rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-13869 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13870 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13871 
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Mail" component. It allows remote attackers to read cleartext e-mail content (for which S/MIME encryption was intended) by leveraging the lack of installation of an S/MIME certificate by the recipient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13872 
An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user name.
Problem types: description: improper access control
Affected products: vendor: n/a
product: macOS High Sierra
Published: 2017-11-29T17:00:00.000Z
CVE-2017-13873 
An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Kernel" component. It allows attackers to obtain sensitive network-activity information about arbitrary apps via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2017-13874 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "Mail" component. It might allow remote attackers to bypass an intended encryption protection mechanism by leveraging incorrect S/MIME certificate selection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13875 
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds read) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13876 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13877 
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Sandbox Profiles" component. It allows attackers to determine whether arbitrary files exist via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2017-13878 
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (out-of-bounds read and system crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13879 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "IOMobileFrameBuffer" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13880 
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 11.2, watchOS 4.2. An application may be able to execute arbitrary code with kernel privilege.
Problem types: description: An application may be able to execute arbitrary code with kernel privilege
Affected products: vendor: Apple
product: watchOS
vendor: Apple
product: iOS
Published: 2021-12-23T19:48:22.000Z
CVE-2017-13883 
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13884 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2017-13885 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2017-13886 
In macOS High Sierra before 10.13.2, an access issue existed with privileged WiFi system configuration. This issue was addressed with additional restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T18:00:00.000Z
CVE-2017-13887 
In macOS High Sierra before 10.13.2, a logic issue existed in APFS when deleting keys during hibernation. This was addressed with improved state management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T18:00:00.000Z
CVE-2017-13888 
In iOS before 11.2, a type confusion issue was addressed with improved memory handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T18:00:00.000Z
CVE-2017-13889 
In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a logic error existed in the validation of credentials. This was addressed with improved credential validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T18:00:00.000Z
CVE-2017-13890 
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. macOS before 10.13 is affected. The issue involves the "CoreTypes" component. It allows remote attackers to trigger disk-image mounting via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T06:00:00.000Z
CVE-2017-13891 
In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-11T18:00:00.000Z
CVE-2017-13892 
An issue existed in the handling of Contact sharing. This issue was addressed with improved handling of user information. This issue is fixed in macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan. Sharing contact information may lead to unexpected data sharing.
Problem types: description: Sharing contact information may lead to unexpected data sharing
Affected products: vendor: Apple
product: macOS
Published: 2021-12-23T19:48:24.000Z
CVE-2017-13903 
An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. It allows remote attackers to modify the application state by leveraging incorrect message handling, as demonstrated by use of an Apple Watch to obtain an encryption key and unlock a door.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-25T21:00:00.000Z
CVE-2017-13904 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T00:00:00.000Z
CVE-2017-13905 
A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, watchOS 4.2. An application may be able to gain elevated privileges.
Problem types: description: An application may be able to gain elevated privileges
Affected products: vendor: Apple
product: watchOS
vendor: Apple
product: tvOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-12-23T19:48:22.000Z
CVE-2017-13906 
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, macOS High Sierra 10.13. A malicious application may be able to elevate privileges.
Problem types: description: A malicious application may be able to elevate privileges
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-12-23T19:48:25.000Z
CVE-2017-13907 
A state management issue was addressed with improved state validation. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan. The screen lock may unexpectedly remain unlocked.
Problem types: description: The screen lock may unexpectedly remain unlocked
Affected products: vendor: Apple
product: macOS
Published: 2021-12-23T19:48:25.000Z
CVE-2017-13908 
An issue in handling file permissions was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, macOS High Sierra 10.13. A local attacker may be able to execute non-executable text files via an SMB share.
Problem types: description: A local attacker may be able to execute non-executable text files via an SMB share
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2021-12-23T19:48:30.000Z
CVE-2017-13909 
An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain. This issue is fixed in macOS High Sierra 10.13. A local attacker may gain access to iCloud authentication tokens.
Problem types: description: A local attacker may gain access to iCloud authentication tokens
Affected products: vendor: Apple
product: macOS
Published: 2021-12-23T19:48:26.000Z
CVE-2017-13910 
An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files.
Problem types: description: An application may be able to access restricted files
Affected products: vendor: Apple
product: macOS
Published: 2021-12-23T19:48:27.000Z
CVE-2017-13911 
A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS X El Capitan 10.11.6 Security Update 2018-002, macOS Sierra 10.12.6 Security Update 2018-002, macOS High Sierra 10.13.2.
