rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-8983 
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P4 was found.
Problem types: description: Remote Code Execution
Affected products: vendor: Hewlett Packard Enterprise
product: Intelligent Management Center (iMC) PLAT
Published: 2018-02-15T22:00:00.000Z
CVE-2017-8984 
A remote code execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0506P03 was found.
Problem types: description: Remote Code Execution
Affected products: vendor: Hewlett Packard Enterprise
product: Intelligent Management Center (iMC) PLAT
Published: 2018-02-15T22:00:00.000Z
CVE-2017-8985 
HPE XP Storage using Hitachi Global Link Manager (HGLM) has a local authenticated information disclosure vulnerability in HGLM version HGLM 6.3.0-00 to 8.5.2-00.
Problem types: description: Local Authentication Bypass
Affected products: vendor: Hewlett Packard Enterprise
product: XP Storage using HGLM
Published: 2018-02-15T22:00:00.000Z
CVE-2017-8987 
A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 (iLO 3) version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions.
Problem types: description: remote denial of service
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Integrated Lights-Out 3 (iLO 3)
Published: 2018-08-06T20:00:00.000Z
CVE-2017-8988 
A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software Earlier than 8.5.3-00. The vulnerability impacts DevMgr Earlier than 8.5.3-00 (for Windows, Linux), RepMgr earlier than 8.5.3-00 (for Windows, Linux) and HDLM earlier than 8.5.3-00 (for Windows, Linux, Solaris, AIX).
Problem types: description: remote bypass of security restrictions
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Command View Advanced Edition
Published: 2018-08-06T20:00:00.000Z
CVE-2017-8989 
A security vulnerability in HPE IceWall SSO Dfw 10.0 and 11.0 on RHEL, HP-UX, and Windows could be exploited remotely to allow URL Redirection.
Problem types: description: remote URL redirection
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Icewall DFW
Published: 2018-08-06T20:00:00.000Z
CVE-2017-8990 
A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Service Manager (WSM) Software earlier than version WSM 7.3 (E0506). This issue was resolved in HPE IMC Wireless Services Manager Software IMC WSM 7.3 E0506P01 or subsequent version.
Problem types: description: remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Intelligent Management Center (IMC) Wirelss Service Manager
Published: 2018-08-06T20:00:00.000Z
CVE-2017-8991 
HPE has identified a cross site scripting (XSS) vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
Problem types: description: cross site scripting (XSS)
Affected products: vendor: Hewlett Packard Enterprise
product: HPE CentralView Fraud Risk Management
Published: 2018-08-06T20:00:00.000Z
CVE-2017-8992 
HPE has identified a remote privilege escalation vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
Problem types: description: remote privilege escalation
Affected products: vendor: Hewlett Packard Enterprise
product: HPE CentralView Fraud Risk Management
Published: 2018-08-06T20:00:00.000Z
CVE-2017-8993 
A Remote Cross-Site Scripting vulnerability in HPE Project and Portfolio Management (PPM) version v9.30, v9.31, v9.32, v9.40 was found.
Problem types: description: Remote Cross-Site Scripting
Affected products: vendor: Hewlett Packard Enterprise
product: Project and Portfolio Management (PPM)
Published: 2018-02-15T22:00:00.000Z
CVE-2017-8994 
A input validation vulnerability in HPE Operations Orchestration product all versions prior to 10.80, allows for the execution of code remotely.
Problem types: description: Remote Code Execution
Affected products: vendor: Micro Focus
product: HPE Operations Orchestration
Published: 2017-10-10T21:00:00.000Z
CVE-2017-9000 
ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An unauthenticated user with network access to an Aruba mobility controller on TCP port 8080 or 8081 may be able to access arbitrary files stored on the mobility controller. Ports 8080 and 8081 are used for captive portal functionality and are listening, by default, on all IP interfaces of the mobility controller, including captive portal interfaces. The attacker could access files which could contain passwords, keys, and other sensitive information that could lead to full system compromise.
Problem types: description: unauthenticated arbitrary File access
Affected products: vendor: Hewlett Packard Enterprise
product: ArubaOS
Published: 2018-08-06T20:00:00.000Z
CVE-2017-9001 
Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user to execute arbitrary commands on the underlying operating system with "root" privilege level. This vulnerability is only present when a specific feature has been enabled. The SSH Lockout feature is not enabled by default, so only systems which have enabled this feature are vulnerable.
Problem types: description: unauthenticated remote command execution
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass
Published: 2018-08-06T20:00:00.000Z
CVE-2017-9002 
All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into ClearPass in the same browser.
Problem types: description: reflected cross-site scripting
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba ClearPass
Published: 2018-08-06T20:00:00.000Z
CVE-2017-9003 
Multiple memory corruption flaws are present in ArubaOS which could allow an unauthenticated user to crash ArubaOS processes. With sufficient time and effort, it is possible these vulnerabilities could lead to the ability to execute arbitrary code - remote code execution has not yet been confirmed.
