rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-9632 
A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The username and password are transmitted insecurely.
Problem types: cwe_id: CWE-311
description: CWE-311
Affected products: vendor: n/a
product: PDQ Manufacturing, Inc. LaserWash, Laser Jet and ProTouch
Published: 2017-08-07T08:00:00.000Z
CVE-2017-9633 
An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: Continental AG Infineon S-Gold 2 (PMB 8876)
Published: 2017-08-07T08:00:00.000Z
CVE-2017-9634 
Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary memory locations. This can result in arbitrary code execution, compromised data integrity, denial of service, and system crash.
Problem types: cwe_id: CWE-787
description: Out-of-bounds write CWE-787
Affected products: vendor: Mitsubishi Electric Europe B.V.
product: E-Designer
Published: 2018-04-17T14:00:00.000Z
CVE-2017-9635 
Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
Problem types: cwe_id: CWE-326
description: Inadequate encryption strength CWE-326
Affected products: vendor: Schneider Electric SE
product: Ampla MES
Published: 2018-05-18T13:00:00.000Z
CVE-2017-9636 
Mitsubishi E-Designer, Version 7.52 Build 344 contains five code sections which may be exploited to overwrite the heap. This can result in arbitrary code execution, compromised data integrity, denial of service, and system crash.
Problem types: cwe_id: CWE-122
description: Heap based buffer overflow CWE-122
Affected products: vendor: Mitsubishi Electric Europe B.V.
product: E-Designer
Published: 2018-04-17T14:00:00.000Z
CVE-2017-9637 
Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
Problem types: cwe_id: CWE-319
description: Cleartext transmission of sensitive information CWE-319
Affected products: vendor: Schneider Electric SE
product: Ampla MES
Published: 2018-05-18T13:00:00.000Z
CVE-2017-9638 
Mitsubishi E-Designer, Version 7.52 Build 344 contains six code sections which may be exploited to overwrite the stack. This can result in arbitrary code execution, compromised data integrity, denial of service, and system crash.
Problem types: cwe_id: CWE-121
description: Stack based buffer overflow CWE-121
Affected products: vendor: Mitsubishi Electric Europe B.V.
product: E-Designer
Published: 2018-04-17T14:00:00.000Z
CVE-2017-9639 
An issue was discovered in Fuji Electric V-Server Version 3.3.22.0 and prior. A memory corruption vulnerability has been identified (aka improper restriction of operations within the bounds of a memory buffer), which may allow remote code execution.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: Fuji Electric V-Server
Published: 2017-07-17T19:00:00.000Z
CVE-2017-9640 
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to overwrite files that are used to execute code. This vulnerability does not affect version 6.5 of the software.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: n/a
product: Automated Logic Corporation WebCTRL, i-VU, SiteScan
Published: 2017-08-25T19:00:00.000Z
CVE-2017-9641 
PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. OSIsoft recommends that users upgrade to PI Vision 2017 or greater to mitigate this vulnerability.
Problem types: cwe_id: CWE-352
description: Cross-site request forgery CWE-352
Affected products: vendor: OSIsoft
product: PI Coresight
Published: 2018-05-25T15:00:00.000Z
CVE-2017-9644 
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An unquoted search path vulnerability may allow a non-privileged local attacker to change files in the installation directory and execute arbitrary code with elevated privileges.
Problem types: cwe_id: CWE-428
description: CWE-428
Affected products: vendor: n/a
product: Automated Logic Corporation WebCTRL, i-VU, SiteScan
Published: 2017-08-25T19:00:00.000Z
CVE-2017-9645 
An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants (including RSD31-AM Package), DRM-1/2 and variants (including Solar PWR Package), DRM and RDS Based Boundary Monitors, External Transmitters, Telepole II, and MESH Repeater (Telemetry Enabled Devices). Decryption of data is possible at the hardware level.
