rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-13084 
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
Problem types: cwe_id: CWE-323
description: CWE-323: Reusing a Nonce, Key Pair in Encryption
Affected products: vendor: Wi-Fi Alliance
product: Wi-Fi Protected Access (WPA and WPA2)
Published: 2017-10-17T13:00:00.000Z
CVE-2017-13086 
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
Problem types: cwe_id: CWE-323
description: CWE-323: Reusing a Nonce, Key Pair in Encryption
Affected products: vendor: Wi-Fi Alliance
product: Wi-Fi Protected Access (WPA and WPA2)
Published: 2017-10-17T13:00:00.000Z
CVE-2017-13087 
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T13:00:00.000Z
CVE-2017-13088 
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
Problem types: cwe_id: CWE-323
description: CWE-323: Reusing a Nonce, Key Pair in Encryption
Affected products: vendor: Wi-Fi Alliance
product: Wi-Fi Protected Access (WPA and WPA2)
Published: 2017-10-17T13:00:00.000Z
CVE-2017-13089 GNU Wget: stack overflow in HTTP protocol handling
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: GNU Project
product: Wget
Credits: lang: en
value: Antti Levomäki, Christian Jalio, Joonas Pihlaja from Forcepoint
Published: 2017-10-27T19:00:00.000Z
CVE-2017-13090 GNU Wget: heap overflow in HTTP protocol handling
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: GNU Project
product: Wget
Credits: lang: en
value: Antti Levomäki, Christian Jalio, Joonas Pihlaja from Forcepoint
Published: 2017-10-27T19:00:00.000Z
CVE-2017-13091 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including improperly specified padding in CBC mode allows use of an EDA tool as a decryption oracle
The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including improperly specified padding in CBC mode allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: IEEE
product: Standard
Published: 2018-07-13T20:00:00.000Z
CVE-2017-13092 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including improperly specified HDL syntax allows use of an EDA tool as a decryption oracle
The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including improperly specified HDL syntax allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: IEEE
product: Standard
Published: 2018-07-13T20:00:00.000Z
CVE-2017-13093 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of encrypted IP cyphertext to insert hardware trojans
The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of encrypted IP cyphertext to insert hardware trojans. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: IEEE
product: Standard
Published: 2018-07-13T20:00:00.000Z
CVE-2017-13094 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of the encryption key and insertion of hardware trojans in any IP
The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of the encryption key and insertion of hardware trojans in any IP. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: IEEE
product: Standard
Published: 2018-07-13T20:00:00.000Z
CVE-2017-13095 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of a license-deny response to a license grant
The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of a license-deny response to a license grant. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: IEEE
product: Standard
Published: 2018-07-13T20:00:00.000Z
CVE-2017-13096 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of Rights Block to remove or relax access control
The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of Rights Block to remove or relax access control. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: IEEE
product: Standard
Published: 2018-07-13T20:00:00.000Z
CVE-2017-13097 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of Rights Block to remove or relax license requirement
The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of Rights Block to remove or relax license requirement. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
Problem types: cwe_id: CWE-310
description: CWE-310
Affected products: vendor: IEEE
product: Standard
Published: 2018-07-13T20:00:00.000Z
CVE-2017-13098 BouncyCastle JCE TLS Bleichenbacher/ROBOT
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."
Problem types: cwe_id: CWE-203
description: CWE-203
Affected products: vendor: Legion of the Bouncy Castle
product: BouncyCastle TLS
Published: 2017-12-13T01:00:00.000Z
CVE-2017-13099 wolfSSL Bleichenbacher/ROBOT
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT."
