rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-3961 SB10192 - Network Security Management (NSM) - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes.
Problem types: description: Cross-Site Scripting (XSS) vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-05-25T13:00:00.000Z
CVE-2017-3962 McAfee Network Security Management (NSM) - Password recovery exploitation vulnerability
Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to crack user passwords via unsalted hashes.
Problem types: description: Password recovery exploitation vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-06-12T14:00:00.000Z
CVE-2017-3964 SB10192 - Network Security Management (NSM) - Reflective Cross-Site Scripting (XSS) vulnerability
Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inject arbitrary web script or HTML via a URL parameter.
Problem types: description: Reflective Cross-Site Scripting (XSS) vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-04-04T13:00:00.000Z
CVE-2017-3965 SB10192 - Network Security Management (NSM) - Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability
Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted URLs.
Problem types: description: Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-04-04T13:00:00.000Z
CVE-2017-3966 SB10192 - Network Security Management (NSM) - Exploitation of session variables, resource IDs and other trusted credentials vulnerability
Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.
Problem types: description: Exploitation of session variables, resource IDs and other trusted credentials vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-04-04T13:00:00.000Z
CVE-2017-3967 SB10192 - Network Security Management (NSM) - Target influence via framing vulnerability
Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
Problem types: description: Target influence via framing vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-04-04T13:00:00.000Z
CVE-2017-3968 McAfee Network Security Management (NSM) and Network Data Loss Prevention (NDLP)- Password recovery exploitation vulnerability
Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie.
Problem types: description: Session fixation vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
vendor: McAfee
product: Network Data Loss Prevention (NDLP)
Published: 2018-06-13T20:00:00.000Z
CVE-2017-3969 SB10192 - Network Security Management (NSM) - Abuse of communication channels vulnerability
Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate implementation of SSL.
Problem types: description: Abuse of communication channels vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-04-04T13:00:00.000Z
CVE-2017-3971 SB10192 - Network Security Management (NSM) - Cryptanalysis vulnerability
Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confidential information via insecure use of RC4 encryption cyphers.
Problem types: description: Cryptanalysis vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-04-04T13:00:00.000Z
CVE-2017-3972 SB10192 - Network Security Management (NSM) - Infrastructure-based foot printing vulnerability
Infrastructure-based foot printing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to execute arbitrary code via the server banner leaking potentially sensitive or security relevant information.
Problem types: description: Infrastructure-based foot printing vulnerability
Affected products: vendor: McAfee
product: Network Security Management (NSM)
Published: 2018-04-03T22:00:00.000Z
CVE-2017-3980 
A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session.
Problem types: description: A directory traversal vulnerability
Affected products: vendor: McAfee
product: ePolicy Orchestrator (ePO)
Published: 2017-05-18T19:00:00.000Z
CVE-2017-4011 
Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.
Problem types: description: Embedding Script (XSS) in HTTP Headers vulnerability
Affected products: vendor: McAfee
product: Network Data Loss Prevention (NDLP)
Published: 2017-05-17T21:00:00.000Z
CVE-2017-4012 
Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via modification of the HTTP request.
Problem types: description: Privilege Escalation vulnerability
Affected products: vendor: McAfee
product: Network Data Loss Prevention (NDLP)
Published: 2017-05-17T21:00:00.000Z
CVE-2017-4013 
Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to obtain product information via HTTP response header.
Problem types: description: Banner Disclosure
Affected products: vendor: McAfee
product: Network Data Loss Prevention (NDLP)
Published: 2017-05-17T21:00:00.000Z
CVE-2017-4014 
Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request.
Problem types: description: Session Side jacking vulnerability
Affected products: vendor: McAfee
product: Network Data Loss Prevention (NDLP)
Published: 2017-05-17T21:00:00.000Z
CVE-2017-4015 
Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header.
Problem types: description: Clickjacking vulnerability
Affected products: vendor: McAfee
product: Network Data Loss Prevention (NDLP)
Published: 2017-05-17T21:00:00.000Z
CVE-2017-4016 
Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find another hole via HTTP response header.
