rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-9075 
The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T06:25:00.000Z
CVE-2017-9076 
The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T06:25:00.000Z
CVE-2017-9077 
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T14:00:00.000Z
CVE-2017-9078 
The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T14:00:00.000Z
CVE-2017-9079 
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T14:00:00.000Z
CVE-2017-9080 
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T15:00:00.000Z
CVE-2017-9083 
poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example, the perf_test utility will crash (segmentation fault) when parsing an invalid PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T16:00:00.000Z
CVE-2017-9085 
Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 6.5 to 8.0 allow remote attackers to inject arbitrary web script via the (1) "paramFile" parameter to /Site/Troubleshooting/DiagnosticReport.asp, or (2) "paramFile" parameter to /Site/Troubleshooting/SpeedTest.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-14T17:00:00.000Z
CVE-2017-9090 
reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to bypass the CAPTCHA via an empty $_POST['captcha'].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T18:00:00.000Z
CVE-2017-9091 
/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to CAPTCHA bypass by emptying $_POST['captcha'].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T18:00:00.000Z
CVE-2017-9093 
The my_skip_input_data_fn function in imagew-jpeg.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T19:00:00.000Z
CVE-2017-9094 
The lzw_add_to_dict function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T19:00:00.000Z
CVE-2017-9095 
XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-08T10:00:00.000Z
CVE-2017-9096 
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-08T16:00:00.000Z
CVE-2017-9097 
In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a remote attacker to read or modify files through a path traversal technique, as demonstrated by reading the password file, or using the template parameter to cgi-bin/write.cgi to write to an arbitrary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-16T03:00:00.000Z
CVE-2017-9098 
ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T19:00:00.000Z
CVE-2017-9100 
login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password field during an admin login attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T03:41:00.000Z
CVE-2017-9101 
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T18:00:00.000Z
CVE-2017-9103 
An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length. Depending on the circumstances, an attacker might be able to trick adns into crashing the calling program, leaking aspects of the contents of some of its memory, causing it to allocate lots of memory, or perhaps overrunning a buffer. This is only possible with applications which make non-raw queries for SOA or RP records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T14:53:21.000Z
CVE-2017-9104 
An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T14:50:48.000Z
CVE-2017-9105 
An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because of a wrong number of pointer dereferences. This bug may well be exploitable as a remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T13:09:34.000Z
CVE-2017-9106 
An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the right range; if it isn't, the buffer may be overrun (depending on the sizes of the types on the current platform). Of course the inputs ought to be right. And there are pointers in there too, so perhaps one could say that the caller ought to check these things. It may be better to require the caller to make the pointer structure right, but to have the code here be defensive about (and tolerate with an error but without crashing) out-of-range integer values. So: it should defend each of these integer conversion sites with a check for the actual permitted range, and return adns_s_invaliddata if not. The lack of this check causes the SOA sign extension bug to be a serious security problem: the sign extended SOA value is out of range, and overruns the buffer when reconverted. This is related to sign extending SOA 32-bit integer fields, and use of a signed data type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T13:08:28.000Z
CVE-2017-9107 
An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with \, and adns_qf_quoteok_query was specified, qdparselabel would read additional bytes from the buffer and try to treat them as the escape sequence. It would depart the input buffer and start processing many bytes of arbitrary heap data as if it were the query domain. Eventually it would run out of input or find some other kind of error, and declare the query domain invalid. But before then it might outrun available memory and crash. In principle this could be a denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T13:06:39.000Z
CVE-2017-9108 
An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T13:05:46.000Z
CVE-2017-9109 
An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T13:02:11.000Z
CVE-2017-9110 
In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T18:00:00.000Z
CVE-2017-9111 
In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T18:00:00.000Z
CVE-2017-9112 
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T18:00:00.000Z
CVE-2017-9113 
In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T18:00:00.000Z
CVE-2017-9114 
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T18:00:00.000Z
CVE-2017-9115 
In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T18:00:00.000Z
CVE-2017-9116 
In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T18:00:00.000Z
CVE-2017-9117 
In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: LibTIFF
product: LibTIFF
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2017-05-21T19:00:00.000Z
CVE-2017-9118 