Problem types: cwe_id: CWE-203
description: CWE-203
Affected products: vendor: wolfSSL
product: wolfSSL
Published: 2017-12-13T01:00:00.000Z
CVE-2017-13100 DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption
DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: DistinctDev, Inc
product: The Moron Test
Published: 2018-08-15T22:00:00.000Z
CVE-2017-13101 Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption
Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Musical.ly Inc.
product: musical.ly
Published: 2018-08-15T22:00:00.000Z
CVE-2017-13102 Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption
Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Gameloft
product: Asphalt Xtreme: Offroad Rally Racing
Published: 2018-08-15T22:00:00.000Z
CVE-2017-13104 Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption
Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Uber Technologies, Inc.
product: UberEATS: Uber for Food Delivery
Published: 2018-08-15T22:00:00.000Z
CVE-2017-13105 Hi Security Virus Cleaner - Antivirus, Booster,  3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication
Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication. This opens the application up to a man-in-the-middle attack having all of its encrypted traffic intercepted and read by an attacker.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: Hi Security Lab
product: Virus Cleaner - Antivirus, Booster
Published: 2018-08-15T22:00:00.000Z
CVE-2017-13106 Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption
Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Cheetahmobile
product: CM Launcher 3D - Theme, wallpaper, Secure, Efficient
Published: 2018-08-15T22:00:00.000Z
CVE-2017-13107 Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption
Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Live.me
product: Live.me
Published: 2018-08-15T22:00:00.000Z
CVE-2017-13108 DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption
DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: DFNDR
product: Security Antivirus, Anti-hacking & Cleaner
Published: 2018-08-15T22:00:00.000Z
CVE-2017-13127 
The VIP.com application for IOS and Android allows remote attackers to obtain sensitive information and hijack the authentication of users via a rogue access point and a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-20T18:00:00.000Z
CVE-2017-13129 
Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-26T14:00:00.000Z
CVE-2017-13130 
mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T00:00:00.000Z
CVE-2017-13131 
In ImageMagick 7.0.6-8, a memory leak vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (memory consumption in NewLinkedList in MagickCore/linked-list.c) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T03:00:00.000Z
CVE-2017-13132 
In ImageMagick 7.0.6-8, the WritePDFImage function in coders/pdf.c operates on an incorrect data structure in the "dump uncompressed PseudoColor packets" step, which allows attackers to cause a denial of service (assertion failure in WriteBlobStream in MagickCore/blob.c) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T03:00:00.000Z
CVE-2017-13133 
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T03:00:00.000Z
CVE-2017-13134 
In ImageMagick 7.0.6-6 and GraphicsMagick 1.3.26, a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T03:00:00.000Z
CVE-2017-13135 
A NULL Pointer Dereference exists in VideoLAN x265, as used in libbpg 0.9.7 and other products, because the CUData::initialize function in common/cudata.cpp mishandles memory-allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-16T04:00:00.000Z
CVE-2017-13136 
The image_alloc function in bpgenc.c in libbpg 0.9.7 has an integer overflow, with a resultant invalid malloc and NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-16T04:00:00.000Z
CVE-2017-13137 
The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T14:00:00.000Z
CVE-2017-13138 
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T14:00:00.000Z
CVE-2017-13139 
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T06:00:00.000Z
CVE-2017-13140 
In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service (application hang in LockSemaphoreInfo) via a PNG file with a width equal to MAGICK_WIDTH_LIMIT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T06:00:00.000Z
CVE-2017-13141 
In ImageMagick before 6.9.9-4 and 7.x before 7.0.6-4, a crafted file could trigger a memory leak in ReadOnePNGImage in coders/png.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T06:00:00.000Z
CVE-2017-13142 
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T06:00:00.000Z
CVE-2017-13143 
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T06:00:00.000Z
CVE-2017-13144 
In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T06:00:00.000Z
CVE-2017-13145 
In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T06:00:00.000Z
CVE-2017-13146 
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T06:00:00.000Z
CVE-2017-13147 
In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T17:00:00.000Z
CVE-2017-13148 
A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65717533.
Problem types: description: Denial of service
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z
CVE-2017-13149 
An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65719872.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z
CVE-2017-13150 
An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-38328132.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z
CVE-2017-13151 
A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z
CVE-2017-13152 
An information disclosure vulnerability in the Android media framework (libmedia drm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62872384.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z
CVE-2017-13153 
An elevation of privilege vulnerability in the Android media framework (libaudioservice). Product: Android. Versions: 8.0. Android ID A-65280854.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z
CVE-2017-13154 
An elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63666573.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z
CVE-2017-13156 
An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z
CVE-2017-13157 
An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32990341.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-12-06T14:00:00.000Z