rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-7335 
A Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC 6.1-x (6.1-2, 6.1-4 and 6.1-5); 7.0-x (7.0-7, 7.0-8, 7.0-9, 7.0-10); and 8.x (8.0, 8.1, 8.2 and 8.3.0-8.3.2) allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" present in HTTP POST requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-26T13:00:00.000Z
CVE-2017-7336 
A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.
Problem types: description: Hard-coded credentials
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiWLM
Published: 2017-07-22T21:00:00.000Z
CVE-2017-7337 
An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion request.
Problem types: description: Improper Access Control
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiPortal
Published: 2017-05-26T22:00:00.000Z
CVE-2017-7338 
A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure via the FortiAnalyzer Management View.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiPortal
Published: 2017-05-26T22:00:00.000Z
CVE-2017-7339 
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the 'Name' and 'Description' inputs in the 'Add Revision Backup' functionality.
Problem types: description: Execution of unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiPortal
Published: 2017-05-26T22:00:00.000Z
CVE-2017-7340 
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the applicationSearch parameter in the FortiView functionality.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Fortinet
product: Fortinet FortiPortal
Published: 2019-03-25T20:55:59.000Z
CVE-2017-7341 
An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-26T13:00:00.000Z
CVE-2017-7342 
A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via a hidden Close button
Problem types: description: Password
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiPortal
Published: 2019-03-25T21:05:27.000Z
CVE-2017-7343 
An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter.
Problem types: description: Execution of unauthorized code or commands
Affected products: vendor: Fortinet, Inc.
product: Fortinet FortiPortal
Published: 2017-05-26T22:00:00.000Z
CVE-2017-7344 
A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "security alert" dialog thereby popping up when the "VPN before logon" feature is enabled and an untrusted certificate chain.
Problem types: description: Escalation of privilege
Affected products: vendor: Fortinet, Inc.
product: FortiClientWindows
Published: 2017-12-14T18:00:00.000Z
CVE-2017-7345 
NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management Extension Remote Method Invocation (aka JMX RMI) service to the network, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-10T15:00:00.000Z
CVE-2017-7346 
The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-30T23:00:00.000Z
CVE-2017-7351 
A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T15:00:00.000Z
CVE-2017-7352 
Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "host" parameter on the 'System > Configuration > SNMP > Add SNMP Trap Manager' screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-11T06:00:00.000Z
CVE-2017-7357 
Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2017-7358 
In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-05T06:23:00.000Z
CVE-2017-7359 
Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T04:26:00.000Z
CVE-2017-7360 
Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T04:26:00.000Z
CVE-2017-7361 
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T04:26:00.000Z
CVE-2017-7362 
Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T04:26:00.000Z
CVE-2017-7363 
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T04:26:00.000Z
CVE-2017-7364 
In all Qualcomm products with Android releases from CAF using the Linux kernel, in function __mdss_fb_copy_destscaler_data(), variable ds_data[i].scale may still point to a user-provided address (which could point to arbitrary kernel address), so on an error condition, this user-provided address will be freed (arbitrary free), and continued operation could result in use after free condition.
Problem types: description: Use After Free in Video
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T19:00:00.000Z
CVE-2017-7365 
In all Android releases from CAF using the Linux kernel, a buffer overread can occur if a particular string is not NULL terminated.
Problem types: description: String Errors in Linux Boot
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7366 
In all Android releases from CAF using the Linux kernel, a KGSL ioctl was not validating all of its parameters.
Problem types: description: Improper Input Validation in Graphics
Affected products: vendor: n/a
product: n/a
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7367 
In all Android releases from CAF using the Linux kernel, an integer underflow vulnerability exists while processing the boot image.
Problem types: description: Integer Underflow Vulnerability in Linux Boot
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7368 
In all Android releases from CAF using the Linux kernel, a race condition potentially exists in the ioctl handler of a sound driver.
Problem types: description: Time-of-check Time-of-use (TOCTOU) Race Condition in Audio
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7369 
In all Android releases from CAF using the Linux kernel, an array index in an ALSA routine is not properly validating potentially leading to kernel stack corruption.
