when configured will accept commands from those IP addresses that are specified in its access control list and/or from clients which present the proper transaction key.  Using this defect, an attacker can cause a running server to stop if they can get it to accept control channel input from them.  In most instances this is not as bad as it sounds, because existing commands permitted over the control channel (i.e. "rndc stop") can already be given to cause the server to stop.

However, BIND 9.11.0 introduced a new option to allow "read only" commands over the command channel.  Using this restriction, a server can be configured to limit specified clients to giving control channel commands which return information only (e.g. "rndc status") without affecting the operational state of the server.  The defect described in this advisory, however, is not properly stopped by the "read only" restriction, in essence permitting a privilege escalation allowing a client which should only be permitted the limited set of "read only" operations to cause the server to stop execution.
Affected products: vendor: ISC
product: BIND 9
Credits: lang: en
value: ISC would like to thank Mike Lalumiere of Dyn, Inc., for bringing this issue to our attention.
Published: 2019-01-16T20:00:00.000Z
CVE-2017-3139 
A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.
Problem types: description: Other
Affected products: vendor: Red Hat
product: BIND
Published: 2019-04-09T17:07:24.000Z
CVE-2017-3140 An error processing RPZ rules can cause named to loop endlessly after handling a query
If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1.
Problem types: description: A server is potentially vulnerable to degradation of service if

    the server is configured to use RPZ,
    the server uses NSDNAME or NSIP policy rules, and
    an attacker can cause the server to process a specific query

Successful exploitation of this condition will cause named to enter a state where it continues to loop while processing the query without ever reaching an end state. While in this state, named repeatedly queries the same sets of authoritative nameservers and this behavior will usually persist indefinitely beyond the normal client query processing timeout. By triggering this condition multiple times, an attacker could cause a deliberate and substantial degradation in service.

Operators of servers that meet the above conditions 1. and 2. may also accidentally encounter this defect during normal operation.  It is for this reason that the decision was made to issue this advisory despite its low CVSS score.
Affected products: vendor: ISC
product: BIND 9
Credits: lang: en
value: ISC would like to thank Oli Schacher of Switch for bringing this defect to our attention.
Published: 2019-01-16T20:00:00.000Z