rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-18227 
TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T04:00:00.000Z
CVE-2017-18228 
Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-12T23:00:00.000Z
CVE-2017-18229 
An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T02:00:00.000Z
CVE-2017-18230 
An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadCINEONImage in coders/cineon.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T02:00:00.000Z
CVE-2017-18231 
An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found in the function ReadEnhMetaFile in coders/emf.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T02:00:00.000Z
CVE-2017-18232 
The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T04:00:00.000Z
CVE-2017-18233 
An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T19:00:00.000Z
CVE-2017-18234 
An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T19:00:00.000Z
CVE-2017-18235 
An issue was discovered in Exempi before 2.4.3. The VPXChunk class in XMPFiles/source/FormatSupport/WEBP_Support.cpp does not ensure nonzero widths and heights, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted .webp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T19:00:00.000Z
CVE-2017-18236 
An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T19:00:00.000Z
CVE-2017-18237 
An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T19:00:00.000Z
CVE-2017-18238 
An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .qt file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-15T19:00:00.000Z
CVE-2017-18239 
A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-18T03:00:00.000Z
CVE-2017-18240 
The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL (when the service is stopped).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T02:00:00.000Z
CVE-2017-18241 
fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-21T16:00:00.000Z
CVE-2017-18242 
The apply_dependent_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-22T21:00:00.000Z
CVE-2017-18243 
The unpack_parse_unit function in libavcodec/dirac_parser.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-22T21:00:00.000Z
CVE-2017-18244 
The stereo_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file, related to ff_ps_apply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-22T21:00:00.000Z
CVE-2017-18245 
The mpc8_probe function in libavformat/mpc8.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-23T19:00:00.000Z
CVE-2017-18246 
The pcm_encode_frame function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted media file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-23T19:00:00.000Z
CVE-2017-18247 
The av_audio_fifo_size function in libavutil/audio_fifo.c in Libav 12.2 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted media file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-23T19:00:00.000Z
CVE-2017-18248 
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-26T17:00:00.000Z
CVE-2017-18249 
The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-26T20:00:00.000Z
CVE-2017-18250 
An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LogOpenCLBuildFailure in MagickCore/opencl.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2017-18251 
An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2017-18252 
An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2017-18253 
An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LoadOpenCLDevices in MagickCore/opencl.c, which allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2017-18254 
An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T03:00:00.000Z
CVE-2017-18255 
The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-31T17:00:00.000Z
CVE-2017-18256 
Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaScript code, because window dialogs are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T02:00:00.000Z
CVE-2017-18257 
The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T17:00:00.000Z
CVE-2017-18258 
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-08T17:00:00.000Z
CVE-2017-18259 
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T03:00:00.000Z
CVE-2017-18260 
Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-11T03:00:00.000Z
CVE-2017-18261 
The arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h in the Linux kernel before 4.13 allows local users to cause a denial of service (infinite recursion) by writing to a file under /sys/kernel/debug in certain circumstances, as demonstrated by a scenario involving debugfs, ftrace, PREEMPT_TRACER, and FUNCTION_GRAPH_TRACER.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-19T08:00:00.000Z
CVE-2017-18262 
Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T13:00:00.000Z
CVE-2017-18263 
Seagate Media Server in Seagate Personal Cloud before 4.3.18.4 has directory traversal in getPhotoPlaylistPhotos.psp via a parameter named url.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-28T01:00:00.000Z
CVE-2017-18264 
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given '' as the first argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T17:00:00.000Z
CVE-2017-18265 
Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such as the lua-socket package from Debian stretch. The attacker needs to trigger a stream error. A crash can be observed in, for example, the c2s module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-09T17:00:00.000Z
CVE-2017-18266 
The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-10T14:00:00.000Z
CVE-2017-18267 
The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-10T15:00:00.000Z
CVE-2017-18268 
Symantec IntelligenceCenter 3.3 is vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. A remote attacker, who has captured a pre-recorded SSL session inspected by SSLV, can establish large numbers of crafted SSL connections to the target and obtain the session keys required to decrypt the pre-recorded SSL session.