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-02T15:00:00.000Z
CVE-2017-9119 
The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T19:00:00.000Z
CVE-2017-9120 
PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-02T15:00:00.000Z
CVE-2017-9122 
The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9123 
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9124 
The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9125 
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9126 
The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9127 
The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9128 
The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T06:00:00.000Z
CVE-2017-9129 
The wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (large loop) via a crafted wav file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-21T07:00:00.000Z
CVE-2017-9130 
The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-21T07:00:00.000Z
CVE-2017-9131 
An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. By connecting to the Mosquitto broker on an access point and one of its clients, an attacker can gather enough information to craft a command that reboots the client remotely when sent to the client's Mosquitto broker, aka "unauthenticated remote command execution." This command can be re-sent endlessly to act as a DoS attack on the client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T21:00:00.000Z
CVE-2017-9132 
A hard-coded credentials issue was discovered on Mimosa Client Radios before 2.2.3, Mimosa Backhaul Radios before 2.2.3, and Mimosa Access Points before 2.2.3. These devices run Mosquitto, a lightweight message broker, to send information between devices. By using the vendor's hard-coded credentials to connect to the broker on any device (whether it be an AP, Client, or Backhaul model), an attacker can view all the messages being sent between the devices. If an attacker connects to an AP, the AP will leak information about any clients connected to it, including the serial numbers, which can be used to remotely factory reset the clients via a page in their web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T21:00:00.000Z
CVE-2017-9133 
An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. In the device's web interface, after logging in, there is a page that allows you to ping other hosts from the device and view the results. The user is allowed to specify which host to ping, but this variable is not sanitized server-side, which allows an attacker to pass a specially crafted string to execute shell commands as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T21:00:00.000Z
CVE-2017-9134 
An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. There is a page in the web interface that will show you the device's serial number, regardless of whether or not you have logged in. This information-leakage issue is relevant because there is another page (accessible without any authentication) that allows you to remotely factory reset the device simply by entering the serial number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T21:00:00.000Z
CVE-2017-9135 
An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program like cURL. There is one test accessible via cURL that does not properly sanitize user input, allowing an attacker to execute shell commands as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T21:00:00.000Z
CVE-2017-9136 
An issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface, there is a page that allows an attacker to use an unsanitized GET parameter to download files from the device as the root user. The attacker can download any file from the device's filesystem. This can be used to view unsalted, MD5-hashed administrator passwords, which can then be cracked, giving the attacker full admin access to the device's web interface. This vulnerability can also be used to view the plaintext pre-shared key (PSK) for encrypted wireless connections, or to view the device's serial number (which allows an attacker to factory reset the device).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T21:00:00.000Z
CVE-2017-9137 
Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a default password of mateidu for the mateidu account (a hidden user account established by the vendor). This account can be accessed via both the web interface and SSH. In the web interface, this simply grants an attacker read-only access to the device's settings. However, when using SSH, this gives an attacker access to a Linux shell. NOTE: the vendor has commented "The mateidu user is a known user, which is mentioned in the FibeAir IP-10 User Guide. Customers are instructed to change the mateidu user password. Changing the user password fully solves the vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T21:00:00.000Z
CVE-2017-9138 
There is a debug-interface vulnerability on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20). After connecting locally to a router in a wired or wireless manner, one can bypass intended access restrictions by sending shell commands directly and reading their results, or by entering shell commands that change this router's username and password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T22:00:00.000Z
CVE-2017-9139 
There is a stack-based buffer overflow on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20). Crafted POST requests to an unspecified URL result in DoS, interrupting the HTTP service (used to login to the web UI of a router) for 1 to 2 seconds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T22:00:00.000Z
CVE-2017-9140 
Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-9141 
In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T14:00:00.000Z
CVE-2017-9142 
In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T14:00:00.000Z
CVE-2017-9143 
In ImageMagick 7.0.5-5, the ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T14:00:00.000Z
CVE-2017-9144 
In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T14:00:00.000Z