rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-17383 
Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-06T05:00:00.000Z
CVE-2017-17384 
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-07T08:00:00.000Z
CVE-2017-17405 
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T09:00:00.000Z
CVE-2017-17406 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within an exposed RMI registry, which listens on TCP ports 1800 and 1850 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Was ZDI-CAN-4753.
Problem types: cwe_id: CWE-502
description: CWE-502-Deserialization of Untrusted Data
Affected products: vendor: NetGain Systems
product: NetGain Systems Enterprise Manager
Published: 2018-01-23T01:00:00.000Z
CVE-2017-17407 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.699 build 1001. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the content parameter provided to the script_test.jsp endpoint. A crafted content request parameter can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code under the context of the web service. Was ZDI-CAN-5080.
Problem types: cwe_id: CWE-78
description: CWE-78-Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: NetGain Systems
product: NetGain Systems Enterprise Manager
Published: 2018-01-23T01:00:00.000Z
CVE-2017-17408 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5101.
Problem types: cwe_id: CWE-190
description: CWE-190-Integer Overflow or Wraparound
Affected products: vendor: Bitdefender
product: Bitdefender Internet Security
Published: 2017-12-21T14:00:00.000Z
CVE-2017-17409 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within emulator 0x10A in cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5102.
Problem types: cwe_id: CWE-190
description: CWE-190-Integer Overflow or Wraparound
Affected products: vendor: Bitdefender
product: Bitdefender Internet Security
Published: 2017-12-21T14:00:00.000Z
CVE-2017-17410 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within emulator 0x102 in cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5116.
Problem types: cwe_id: CWE-787
description: CWE-787-Out-of-bounds Write
Affected products: vendor: Bitdefender
product: Bitdefender Internet Security
Published: 2017-12-21T14:00:00.000Z
CVE-2017-17411 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.
Problem types: cwe_id: CWE-78
description: CWE-78-Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Linksys
product: Linksys WVBR0
Published: 2017-12-21T14:00:00.000Z
CVE-2017-17412 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of GET method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute arbitrary code in the context of the underlying database. Was ZDI-CAN-4223.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17413 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupTargetSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4224.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17414 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4225.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17415 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Count method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4226.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17416 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus GetPlugins method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4227.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17417 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Acknowledge method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4228.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17418 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPolicy Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4229.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17419 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUTransferHistory Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4230.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17420 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobCountHistory Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4231.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17421 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUSelectionSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4232.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17422 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4233.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17423 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupSegment Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4234.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17424 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUScheduleSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4235.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17425 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUSourceDeviceSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4237.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17426 
The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-05T17:00:00.000Z
CVE-2017-17427 
Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack ("Bleichenbacher attack"). This allows an attacker to decrypt observed traffic that has been encrypted with the RSA cipher and to perform other private key operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T16:00:00.000Z
CVE-2017-17428 
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-05T18:00:00.000Z
CVE-2017-17429 
In K7 Antivirus Premium before 15.1.0.53, user-controlled input to the K7Sentry device is not sufficiently authenticated: a local user with a LOW integrity process can access a raw hard disk by sending a specific IOCTL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-17430 
Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-07T08:00:00.000Z
CVE-2017-17431 
GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-05T21:00:00.000Z
CVE-2017-17432 
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-06T00:00:00.000Z
CVE-2017-17433 
The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-06T03:00:00.000Z
CVE-2017-17434 
The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-06T03:00:00.000Z
CVE-2017-17435 
An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request, the safe does not check the PIN code, so an attacker can obtain authorization using any value. Once an attacker sees the Bluetooth Low Energy (BLE) advertisement for the safe, they need only to write a BLE characteristic to enable notifications, and send a crafted getAuthor packet that returns a temporary key, and an unlock packet including that temporary key. The safe then opens after the unlock packet is processed, with no verification of PIN or other credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-07T00:00:00.000Z
CVE-2017-17436 
An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and "Data transmissions are secure via AES256 bit encryption." These claims, however, are not true. Moreover, AES256 bit encryption is not supported in the Bluetooth Low Energy (BLE) standard, so it would have to be at the application level. This lack of encryption allows an individual to learn the passcode by eavesdropping on the communications between the application and the safe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-07T00:00:00.000Z
CVE-2017-17439 
In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-06T15:00:00.000Z
CVE-2017-17440 
GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, as demonstrated by the EXTRACTOR_xm_extract_method function in plugins/xm_extractor.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-06T17:00:00.000Z
CVE-2017-17442 
In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the context of the affected UEM Management Console account by crafting a malicious link and then persuading a user with legitimate access to the Management Console to click on the malicious link.
Problem types: description: Reflected cross-site scripting vulnerability
Affected products: vendor: BlackBerry
product: UEM Management Console
default_status: unaffected
Published: 2018-03-13T18:00:00.000Z
CVE-2017-17443 
OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by placing invalid data into the configuration file. This vulnerability requires an attacker with access to the file system where the configuration file is stored; however, if the configuration file is altered the LDS will be unavailable until it is repaired.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-13T18:00:00.000Z
CVE-2017-17446 
The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-06T19:00:00.000Z