rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-16551 
K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-16552 
K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-16553 
K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-16554 
K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-16555 
K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-16556 
In K7 Antivirus Premium before 15.1.0.53, user-controlled input can be used to allow local users to write to arbitrary memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-16557 
K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-16558 
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-25T16:36:49.000Z
CVE-2017-16560 
SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as if the file is being edited when the user exits the application or if the application crashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-16T15:00:00.000Z
CVE-2017-16561 
/view/friend_profile.php in Ingenious School Management System 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'friend_index' parameter of a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-07T22:00:00.000Z
CVE-2017-16562 
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-09T19:00:00.000Z
CVE-2017-16563 
Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T08:00:00.000Z
CVE-2017-16564 
Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field (P148).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T08:00:00.000Z
CVE-2017-16565 
Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T08:00:00.000Z
CVE-2017-16566 
On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system files including those used for authentication (such as passwd and shadow). This can be abused to take full root level control of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-17T23:00:00.000Z
CVE-2017-16567 
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality. Exploitation of this vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthorized actions on behalf of users, and Exfiltration of sensitive data. This vulnerability presents a potential risk for widespread exploitation in connected IoT environments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-09T19:00:00.000Z
CVE-2017-16568 
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the compromised radio stream. Exploitation of this vulnerability can lead to Session hijacking and unauthorized access, Persistent manipulation of web content within the application, and Phishing or malicious redirects to external domains. This vulnerability can be exploited to manipulate media server behavior in enterprise and home network environments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-09T19:00:00.000Z
CVE-2017-16569 
An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T08:00:00.000Z
CVE-2017-16570 
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T08:00:00.000Z
CVE-2017-16571 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of references to the app object from FormCalc. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5072.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16572 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within FormCalc's closeDoc method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process. Was ZDI-CAN-5073.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16573 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of LZWDecode filters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5078.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16574 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of Image filters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5079.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16575 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA's bind element. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5091.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16576 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within XFA's field element. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5092.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16577 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the alignment attribute of Field objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5094.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16578 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the picture elements within XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5216.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16579 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5244.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16580 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ImageField node of XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5281.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16581 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the author attribute of the Document object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5282.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16582 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the clearItems XFA method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5288.
Problem types: cwe_id: CWE-843
description: CWE-843-Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16583 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the datasets element of XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5289.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16584 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within util.printf. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5290.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16585 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the app.response method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5294.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16586 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addAnnot method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5295.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16587 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5296.
Problem types: cwe_id: CWE-416
description: CWE-416-Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16588 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SOT markers. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-4976.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16589 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of the yTsiz member of SIZ markers. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-4977.
Problem types: cwe_id: CWE-125
description: CWE-125-Out-of-bounds Read
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2017-12-20T14:00:00.000Z
CVE-2017-16590 
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User interaction is required to exploit this vulnerability. The specific flaw exists within the MainFilter servlet. The issue results from the lack of proper string matching inside the doFilter method. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of Administrator. Was ZDI-CAN-5099.
Problem types: cwe_id: CWE-289
description: CWE-289-Authentication Bypass by Alternate Name
Affected products: vendor: NetGain Systems
product: NetGain Systems Enterprise Manager
Published: 2018-01-23T01:00:00.000Z
CVE-2017-16591 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.restore.download_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5100.
Problem types: cwe_id: CWE-22
description: CWE-22-Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: NetGain Systems
product: NetGain Systems Enterprise Manager
Published: 2018-01-23T01:00:00.000Z
CVE-2017-16592 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the common.download_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5103.
Problem types: cwe_id: CWE-22
description: CWE-22-Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: NetGain Systems
product: NetGain Systems Enterprise Manager
Published: 2018-01-23T01:00:00.000Z