Problem types: description: Web Server method disclosure
Affected products: vendor: McAfee
product: Network Data Loss Prevention (NDLP)
Published: 2017-05-17T21:00:00.000Z
CVE-2017-4017 
User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via the appliance web interface.
Problem types: description: User Name Disclosure
Affected products: vendor: McAfee
product: Network Data Loss Prevention (NDLP)
Published: 2017-05-17T21:00:00.000Z
CVE-2017-4028 SB10193 - consumer and corporate products - Maliciously misconfigured registry vulnerability
Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters.
Problem types: description: Maliciously misconfigured registry vulnerability
Affected products: vendor: McAfee
product: McAfee Anti-Virus Plus (AVP)
vendor: McAfee
product: McAfee Endpoint Security (ENS)
vendor: McAfee
product: McAfee Host Intrusion Prevention (Host IPS)
vendor: McAfee
product: McAfee Internet Security (MIS)
vendor: McAfee
product: McAfee Total Protection (MTP)
vendor: McAfee
product: McAfee Virus Scan Enterprise (VSE)
Published: 2018-04-03T22:00:00.000Z
CVE-2017-4052 
Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to change or update any configuration settings, or gain administrator functionality via a crafted HTTP request parameter.
Problem types: description: Authentication Bypass vulnerability
Affected products: vendor: McAfee
product: Advanced Threat Defense (ATD)
Published: 2017-07-12T15:00:00.000Z
CVE-2017-4053 
Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to execute a command of their choice via a crafted HTTP request parameter.
Problem types: description: Command Injection vulnerability
Affected products: vendor: McAfee
product: Advanced Threat Defense (ATD)
Published: 2017-07-12T15:00:00.000Z
CVE-2017-4054 
Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a command of their choice via a crafted HTTP request parameter.
Problem types: description: Command Injection vulnerability
Affected products: vendor: McAfee
product: Advanced Threat Defense (ATD)
Published: 2017-07-12T15:00:00.000Z
CVE-2017-4055 
Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to bypass ATD detection via loose enforcement of authentication and authorization.
Problem types: description: Exploitation of Authentication vulnerability
Affected products: vendor: McAfee
product: Advanced Threat Defense (ATD)
Published: 2017-07-12T15:00:00.000Z
CVE-2017-4057 
Privilege Escalation vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.
Problem types: description: Privilege Escalation vulnerability
Affected products: vendor: McAfee
product: Advanced Threat Defense (ATD)
Published: 2017-07-12T15:00:00.000Z
CVE-2017-4895 
Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection. Successful exploitation of this issue may result in an enrolled device having unrestricted access over local Airwatch security controls and data.
Problem types: description: Root detection bypass
Affected products: vendor: VMware
product: Airwatch Agent
Published: 2017-05-10T14:00:00.000Z
CVE-2017-4896 
Airwatch Inbox for Android contains a vulnerability that may allow a rooted device to decrypt the local data used by the application. Successful exploitation of this issue may result in an unauthorized disclosure of confidential data.
Problem types: description: Encyption bypass
Affected products: vendor: VMware
product: Airwatch Console
vendor: VMware
product: Airwatch Inbox
Published: 2017-05-10T14:00:00.000Z
CVE-2017-4897 
VMware Horizon DaaS before 7.0.0 contains a vulnerability that exists due to insufficient validation of data. An attacker may exploit this issue by tricking DaaS client users into connecting to a malicious server and sharing all their drives and devices. Successful exploitation of this vulnerability requires a victim to download a specially crafted RDP file through DaaS client by clicking on a malicious link.
Problem types: description: Lack of input validation
Affected products: vendor: VMware
product: Horizon DaaS
Published: 2017-05-31T14:00:00.000Z
CVE-2017-4898 
VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLLs from a path defined in the local environment-variable. Successful exploitation of this issue may allow normal users to escalate privileges to System in the host machine where VMware Workstation is installed.
