rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-17789 
In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17790 
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17792 
Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17793 
Information Disclosure vulnerability in creer_fichier_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to defeat a filename-randomization protection mechanism, and read backup archives on Windows servers, by providing the archiv~1.zip name (aka an 8.3 filename).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17794 
validate_form_preferences in admin/preferences.php in BlogoText through 3.7.6 allows attackers to bypass intended access restrictions via vectors related to an e-mail address field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17795 
In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83000088.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17796 
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x827300A4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17797 
In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83000058.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17798 
In TG Soft Vir.IT eXplorer Lite 8.5.42, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273A0A0, a different vulnerability than CVE-2017-17800.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17799 
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x82730068.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17800 
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273A0A0, a different vulnerability than CVE-2017-17798.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17801 
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273E060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17802 
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273E080.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17803 
In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x82736068, a different vulnerability than CVE-2017-17475.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17804 
In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x83000084.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T09:00:00.000Z
CVE-2017-17805 
The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T23:00:00.000Z
CVE-2017-17806 
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T23:00:00.000Z
CVE-2017-17807 
The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T23:00:00.000Z
CVE-2017-17809 
In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forcing the VyprVPN application to load a malicious dynamic library every time a new connection is made.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-20T23:00:00.000Z
CVE-2017-17810 
In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17811 
In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17812 
In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17813 
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a remote denial of service attack, related to mishandling of line-syntax errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17814 
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a remote denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17815 
In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause a remote denial of service attack, because of a missing check for the relationship between minimum and maximum parameter counts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17816 
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a remote denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17817 
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_verror in asm/preproc.c that will cause a remote denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17818 
In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a while loop in paste_tokens in asm/preproc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17819 
In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find_cc() in asm/preproc.c that will cause a remote denial of service attack, because pointers associated with skip_white_ calls are not validated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17820 
In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_list_one_macro in asm/preproc.c that will lead to a remote denial of service attack, related to mishandling of operand-type errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17821 
WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function (in WTF/wtf/FastBitVector.cpp) for a purpose other than initializing a bitvector size, and resizeSlow mishandles cases where the old array length is greater than the new array length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T03:00:00.000Z
CVE-2017-17822 
The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user_list_backend.php sSortDir_0 parameter. An attacker can exploit this to gain access to the data in a connected MySQL database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T04:00:00.000Z
CVE-2017-17823 
The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T04:00:00.000Z
CVE-2017-17824 
The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T04:00:00.000Z
CVE-2017-17825 
The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T04:00:00.000Z
CVE-2017-17826 
The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration&section=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T04:00:00.000Z
CVE-2017-17827 
Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T04:00:00.000Z
CVE-2017-17828 
Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T05:00:00.000Z
CVE-2017-17829 
Bus Booking Script has SQL Injection via the admin/view_seatseller.php sp_id parameter or the admin/view_member.php memid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T05:00:00.000Z
CVE-2017-17830 
Bus Booking Script has CSRF via admin/new_master.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T05:00:00.000Z
CVE-2017-17831 
GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T06:00:00.000Z
CVE-2017-17832 
ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanitized when passed in the settings_SMS_ALERT_TYPE parameter, and JavaScript can be executed on settings-save.html (the Settings - SMS Alerts page).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-22T18:00:00.000Z
CVE-2017-17833 
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-23T18:00:00.000Z
CVE-2017-17835 
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
Published: 2019-01-23T17:00:00.000Z
CVE-2017-17836 
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.
Problem types: description: Information Exposure
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
Published: 2019-01-23T17:00:00.000Z
CVE-2017-17837 
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache DeltaSpike
Published: 2018-01-04T15:00:00.000Z
CVE-2017-17840 
An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-22T09:00:00.000Z
CVE-2017-17841 
Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalProtect portal or gateway, might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2017-17843 
An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-22T23:00:00.000Z
CVE-2017-17844 
An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 "replay" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-22T23:00:00.000Z
CVE-2017-17845 
An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-22T23:00:00.000Z
CVE-2017-17846 
An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-22T23:00:00.000Z
CVE-2017-17847 
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-22T23:00:00.000Z
CVE-2017-17848 
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-22T23:00:00.000Z
CVE-2017-17849 
A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-24T18:00:00.000Z
CVE-2017-17850 
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T00:00:00.000Z
CVE-2017-17852 
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T04:00:00.000Z
CVE-2017-17853 
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T04:00:00.000Z
CVE-2017-17854 
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T04:00:00.000Z
CVE-2017-17855 
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T04:00:00.000Z
CVE-2017-17856 
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T04:00:00.000Z
CVE-2017-17857 
The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-23T04:00:00.000Z
CVE-2017-17858 
Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T15:00:00.000Z