Problem types: cwe_id: CWE-326
description: CWE-326
Affected products: vendor: n/a
product: Mirion Technologies Telemetry Enabled Devices
Published: 2017-09-20T16:00:00.000Z
CVE-2017-9646 
An Uncontrolled Search Path Element issue was discovered in Solar Controls Heating Control Downloader (HCDownloader) Version 1.0.1.15 and prior. An uncontrolled search path element has been identified, which could allow an attacker to execute arbitrary code on a target system using a malicious DLL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-14T16:00:00.000Z
CVE-2017-9647 
A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: Continental AG Infineon S-Gold 2 (PMB 8876)
Published: 2017-08-07T08:00:00.000Z
CVE-2017-9648 
An Uncontrolled Search Path Element issue was discovered in Solar Controls WATTConfig M Software Version 2.5.10.1 and prior. An uncontrolled search path element has been identified, which could allow an attacker to execute arbitrary code on a target system using a malicious DLL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-14T16:00:00.000Z
CVE-2017-9649 
A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants (including RSD31-AM Package), DRM-1/2 and variants (including Solar PWR Package), DRM and RDS Based Boundary Monitors, External Transmitters, Telepole II, and MESH Repeater (Telemetry Enabled Devices). An unchangeable, factory-set key is included in the 900 MHz transmitter firmware.
Problem types: cwe_id: CWE-321
description: CWE-321
Affected products: vendor: n/a
product: Mirion Technologies Telemetry Enabled Devices
Published: 2017-09-20T16:00:00.000Z
CVE-2017-9650 
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: n/a
product: Automated Logic Corporation WebCTRL, i-VU, SiteScan
Published: 2017-08-25T19:00:00.000Z
CVE-2017-9653 
An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while unauthorized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-14T16:00:00.000Z
CVE-2017-9654 
The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3 base score: 6.5, CVSS vector string: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Problem types: cwe_id: CWE-312
description: Cleartext storage of sensitive information CWE-312
Affected products: vendor: Philips
product: DoseWise Portal
Published: 2018-04-24T15:00:00.000Z
CVE-2017-9655 
A Cross-Site Scripting issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker may be able to upload a malicious script that attempts to redirect users to a malicious web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-14T16:00:00.000Z
CVE-2017-9656 
The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privileges that can affect confidentiality, integrity, and availability of the database. For an attacker to exploit this vulnerability, elevated privileges are first required for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DWP application, which contains PHI. CVSS v3 base score: 9.1, CVSS vector string: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Problem types: cwe_id: CWE-798
description: Use of hard-coded credentials CWE-798
Affected products: vendor: Philips
product: DoseWise Portal
Published: 2018-04-24T15:00:00.000Z
CVE-2017-9657 
Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring station is possible. In this state, the central monitoring station can indicate the MX40 is not connected or associated to the central monitor, and thus should be operating in local monitoring mode (local audio-on, screen-on), but the MX40 WLAN itself can instead still be operating in telemetry mode (local audio-off, screen-off). If a patient experiences an alarm event and clinical staff expects the MX40 to provide local alarming when it is not available from the local device, a delay of treatment can occur. CVSS v3 base score: 6.5, CVSS vector string: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Philips has released software update, Version B.06.18, to fix the improper cleanup on thrown exception vulnerability, and implement mitigations to reduce the risk associated with the improper handling of exceptional conditions vulnerability. The software update implements messaging and alarming on the MX40 and at the central monitoring station, when the MX40 disconnects from the access point.
Problem types: cwe_id: CWE-460
description: Improper cleanup on thrown exception CWE-460
Affected products: vendor: Philips
product: IntelliVue MX40 Patient Worn Monitor
Published: 2018-04-30T15:00:00.000Z
CVE-2017-9658 
Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not required, which can necessitate intervention by hospital staff to reset the device and reestablish a network connection to the Wi-Fi access point. During this state, the Philips IntelliVue MX40 Version B.06.18 can either connect to an alternative access point within signal range for association to a central monitoring station, or it can remain in local monitoring mode until the device is reset by hospital staff. CVSS v3 base score: 6.5, CVSS vector string: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Philips has released software update, Version B.06.18, to fix the improper cleanup on thrown exception vulnerability, and implement mitigations to reduce the risk associated with the improper handling of exceptional conditions vulnerability. The software update implements messaging and alarming on the MX40 and at the central monitoring station, when the MX40 disconnects from the access point.