Problem types: description: Information disclosure
Affected products: vendor: Symantec Corporation
product: IntelligenceCenter
Published: 2018-05-17T13:00:00.000Z
CVE-2017-18269 
An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in corrupt data being produced by the copy operation. This may disclose information to context-dependent attackers, or result in a denial of service, or, possibly, code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-18T16:00:00.000Z
CVE-2017-18270 
In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-18T16:00:00.000Z
CVE-2017-18271 
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-18T19:00:00.000Z
CVE-2017-18272 
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is mishandled in an MngInfoDiscardObject call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-18T19:00:00.000Z
CVE-2017-18273 
In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-18T19:00:00.000Z
CVE-2017-18274 
While iterating through the models contained in a fixed-size array in the actData structure, which also stores an incorrect number of models that is greater than the size of the array, a buffer overflow occurs in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835
Problem types: description: CWE129: Improper Validation of Array Index
Affected products: vendor: Qualcomm Technologies, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2019-05-06T22:37:54.000Z
CVE-2017-18275 
A new account can be inserted into simContacts service using Android command line tool in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845.
Problem types: description: CWE284: Improper Access Control
Affected products: vendor: Qualcomm Technologies, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2019-05-06T22:43:05.000Z
CVE-2017-18276 
Secure camera logic allows display/secure camera controllers to access HLOS memory during secure display or camera session in Snapdragon Mobile, Snapdragon Wear in MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD 845, SD 850
Problem types: description: CWE284: Improper Access Control
Affected products: vendor: Qualcomm Technologies, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2019-05-06T22:46:52.000Z
CVE-2017-18277 
When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop without retrying for memory allocation in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCN5502, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835.
Problem types: description: Loop with Unreachable Exit Condition in WLAN
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2018-10-23T13:00:00.000Z
CVE-2017-18278 
An integer underflow may occur due to lack of check when received data length from font_mgr_qsee_request_service is bigger than the minimal value of the segment header, which may result in a buffer overflow, in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850.
Problem types: description: CWE680: Integer Overflow to Buffer Overflow
Affected products: vendor: Qualcomm Technologies, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2019-05-06T22:54:13.000Z
CVE-2017-18279 
Lack of check of buffer length before copying can lead to buffer overflow in camera module in Small Cell SoC, Snapdragon Mobile, Snapdragon Wear in FSM9055, FSM9955, IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 835, SDM630, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016.
Problem types: description: CWE680: Integer Overflow to Buffer Overflow
Affected products: vendor: Qualcomm Technologies, Inc.
product: Small Cell SoC, Snapdragon Mobile, Snapdragon Wear
Published: 2019-05-06T22:58:17.000Z
CVE-2017-18280 
In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDM429, SDM439, SDM632, Snapdragon_High_Med_2016, when a Trusted Application has opened the SPI/I2C interface to a particular device, it is possible for another Trusted Application to read the data on this open interface by calling the SPI/I2C read function.
Problem types: description: Access to the SPI/I2C bus is non-exclusive
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2018-09-20T13:00:00.000Z
CVE-2017-18281 
A bool variable in Video function, which gets typecasted to int before being read could result in an out of bound read access in all Android releases from CAF using the linux kernel
Problem types: description: Use of Out-of-range Pointer Offset in Video
Affected products: vendor: Qualcomm, Inc.
product: Android for MSM, Firefox OS for MSM, QRD Android
Published: 2018-10-29T18:00:00.000Z
CVE-2017-18282 
Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SDA660.
Problem types: description: NImproper Access Control in Access Control module
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-10-23T13:00:00.000Z
CVE-2017-18283 
Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 625, SD 835, SD 845, SD 850, SDA660.
Problem types: description: Improper Input Validation in Bluetooth Controller
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-10-23T13:00:00.000Z
CVE-2017-18284 
The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-04T06:00:00.000Z
CVE-2017-18285 
The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-04T06:00:00.000Z
CVE-2017-18286 
nZEDb v0.7.3.3 has XSS in the 404 error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-05T06:00:00.000Z
CVE-2017-18287 
An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST user_search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-12T18:00:00.000Z