rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-15392 
Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a crafted Windows Registry entry, related to PlatformIntegration.
Problem types: description: Insufficient data validation
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15393 
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15394 
Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs in a crafted Chrome Extension.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15395 
A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an ImageCapture NULL pointer dereference.
Problem types: description: Use After Free
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15396 
A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Stack buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.75 unknown
Published: 2018-08-28T20:00:00.000Z
CVE-2017-15397 
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position.
Problem types: description: Inappropriate implementation
Affected products: vendor: n/a
product: Google Chrome OS prior to 62.0.3202.74
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15398 
A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious server.
Problem types: description: Stack buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.89 unknown
Published: 2018-08-28T20:00:00.000Z
CVE-2017-15399 
A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.89 unknown
Published: 2018-08-28T20:00:00.000Z
CVE-2017-15400 
Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue.
Problem types: description: Script injection
Affected products: vendor: n/a
product: Google Chrome OS prior to 62.0.3202.74
Published: 2018-02-07T23:00:00.000Z
CVE-2017-15401 
A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Problem types: description: Out of bounds read and write
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2017-15402 
Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the same process in Navigation in Google Chrome on Chrome OS prior to 62.0.3202.74 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2017-15403 
Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page.
Problem types: description: Script injection
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2017-15404 
An ability to process crash dumps under root privileges and inappropriate symlinks handling could lead to a local privilege escalation in Crash Reporting in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to perform privilege escalation via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2017-15405 
Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established by a malicious code running with root privileges in cryptohomed in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page.
Problem types: description: Race
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2017-15406 
A stack buffer overflow in V8 in Google Chrome prior to 62.0.3202.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Stack buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.75 unknown
Published: 2018-08-28T20:00:00.000Z
CVE-2017-15407 
Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.
Problem types: description: Out-of-bounds Write
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15408 
Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium.
Problem types: description: Heap buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15409 
Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15410 
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Use After Free
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15411 
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Use After Free
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15412 
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use After Free
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15413 
Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type confusion
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15415 
Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15416 
Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read.
Problem types: description: Heap buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15417 
Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Sidechannel information leakage
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15418 
Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Problem types: description: Uninitialized Use
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15419 
Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15420 
Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15422 
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Integer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15423 
Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic.
Problem types: description: Cryptographic Flaw
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15424 
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15425 
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15426 
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15427 
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.
Problem types: description: Insufficient Policy Enforcement
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.84 unknown
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15428 
Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2019-01-09T19:00:00.000Z
CVE-2017-15429 
Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: n/a
product: Google Chrome prior to 63.0.3239.108 unknown
Published: 2018-08-28T20:00:00.000Z
CVE-2017-15430 
Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2018-08-28T19:00:00.000Z
CVE-2017-15515 
NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged user to inject arbitrary scripts into the custom secondary policy label field.
Problem types: description: Cross-Site Scripting
Affected products: vendor: NetApp
product: SnapCenter Server
Published: 2019-03-04T22:00:00.000Z
CVE-2017-15516 
NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used to cause an unintended authenticated action in the user interface.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: NetApp
product: SnapCenter Server
Published: 2017-11-16T22:00:00.000Z
CVE-2017-15517 
AltaVault OST Plug-in versions prior to 1.2.2 may allow attackers to obtain sensitive information via unspecified vectors. All users are urged to move to a fixed version and change passwords used by Veritas NetBackup to access the OST shares on the NetApp AltaVault as a precaution.
Problem types: description: Sensitive Information Disclosure
Affected products: vendor: NetApp
product: AltaVault OST Plug-in
Published: 2017-11-17T00:00:00.000Z
CVE-2017-15518 
All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password. All users are urged to move to a fixed version. Since the affected password is changed during every upgrade/installation no further action is required.
Problem types: description: CWE 311
Affected products: vendor: NetApp
product: OnCommand API Services and NetApp Service Level Manager
Published: 2018-02-23T23:00:00.000Z
CVE-2017-15519 
Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. All users are urged to move to version 3.0.1 and perform the mitigation steps or upgrade to 4.0 following the product documentation.
Problem types: description: Unauthenticated Remote Access
Affected products: vendor: NetApp
product: SnapCenter
Published: 2018-03-06T20:00:00.000Z
CVE-2017-15524 
The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T17:00:00.000Z
CVE-2017-15525 
Prior to SEE v11.1.3MP1, Symantec Endpoint Encryption can be susceptible to a denial of service (DoS) attack, which is a type of attack whereby the perpetrator attempts to make a particular machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a specific host within a network.
