rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-8077 
On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T16:00:00.000Z
CVE-2017-8078 
On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd). This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T16:00:00.000Z
CVE-2017-8080 
Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T14:00:00.000Z
CVE-2017-8081 
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-30T19:00:00.000Z
CVE-2017-8082 
concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T06:12:00.000Z
CVE-2017-8083 
CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of flash memory regions, which allows local users to install a firmware rootkit by leveraging administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T14:00:00.000Z
CVE-2017-8085 
In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T14:00:00.000Z
CVE-2017-8086 
Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-02T14:00:00.000Z
CVE-2017-8087 
Information Leakage in PPPoE Packet Padding in AVM Fritz!Box 7490 with Firmware versions Fritz!OS 6.80 and 6.83 allows physically proximate attackers to view slices of previously transmitted packets or portions of memory via via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T15:52:22.000Z
CVE-2017-8098 
e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2017-8099 
There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2017-8100 
There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2017-8101 
There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2017-8102 
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2017-8103 
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2017-8104 
In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2017-8105 
FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2017-8106 
The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T23:00:00.000Z
CVE-2017-8108 
Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2017-8109 
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-25T17:00:00.000Z
CVE-2017-8110 
www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-25T17:00:00.000Z
CVE-2017-8112 
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-02T14:00:00.000Z
CVE-2017-8114 
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-29T19:00:00.000Z
CVE-2017-8115 
Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-25T19:00:00.000Z
CVE-2017-8116 
The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-03T16:00:00.000Z
CVE-2017-8117 
The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8118 
The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak.
Problem types: description: leak vulnerabilities
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8119 
The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8120 
The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8121 
The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak.
Problem types: description: leak vulnerabilities
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8122 
The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8123 
The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8124 
The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8125 
The UMA product with software V200R001 and V300R001 has a cross-site scripting (XSS) vulnerability due to insufficient input validation. An attacker could craft malicious links or scripts to launch XSS attacks.
Problem types: description: XSS
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8126 
The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8127 
The UMA product with software V200R001 has a cross-site scripting (XSS) vulnerability due to insufficient input validation. An attacker could craft malicious links or scripts to launch XSS attacks.
Problem types: description: XSS
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8128 
The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8129 
The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
Problem types: description: privilege elevation
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8130 
The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak.
Problem types: description: leak vulnerabilities
Affected products: vendor: Huawei Technologies Co., Ltd.
product: UMA
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8131 
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
Problem types: description: Command Injection
Affected products: vendor: Huawei Technologies Co., Ltd.
product: FusionSphere OpenStack
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8132 
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
Problem types: description: Command Injection
Affected products: vendor: Huawei Technologies Co., Ltd.
product: FusionSphere OpenStack
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8133 
Huawei iManager NetEco with software V600R008C00 and V600R008C10 has a command injection vulnerability. An authenticated, remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploit could enable a low privileged user to execute commands that a high privileged user could execute, causing the files to be tampered with or deleted.
Problem types: description: Command Injection
Affected products: vendor: Huawei Technologies Co., Ltd.
product: iManager NetEco
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8134 
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
Problem types: description: Command Injection
Affected products: vendor: Huawei Technologies Co., Ltd.
product: FusionSphere OpenStack
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8135 
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.
Problem types: description: Command Injection
Affected products: vendor: Huawei Technologies Co., Ltd.
product: FusionSphere OpenStack
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8136 
HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target device to cause information leak.
Problem types: description: arbitrary file download
Affected products: vendor: Huawei Technologies Co., Ltd.
product: HedEx Lite
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8137 
HedEx Earlier than V200R006C00 versions has a dynamic link library (DLL) hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking.
Problem types: description: DLL hijacking
Affected products: vendor: Huawei Technologies Co., Ltd.
product: HedEx Lite
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8138 
HedEx Earlier than V200R006C00 versions has a cross-site request forgery (CSRF) vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services.
Problem types: description: CSRF
Affected products: vendor: Huawei Technologies Co., Ltd.
product: HedEx Lite
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8139 
HedEx Earlier than V200R006C00 versions have the stored cross-site scripting (XSS) vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users.
Problem types: description: XSS
Affected products: vendor: Huawei Technologies Co., Ltd.
product: HedEx Lite
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8140 
The soundtrigger driver in P9 Plus smart phones with software versions earlier than VIE-AL10BC00B353 has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash or arbitrary code execution.
Problem types: description: Memory Double Free
Affected products: vendor: Huawei Technologies Co., Ltd.
product: P9 Plus
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8141 
The Touch Panel (TP) driver in P10 Plus smart phones with software versions earlier than VKY-AL00C00B153 has a memory double free vulnerability. An attacker with the root privilege of the Android system tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash or arbitrary code execution.
Problem types: description: Memory Double Free
Affected products: vendor: Huawei Technologies Co., Ltd.
product: P10 Plus
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8142 
The Trusted Execution Environment (TEE) module driver of Mate 9 and Mate 9 Pro smart phones with software versions earlier than MHA-AL00BC00B221 and versions earlier than LON-AL00BC00B221 has a use after free (UAF) vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to create and free specific memory, which could triggers access memory after free it and causes a system crash or arbitrary code execution.
Problem types: description: Use After Free
Affected products: vendor: Huawei Technologies Co., Ltd.
product: Mate 9, Mate 9 Pro
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8143 
Wi-Fi driver of Honor 5C and P9 Lite Huawei smart phones with software versions earlier than NEM-L21C432B351 and versions earlier than VNS-L21C10B381 has a DoS vulnerability. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system.
Problem types: description: DoS
Affected products: vendor: Huawei Technologies Co., Ltd.
product: Honor 5C, P9 Lite
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8144 
Honor 5A,Honor 8 Lite,Mate9,Mate9 Pro,P10,P10 Plus Huawei smartphones with software the versions before CAM-L03C605B143CUSTC605D003,the versions before Prague-L03C605B161,the versions before Prague-L23C605B160,the versions before MHA-AL00C00B225,the versions before LON-AL00C00B225,the versions before VTR-AL00C00B167,the versions before VTR-TL00C01B167,the versions before VKY-AL00C00B167,the versions before VKY-TL00C01B167 have a resource exhaustion vulnerability due to configure setting. An attacker tricks a user into installing a malicious application, the application may turn on the device flash-light and rapidly drain the device battery.
Problem types: description: Resource Exhaustion
Affected products: vendor: Huawei Technologies Co., Ltd.
product: Honor 5A,Honor 8 Lite,Mate9,Mate9 Pro,P10,P10 Plus
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8145 
The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process.
Problem types: description: DoS
Affected products: vendor: Huawei Technologies Co., Ltd.
product: P10, P10 Plus
Published: 2017-11-22T19:00:00.000Z
CVE-2017-8146 
The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process.
Problem types: description: DoS
Affected products: vendor: Huawei Technologies Co., Ltd.
product: P10, P10 Plus
Published: 2017-11-22T19:00:00.000Z