Problem types: description: An application may be able to execute arbitrary code with kernel privileges
Affected products: vendor: n/a
product: OS X, macOS
Published: 2019-04-03T17:43:20.000Z
CVE-2017-13982 
A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows users to upload unrestricted files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13983 
An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13984 
An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13985 
An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to traverse directory leading to disclosure of information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13986 
A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13987 
An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows an unauthorized user to download log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13988 
An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to alter the maximum size of storage groups and enable/disable the setting for the 'follow schedule' function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13989 
An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to retrieve or modify storage information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13990 
An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of Apache Tomcat application server version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13991 
An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T14:00:00.000Z
CVE-2017-13992 
An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism, which could allow remote code execution.
Problem types: cwe_id: CWE-331
description: CWE-331
Affected products: vendor: n/a
product: LOYTEC LVIS-3ME
Published: 2017-10-05T21:00:00.000Z
CVE-2017-13993 
An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior versions. An uncontrolled search path element vulnerability has been identified which could be exploited by placing a specially crafted DLL file in the search path. If the malicious DLL is loaded prior to the valid DLL, an attacker could execute arbitrary code on the system. This vulnerability does not affect the connected blood glucose monitor and would not impact delivery of therapy to the patient.
Problem types: cwe_id: CWE-428
description: CWE-428
Affected products: vendor: n/a
product: i-SENS, Inc. SmartLog Diabetes Management Software
Published: 2017-10-04T07:00:00.000Z
CVE-2017-13994 
A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: LOYTEC LVIS-3ME
Published: 2017-10-05T21:00:00.000Z
CVE-2017-13995 
An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: iniNet Solutions GmbH SCADA Webserver
Published: 2017-10-04T07:00:00.000Z
CVE-2017-13996 
A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code.
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: n/a
product: LOYTEC LVIS-3ME
Published: 2017-10-05T21:00:00.000Z
CVE-2017-13997 
A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: n/a
product: Schneider Electric InduSoft Web Studio, InTouch Machine Edition
Published: 2017-10-02T05:00:00.000Z
CVE-2017-13998 
An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitive information from unauthorized access.
Problem types: cwe_id: CWE-522
description: CWE-522
Affected products: vendor: n/a
product: LOYTEC LVIS-3ME
Published: 2017-10-05T21:00:00.000Z
CVE-2017-13999 
A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. Multiple stack-based buffer overflow vulnerabilities have been identified in which the application does not verify string size before copying to memory; the attacker may then be able to crash the application or run arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: WECON Technology Co., Ltd. LeviStudio HMI Editor
Published: 2017-10-17T22:00:00.000Z
CVE-2017-14000 
An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access the application without authenticating.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: Ctek, Inc. SkyRouter
Published: 2017-10-04T07:00:00.000Z
CVE-2017-14001 
An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS command injection vulnerability has been identified that may allow the execution of arbitrary code on the system through the inclusion of OS commands in the URL request of the program.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Digium Asterisk GUI
Published: 2017-09-26T02:00:00.000Z
CVE-2017-14002 
GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287 The affected devices use default or hard-coded credentials.
Affected products: vendor: GE Healthcare
product: GE Infinia
Published: 2018-03-20T16:00:00.000Z
CVE-2017-14003 
An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has been identified, which, if exploited, would allow an attacker with the same IP address to bypass authentication by accessing a specific uniform resource locator.
Problem types: cwe_id: CWE-290
description: CWE-290
Affected products: vendor: n/a
product: LAVA Computer MFG Inc. Ether-Serial Link
Published: 2017-10-11T19:00:00.000Z
CVE-2017-14004 
GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287 The affected devices use default or hard-coded credentials.
Affected products: vendor: GE Healthcare
product: GE GEMNet License server aka. (EchoServer)
Published: 2018-03-20T16:00:00.000Z
CVE-2017-14005 
An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is authenticated could change a user's password, enabling future access and possible configuration changes.
Problem types: cwe_id: CWE-620
description: CWE-620
Affected products: vendor: n/a
product: ProMinent MultiFLEX M10a Controller
Published: 2017-10-17T22:00:00.000Z
CVE-2017-14006 
GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287 The affected devices use default or hard-coded credentials.
Affected products: vendor: GE Healthcare
product: GE Xeleris
Published: 2018-03-20T16:00:00.000Z