Problem types: description: Denial of Service
Affected products: vendor: Symantec Corporation
product: Symantec Endpoint Encryption
Published: 2017-11-13T22:00:00.000Z
CVE-2017-15526 
Prior to SEE v11.1.3MP1, Symantec Endpoint Encryption can be susceptible to a null pointer de-reference issue, which can result in a NullPointerException that can lead to a privilege escalation scenario.
Problem types: description: Null Pointer De-reference
Affected products: vendor: Symantec Corporation
product: Symantec Endpoint Encryption
Published: 2017-11-13T22:00:00.000Z
CVE-2017-15527 
Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there is insufficient security validation / sanitization of user-supplied input file names, such that characters representing "traverse to parent directory" are passed through to the file APIs.
Problem types: description: Directory Traversal
Affected products: vendor: Symantec Corporation
product: Symantec Management Console
Published: 2017-11-20T19:00:00.000Z
CVE-2017-15528 
Prior to v 7.6, the Install Norton Security (INS) product can be susceptible to a certificate spoofing vulnerability, which is a type of attack whereby a maliciously procured certificate binds the public key of an attacker to the domain name of the target.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-22T18:00:00.000Z
CVE-2017-15529 
Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular device unavailable to its intended user by temporarily or indefinitely disrupting services of a specific host within a network.
Problem types: description: Denial of Service
Affected products: vendor: Symantec Corporation
product: Norton Family Android App
Published: 2017-12-13T19:00:00.000Z
CVE-2017-15530 
Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that attackers will attempt to exploit as a first pass across the application. As they probe the application they will take note of anything that may seem out of place or any bit of information they can use to their advantage such as error messages, system information, user data, version numbers, component names, URL paths, or even simple typos and misspellings.
Problem types: description: Information disclosure
Affected products: vendor: Symantec Corporation
product: Norton Family Android App
Published: 2017-12-13T19:00:00.000Z
CVE-2017-15531 
Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interface users.  A remote attacker can use brute force search to guess a user password and gain access to Reporter.
Problem types: description: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Symantec Corporation
product: Reporter
Published: 2018-01-23T20:00:00.000Z
CVE-2017-15532 
Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal). These types of attacks aim to access files and directories that are stored outside the web root folder. By manipulating variables, it may be possible to access arbitrary files and directories stored on the file system including application source code or configuration and critical system files.
Problem types: description: Directory traversal
Affected products: vendor: Symantec Corporation
product: Messaging Gateway
Published: 2017-12-20T18:00:00.000Z
CVE-2017-15533 
Symantec SSL Visibility (SSLV) 3.8.4FC, 3.10 prior to 3.10.4.1, 3.11, and 3.12 prior to 3.12.2.1 are vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. All affected SSLV versions act as weak oracles according the oracle classification used in the ROBOT research paper. A remote attacker, who has captured a pre-recorded SSL session inspected by SSLV, can establish multiple millions of crafted SSL connections to the target and obtain the session keys required to decrypt the pre-recorded SSL session.
Problem types: description: Information disclosure
Affected products: vendor: Symantec Corporation
product: SSL Visibility (SSLV)
Published: 2018-05-17T13:00:00.000Z
CVE-2017-15534 
The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access.
Problem types: description: Authentication bypass
Affected products: vendor: Symantec Corporation
product: Norton App Lock
Published: 2018-03-26T16:00:00.000Z
CVE-2017-15535 
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-01T01:00:00.000Z
CVE-2017-15536 
An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain access to the CDSW database which includes Kerberos keytabs of CDSW users and bcrypt hashed passwords, and gain access to other privileged information such as session tokens, invitation tokens, and environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T03:00:00.000Z
CVE-2017-15537 
The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace() or rt_sigreturn() system call, allowing local users to read the FPU registers of other processes on the system, related to arch/x86/kernel/fpu/regset.c and arch/x86/kernel/fpu/signal.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T18:00:00.000Z
CVE-2017-15538 
Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T20:00:00.000Z
CVE-2017-15539 
SQL Injection exists in zorovavi/blog through 2017-10-17 via the id parameter to recept.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T21:00:00.000Z