rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-6367 
In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes the Windows service to crash. The attack methodology involves a long Host header and an invalid Content-Length header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T09:02:00.000Z
CVE-2017-6369 
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T10:00:00.000Z
CVE-2017-6370 
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T17:00:00.000Z
CVE-2017-6371 
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T04:14:30.000Z
CVE-2017-6377 
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
Problem types: description: Access Bypass
Affected products: vendor: Drupal
product: Drupal Core
Published: 2017-03-16T14:00:00.000Z
CVE-2017-6379 
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
Problem types: description: Cross Site Request Forgery
Affected products: vendor: Drupal
product: Drupal Core
Published: 2017-03-16T14:00:00.000Z
CVE-2017-6381 
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments
Problem types: description: Remote code execution
Affected products: vendor: Drupal
product: Drupal Core
Published: 2017-03-16T14:00:00.000Z
CVE-2017-6384 
Memory leak in the login_user function in saslserv/main.c in saslserv/main.so in Atheme 7.2.7 allows a remote unauthenticated attacker to consume memory and cause a denial of service. This is fixed in 7.2.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6386 
Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_OBJECT_VERTEX_ELEMENTS commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6387 
The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DEX file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T01:00:00.000Z
CVE-2017-6390 
An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6391 
An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "admin_console/web/tools/SimpleJWPlayer.php" URL, the "admin_console/web/tools/AkamaiBroadcaster.php" URL, the "admin_console/web/tools/bigRedButton.php" URL, and the "admin_console/web/tools/bigRedButtonPtsPoc.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6392 
An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lynx-12.11.0/admin_console/web/tools/XmlJWPlayer.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6393 
An issue was discovered in NagVis 1.9b12. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "nagvis-master/share/userfiles/gadgets/std_table.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6394 
Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/object_search.php" URL (section_value; src_form). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6395 
An issue was discovered in HashOver 2.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the 'hashover/scripts/widget-output.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6396 
An issue was discovered in WPO-Foundation WebPageTest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "webpagetest-master/www/compare-cf.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6397 
An issue was discovered in FlightAirMap v1.0-beta.10. The vulnerability exists due to insufficient filtration of user-supplied data in multiple parameters passed to several *-sub-menu.php pages. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6398 
An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is root). Besides, the default installation of IMSVA comes with default administrator credentials. The saveCert.imss endpoint takes several user inputs and performs blacklisting. After that, it uses them as arguments to a predefined operating-system command without proper sanitization. However, because of an improper blacklisting rule, it's possible to inject arbitrary commands into it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T09:02:00.000Z
CVE-2017-6399 
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged remote command execution on NetBackup Server and Client (on the server or a connected client) can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6400 
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged command execution on NetBackup Server and Client can occur (on the local system).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6401 
An issue was discovered in Veritas NetBackup before 8.0 and NetBackup Appliance before 3.0. Local arbitrary command execution can occur when using bpcd and bpnbat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6402 
An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Denial of service affecting NetBackup server can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6403 
An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. NetBackup Cloud Storage Service uses a hardcoded username and password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6404 
An issue was discovered in Veritas NetBackup Before 7.7 and NetBackup Appliance Before 2.7. There are world-writable log files, allowing destruction or spoofing of log data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6405 
An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Hostname-based security is open to DNS spoofing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6406 
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Arbitrary privileged command execution, using whitelist directory escape with "../" substrings, can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6407 
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged remote command execution on NetBackup Server and Client (on the server or a connected client) can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6408 
An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. A local-privilege-escalation race condition in pbx_exchange can occur when a local user connects to a socket before permissions are secured.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6409 
An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Unauthenticated CORBA interfaces permit inappropriate access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6410 
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6411 
Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or firewall configuration or any password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T06:11:00.000Z
CVE-2017-6412 
In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-30T17:00:00.000Z
CVE-2017-6413 
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2017-6414 
Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6415 
The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T01:00:00.000Z
CVE-2017-6416 
An issue was discovered in SysGauge 1.5.18. A buffer overflow vulnerability in SMTP connection verification leads to arbitrary code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka "Service ready") string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6417 
Code injection vulnerability in Avira Total Security Suite 15.0 (and earlier), Optimization Suite 15.0 (and earlier), Internet Security Suite 15.0 (and earlier), and Free Security Suite 15.0 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avira process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-21T16:00:00.000Z
CVE-2017-6418 
libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T03:00:00.000Z
CVE-2017-6419 
mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T03:00:00.000Z
CVE-2017-6420 
The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T03:00:00.000Z
CVE-2017-6421 
In the touch controller function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a variable may be controlled by the user and can lead to a buffer overflow.
Problem types: description: Buffer Copy without Checking Size of Input in Touch
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2017-6423 
An elevation of privilege vulnerability in the Qualcomm kyro L2 driver. Product: Android. Versions: Android kernel. Android ID: A-32831370. References: QC-CR#1103158.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2017-6424 
An elevation of privilege vulnerability in the Qualcomm WiFi driver. Product: Android. Versions: Android kernel. Android ID: A-32086742. References: QC-CR#1102648.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2017-6425 
An information disclosure vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-32577085. References: QC-CR#1103689.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2017-6426 
An information disclosure vulnerability in the Qualcomm SPMI driver. Product: Android. Versions: Android kernel. Android ID: A-33644474. References: QC-CR#1106842.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2017-6427 
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will cause a crash. An example attack methodology may include a long message-body in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T10:29:00.000Z
CVE-2017-6429 
Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2017-6430 
The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2017-6432 
An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of fully privileged new users, in addition to capture of sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-09T17:00:00.000Z
CVE-2017-6435 
The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6436 
The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6437 
The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6438 
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6439 
Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6440 
The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6441 
The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating "Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-6443 
Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web script or HTML via the W_AD1 parameter to Forms/oadmin_1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2017-6444 
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many ACK packets. After the attacker stops the exploit, the CPU usage is 100% and the router requires a reboot for normal operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-12T04:57:00.000Z
CVE-2017-6445 
The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6446 
XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T21:00:00.000Z
CVE-2017-6448 
The dalvik_disassemble function in libr/asm/p/asm_dalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-6451 
The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2017-6452 
Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an application path on the command line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2017-6455 
NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z