Problem types: description: unauthenticated memory corruption leading to remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: ArubaOS
Published: 2018-08-06T20:00:00.000Z
CVE-2017-9022 
The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2017-9023 
The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2017-9024 
Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor (SCA) 3.0, has a Directory Traversal issue in its TFTP Server, allowing attackers to read arbitrary files via ../ sequences in a pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T14:00:00.000Z
CVE-2017-9025 
Heap buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted HTTP Cookie header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-17T10:00:00.000Z
CVE-2017-9026 
Stack buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted fname parameter of a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-17T10:00:00.000Z
CVE-2017-9030 
The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid protection mechanism, and makes it easier to read arbitrary uploaded files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-17T14:00:00.000Z
CVE-2017-9031 
The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-17T19:00:00.000Z
CVE-2017-9032 
Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) T1 or (2) tmLastConfigFileModifiedDate parameter to log_management.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-25T19:00:00.000Z
CVE-2017-9033 
Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi, related to the lack of anti-CSRF tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-25T19:00:00.000Z
CVE-2017-9034 
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges by leveraging failure to validate software updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-25T19:00:00.000Z
CVE-2017-9035 
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-25T19:00:00.000Z
CVE-2017-9036 
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-25T19:00:00.000Z
CVE-2017-9037 
Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) S44, (2) S5, (3) S_action_fail, (4) S_ptn_update, (5) T113, (6) T114, (7) T115, (8) T117117, (9) T118, (10) T_action_fail, (11) T_ptn_update, (12) textarea, (13) textfield5, or (14) tmLastConfigFileModifiedDate parameter to notification.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-25T19:00:00.000Z
CVE-2017-9038 
GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to the byte_get_little_endian function in elfcomm.c, the get_unwind_section_word function in readelf.c, and ARM unwind information that contains invalid word offsets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T01:00:00.000Z
CVE-2017-9039 
GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the get_program_headers function in readelf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T01:00:00.000Z
CVE-2017-9040 
GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to the process_mips_specific function in readelf.c, via a crafted ELF file that triggers a large memory-allocation attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T01:00:00.000Z
CVE-2017-9041 
GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to MIPS GOT mishandling in the process_mips_specific function in readelf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T01:00:00.000Z
CVE-2017-9042 
readelf.c in GNU Binutils 2017-04-12 has a "cannot be represented in type long" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T01:00:00.000Z
CVE-2017-9043 
readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T01:00:00.000Z
CVE-2017-9044 
The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T01:00:00.000Z
CVE-2017-9045 
The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof Feed and Schedule data by creating a modified blocks_v4.json file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9046 
winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. For example, if ssgp.dll is on the desktop and executes arbitrary code in the DllMain function, then clicking on a mailto: link on a remote web page triggers the attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-21T14:00:00.000Z
CVE-2017-9047 
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9048 
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9049 
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9050 
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9051 
libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9052 
An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarf_formsdata() is due to a failure to check a pointer for being in bounds (in a few places in this function) and a failure in a check in dwarf_attr_list().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9053 
An issue, also known as DW201703-005, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in _dwarf_read_loc_expr_op() is due to a failure to check a pointer for being in bounds (in a few places in this function).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9054 
An issue, also known as DW201703-002, was discovered in libdwarf 2017-03-21. In _dwarf_decode_s_leb128_chk() a byte pointer was dereferenced just before it was checked for being in bounds, leading to a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9055 
An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21. In dwarf_formsdata() a few data types were not checked for being in bounds, leading to a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9058 
In libytnef in ytnef through 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SIZECHECK macro in lib/ytnef.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9059 
The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource consumption) by leveraging improper channel callback shutdown when unmounting an NFSv4 filesystem, aka a "module reference and kernel daemon" leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T06:13:00.000Z
CVE-2017-9060 
Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-01T16:00:00.000Z
CVE-2017-9061 
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T14:00:00.000Z
CVE-2017-9062 
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T14:00:00.000Z
CVE-2017-9063 
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T14:00:00.000Z
CVE-2017-9064 
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T14:00:00.000Z
CVE-2017-9065 
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T14:00:00.000Z
CVE-2017-9066 
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T14:00:00.000Z
CVE-2017-9067 
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T16:00:00.000Z
CVE-2017-9068 
In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T16:00:00.000Z
CVE-2017-9069 
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T16:00:00.000Z
CVE-2017-9070 
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T16:00:00.000Z
CVE-2017-9071 
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T16:00:00.000Z
CVE-2017-9072 
Two CalendarXP products have XSS in common parts of HTML files. CalendarXP FlatCalendarXP through 9.9.290 has XSS in iflateng.htm and nflateng.htm. CalendarXP PopCalendarXP through 9.8.308 has XSS in ipopeng.htm and npopeng.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-18T17:00:00.000Z
CVE-2017-9074 
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-19T06:25:00.000Z