Problem types: cwe_id: CWE-755
description: Improper handling of exceptional conditions CWE-755
Affected products: vendor: Philips
product: IntelliVue MX40 Patient Worn Monitor
Published: 2018-04-30T15:00:00.000Z
CVE-2017-9659 
A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. The stack-based buffer overflow vulnerability has been identified, which may cause a crash or allow remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-14T16:00:00.000Z
CVE-2017-9660 
A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. A heap-based buffer overflow vulnerability has been identified, which may cause a crash or allow remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-14T16:00:00.000Z
CVE-2017-9661 
An Uncontrolled Search Path Element issue was discovered in SIMPlight SCADA Software version 4.3.0.27 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to place a malicious DLL file within the search path resulting in execution of arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-14T16:00:00.000Z
CVE-2017-9662 
An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Monitouch V-SFT is installed in a directory with weak access controls by default, which could allow an authenticated attacker with local access to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-14T16:00:00.000Z
CVE-2017-9663 
An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow a remote attacker to access an encryption key that is stored in cleartext in memory.
Problem types: cwe_id: CWE-312
description: CWE-312
Affected products: vendor: n/a
product: General Motors and Shanghai OnStar (SOS) iOS Client
Published: 2018-01-09T21:00:00.000Z
CVE-2017-9664 
In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal files of ABB SREA-01 and SREA-50 legacy remote monitoring tools without any authorization over the network using a HTTP request which refers to files using ../../ relative paths. Once the internal password file is retrieved, the password hash can be identified using a brute force attack. There is also an exploit allowing running of commands after authorization.
Problem types: cwe_id: CWE-23
description: Relative path traversal CWE-23
Affected products: vendor: ICS-CERT
product: ABB SREA-01 and SREA-50
Published: 2018-05-24T20:00:00.000Z
CVE-2017-9668 
In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-18T21:00:00.000Z
CVE-2017-9669 
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution by crafting a malicious APKINDEX.tar.gz file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-17T21:00:00.000Z
CVE-2017-9670 
An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-15T13:00:00.000Z
CVE-2017-9671 
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-17T21:00:00.000Z
CVE-2017-9673 
In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account (via the index.php/user/new URI) or change its settings (via the index.php/user/1 URI), including its password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-15T18:00:00.000Z
CVE-2017-9674 
In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?return_url=[XSS] exploitable as a regular or admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-15T18:00:00.000Z
CVE-2017-9675 
On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-15T19:00:00.000Z
CVE-2017-9676 
In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing global static variables without using a lock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T15:00:00.000Z
CVE-2017-9677 
In all Qualcomm products with Android releases from CAF using the Linux kernel, in function msm_compr_ioctl_shared, variable "ddp->params_length" could be accessed and modified by multiple threads, while it is not protected with locks. If one thread is running, while another thread is setting data, race conditions will happen. If "ddp->params_length" is set to a big number, a buffer overflow will occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T15:00:00.000Z
CVE-2017-9678 
In all Qualcomm products with Android releases from CAF using the Linux kernel, in a video driver, memory corruption can potentially occur due to lack of bounds checking in a memcpy().
Problem types: description: Buffer Copy without Checking Size of Input in Display
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T19:00:00.000Z
CVE-2017-9679 
In all Qualcomm products with Android releases from CAF using the Linux kernel, if a userspace string is not NULL-terminated, kernel memory contents can leak to system logs.
Problem types: description: Improper Input Validation in Kernel
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T19:00:00.000Z
CVE-2017-9680 
In all Qualcomm products with Android releases from CAF using the Linux kernel, if a pointer argument coming from userspace is invalid, a driver may use an uninitialized structure to log an error message.
Problem types: description: Use of Uninitialized Variable in Kernel
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T19:00:00.000Z
CVE-2017-9681 
In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if kernel memory address is passed from userspace through iris_vidioc_s_ext_ctrls ioctl, it will print kernel address data. A user could set it to an arbitrary kernel address, hence information disclosure (for kernel) could occur.
Problem types: description: Untrusted Pointer Dereference in FM
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-03-30T15:00:00.000Z
CVE-2017-9682 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in two KGSL driver functions can lead to a Use After Free condition.
Problem types: description: Use After Free in Graphics
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T19:00:00.000Z
CVE-2017-9683 
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a meta image, an integer overflow can occur, if user-defined image offset and size values are too large.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-10T20:00:00.000Z
CVE-2017-9684 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in a USB driver can lead to a Use After Free condition.
Problem types: description: Use After Free in USB
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T19:00:00.000Z
CVE-2017-9685 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in a WLAN driver can lead to a Use After Free condition.
Problem types: description: Use After Free in WLAN
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T19:00:00.000Z
CVE-2017-9686 
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possible double free/use after free in the SPS driver when debugfs logging is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-10T20:00:00.000Z