Problem types: description: Improper Validation of Array Index in ALSA
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7370 
In all Android releases from CAF using the Linux kernel, a race condition exists in a video driver potentially leading to a use-after-free condition.
Problem types: description: Time-of-check Time-of-use (TOCTOU) Race Condition in Video
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7371 
In all Android releases from CAF using the Linux kernel, a data pointer is potentially used after it has been freed when SLIMbus is turned off by Bluetooth.
Problem types: description: Use After Free Vulnerability in Bluetooth
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7372 
In all Android releases from CAF using the Linux kernel, a race condition exists in a video driver potentially leading to buffer overflow or write to arbitrary pointer location.
Problem types: description: Time-of-check Time-of-use (TOCTOU) Race Condition in Video
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7373 
In all Android releases from CAF using the Linux kernel, a double free vulnerability exists in a display driver.
Problem types: description: Double Free Vulnerability in Display
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2017-7374 
Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service (NULL pointer dereference) or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be freed prematurely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T20:00:00.000Z
CVE-2017-7375 
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-19T19:00:00.000Z
CVE-2017-7376 
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-19T19:00:00.000Z
CVE-2017-7377 
The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-10T15:00:00.000Z
CVE-2017-7378 
The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-7379 
The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-7380 
The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-7381 
The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-7382 
The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-7383 
The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T05:44:00.000Z
CVE-2017-7384 
Cross-site scripting (XSS) vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-01T16:00:00.000Z
CVE-2017-7386 
citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T23:58:00.000Z
CVE-2017-7387 
TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T23:58:00.000Z
CVE-2017-7388 
A Cross-Site Scripting (XSS) was discovered in 'wallacepos v1.4.1'. The vulnerability exists due to insufficient filtration of user-supplied data (token) passed to the 'wallacepos-master/myaccount/resetpassword.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7389 
Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7390 
A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data (mail) passed to the 'SocialNetwork-andrea/app/template/pw_forgot.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7391 
A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7392 
In TigerVNC 1.7.1 (SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt), an unauthenticated client can cause a small memory leak in the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7393 
In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7394 
In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7395 
In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7396 
In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-01T01:07:00.000Z
CVE-2017-7397 
BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as defined in RFC 1812 section 5.3.7). This product enables net.ipv4.conf.all.log_martians by default.  NOTE: the vendor reports "It has been proved that this vulnerability has no foundation and it is totally fake and based on false assumptions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T20:00:00.000Z
CVE-2017-7398 
D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated, as demonstrated by changing the Security option from WPA2 to None, or changing the hiddenSSID parameter, SSID parameter, or a security-option password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-04T14:00:00.000Z
CVE-2017-7399 
Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-26T15:28:08.000Z
CVE-2017-7400 
OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T14:00:00.000Z
CVE-2017-7401 
Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T14:00:00.000Z
CVE-2017-7402 
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T17:00:00.000Z
CVE-2017-7404 
On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious site then can send requests to the victim's Router without knowing the credentials (CSRF). An attacker can host a page that sends a POST request to Form2File.htm that tries to upload Firmware to victim's Router. This causes the router to reboot/crash resulting in Denial of Service. An attacker may succeed in uploading malicious Firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-07T12:00:00.000Z
CVE-2017-7405 
On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim's host, an attacker might be able to take over the administrative session without being prompted for authentication credentials. An attacker can get the victim's and router's IP addresses by simply sniffing the network traffic. Moreover, if the victim has web access enabled on his router and is accessing the web interface from a different network that is behind the NAT/Proxy, an attacker can sniff the network traffic to know the public IP address of the victim's router and take over his session as he won't be prompted for credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-07T12:00:00.000Z
CVE-2017-7406 
The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certificate. An attacker can simply monitor network traffic to steal a user's credentials and/or credentials of users being added while sniffing the traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-07T12:00:00.000Z
CVE-2017-7407 
The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T20:00:00.000Z
CVE-2017-7408 
Palo Alto Networks Traps ESM Console before 3.4.4 allows attackers to cause a denial of service by leveraging improper validation of requests to revoke a Traps agent license.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T14:00:00.000Z
CVE-2017-7409 
Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T02:11:00.000Z
CVE-2017-7410 
Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-03T22:00:00.000Z