rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-2515 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2516 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2517 
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-20T16:00:00.000Z
CVE-2017-2518 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted SQL statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2519 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2520 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted SQL statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2521 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2522 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "CoreFoundation" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2523 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "Foundation" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2524 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "TextInput" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2525 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2526 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2527 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "CoreAnimation" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption and application crash) via crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2528 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with cached frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2530 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. iCloud before 6.2.1 on Windows is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2531 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2533 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "DiskArbitration" component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2534 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Speech Framework" component. It allows attackers to conduct sandbox-escape attacks via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2535 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Security" component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (resource consumption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2536 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2537 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "WindowServer" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2538 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2539 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2540 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "WindowServer" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2541 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "WindowServer" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2542 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Multi-Touch" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2543 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Multi-Touch" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2544 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2545 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "IOGraphics" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2546 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2547 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2548 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "WindowServer" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2549 
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with frame loading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-22T04:54:00.000Z
CVE-2017-2550 
Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename.
Problem types: description: Joomla extension Easy Joomla Backup v3.2.4 database backup exposure
Affected products: vendor: kubik-rubik
product: Easy Joomla Backup
Published: 2017-09-08T16:00:00.000Z
CVE-2017-2551 
Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.
Problem types: description: Vulnerability in Wordpress Plugin backwpup v3.4.1 possible brute forcing of backup file download
Affected products: vendor: Inpsyde
product: backwpup
Published: 2017-09-27T16:00:00.000Z
CVE-2017-2575 
A vulnerability was found while fuzzing libbpg 0.9.7. It is a NULL pointer dereference issue due to missing check of the return value of function malloc in the BPG encoder. This vulnerability appeared while converting a malicious JPEG file to BPG.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: Fabrice Bellard
product: libbpg
Published: 2018-08-22T21:00:00.000Z
CVE-2017-2576 
In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Moodle 2.x and 3.x
Published: 2017-01-20T08:39:00.000Z
CVE-2017-2578 
In Moodle 3.x, there is XSS in the assignment submission page.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Moodle 3.x
Published: 2017-01-20T08:39:00.000Z
CVE-2017-2579 
An out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack() function has an insufficient code value check, so that a maliciously crafted file could cause the application to crash or possibly allows code execution.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: Netpbm
product: netpbm
Published: 2018-07-27T18:00:00.000Z
CVE-2017-2580 
An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: Netpbm
product: netpbm
Published: 2018-07-27T18:00:00.000Z
CVE-2017-2581 
An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: Netpbm
product: netpbm
Published: 2018-07-27T18:00:00.000Z
CVE-2017-2582 
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
Problem types: cwe_id: CWE-201
description: CWE-201
Affected products: vendor: Red Hat
product: keycloak
Published: 2018-07-26T17:00:00.000Z
CVE-2017-2583 
The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a "MOV SS, NULL selector" instruction, which allows guest OS users to cause a denial of service (guest OS crash) or gain guest OS privileges via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T06:04:00.000Z
CVE-2017-2584 
arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-15T02:00:00.000Z
CVE-2017-2585 
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
Problem types: description: None
Affected products: vendor: Red Hat, Inc.
product: keycloak
Published: 2018-03-12T15:00:00.000Z
CVE-2017-2586 
A null pointer dereference vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: Netpbm
product: netpbm
Published: 2018-07-27T18:00:00.000Z
CVE-2017-2587 
A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: Netpbm
product: netpbm
Published: 2018-07-27T18:00:00.000Z
CVE-2017-2589 
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: Red Hat
product: hawtio
Published: 2018-07-26T15:00:00.000Z
CVE-2017-2590 
A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: Red Hat
product: ipa
Published: 2018-07-27T18:00:00.000Z
CVE-2017-2591 
389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: unspecified
product: 389-ds-base
Published: 2018-04-30T12:00:00.000Z
CVE-2017-2592 
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
Problem types: cwe_id: CWE-532
description: CWE-532
Affected products: vendor: unspecified
product: python-oslo-middleware
Published: 2018-05-08T17:00:00.000Z
CVE-2017-2594 
hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.
Problem types: cwe_id: CWE-209
description: CWE-209
Affected products: vendor: unspecified
product: hawtio
Published: 2018-05-08T17:00:00.000Z
CVE-2017-2595 
It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: [UNKNOWN]
product: wildfly
Published: 2018-07-27T15:00:00.000Z
CVE-2017-2596 
The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXON instruction, which allows KVM L1 guest OS users to cause a denial of service (host OS memory consumption) by leveraging the mishandling of page references.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T06:04:00.000Z
CVE-2017-2598 
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
Problem types: cwe_id: CWE-325
description: CWE-325
Affected products: vendor: [UNKNOWN]
product: jenkins
Published: 2018-05-23T13:00:00.000Z
CVE-2017-2599 
Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: [UNKNOWN]
product: jenkins
Published: 2018-04-11T16:00:00.000Z
CVE-2017-2600 
In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
Problem types: cwe_id: CWE-325
description: CWE-325
Affected products: vendor: [UNKNOWN]
product: jenkins
Published: 2018-05-15T20:00:00.000Z
CVE-2017-2601 
Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: unspecified
product: jenkins
Published: 2018-05-10T00:00:00.000Z
CVE-2017-2602 
jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
Problem types: cwe_id: CWE-184
description: CWE-184
Affected products: vendor: [UNKNOWN]
product: jenkins
Published: 2018-05-15T21:00:00.000Z