Problem types: description: DLL Hijack
Affected products: vendor: VMware
product: Workstation Pro/Player
Published: 2017-06-07T18:00:00.000Z
CVE-2017-4899 
VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. An attacker may exploit this issue to crash the VM or trigger an out-of-bound read. Note: This issue can be triggered only when the host has no graphics card or no graphics drivers are installed.
Problem types: description: DoS
Affected products: vendor: VMware
product: Workstation Pro/Player
Published: 2017-06-07T18:00:00.000Z
CVE-2017-4900 
VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.
Problem types: description: DoS
Affected products: vendor: VMware
product: Workstation Pro/Player
Published: 2017-06-07T18:00:00.000Z
CVE-2017-4901 
The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability. This may allow a guest to execute code on the operating system that runs Workstation or Fusion.
Problem types: description: Remote code execution
Affected products: vendor: VMware
product: Workstation Pro/Player
vendor: VMware
product: Fusion Pro / Fusion
Published: 2017-06-08T13:00:00.000Z
CVE-2017-4902 
VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host.
Problem types: description: Heap Buffer Overflow
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation Pro / Player
vendor: VMware
product: Fusion Pro / Fusion
Published: 2017-06-07T18:00:00.000Z
CVE-2017-4903 
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have an uninitialized stack memory usage in SVGA. This issue may allow a guest to execute code on the host.
Problem types: description: Uninitialized Stack Memory Usage
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation Pro / Player
vendor: VMware
product: Fusion Pro / Fusion
Published: 2017-06-07T18:00:00.000Z
CVE-2017-4904 
The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 has uninitialized memory usage. This issue may allow a guest to execute code on the host. The issue is reduced to a Denial of Service of the guest on ESXi 5.5.
Problem types: description: Remote Code Execution / DoS
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation Pro / Player
vendor: VMware
product: Fusion Pro / Fusion
Published: 2017-06-07T18:00:00.000Z
CVE-2017-4905 
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have uninitialized memory usage. This issue may lead to an information leak.
Problem types: description: Information leak
Affected products: vendor: VMware
product: ESXi
vendor: VMware
product: Workstation Pro / Player
vendor: VMware
product: Fusion Pro / Fusion
Published: 2017-06-07T18:00:00.000Z
CVE-2017-4907 
VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap buffer-overflow vulnerability which may allow a remote attacker to execute code on the security gateway.
Problem types: description: Heap buffer-overflow vulnerability
Affected products: vendor: VMware
product: Unified Access Gateway
vendor: VMware
product: Horizon View
Published: 2017-06-08T13:00:00.000Z
CVE-2017-4908 
VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple heap buffer-overflow vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Problem types: description: Heap-based buffer overflow issues via Cortado ThinPrint
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-06-08T13:00:00.000Z
CVE-2017-4909 
VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain a heap buffer-overflow vulnerability in TrueType Font (TTF) parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Problem types: description: Heap-based buffer overflow issue via Cortado ThinPrint
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-06-08T13:00:00.000Z
CVE-2017-4910 
VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Problem types: description: Out-of-bounds read issues via Cortado ThinPrint
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-06-08T13:00:00.000Z
CVE-2017-4911 
VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds write vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Problem types: description: Out-of-bounds write issues via Cortado ThinPrint
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-06-08T13:00:00.000Z
CVE-2017-4912 
VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in TrueType Font (TTF) parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Problem types: description: Out-of-bounds read issues via Cortado ThinPrint
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-06-08T13:00:00.000Z
CVE-2017-4913 
VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True Type Font parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Problem types: description: Integer overflow vulnerability via Cortado ThinPrint
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Horizon View Client for Windows
Published: 2017-06-08T13:00:00.000Z
CVE-2017-4914 
VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.
Problem types: description: Remote Command Execution
Affected products: vendor: VMware
product: vSphere Data Protection (VDP)
Published: 2017-06-07T17:00:00.000Z
CVE-2017-4915 
VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.
Problem types: description: Privilege Escalation
Affected products: vendor: VMware
product: Workstation Pro/Player
Published: 2017-05-22T14:00:00.000Z