rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-12080 
An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain sensitive system information via .htaccess file.
Problem types: cwe_id: CWE-200
description: Information Exposure (CWE-200)
Affected products: vendor: Synology
product: Photo Station
Published: 2017-12-04T19:00:00.000Z
CVE-2017-12081 
An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12082 
An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specially crafted external data file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to edit an object within a .blend library in their Scene in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12083 
An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the Internet to trigger this vulnerability.
Problem types: description: authentication bypass
Affected products: vendor: Circle Media
product: Circle
Published: 2017-11-07T16:00:00.000Z
CVE-2017-12084 
A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH server.
Problem types: description: SSH server enabling
Affected products: vendor: Circle Media
product: Circle
Published: 2017-11-07T16:00:00.000Z
CVE-2017-12085 
An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device. An attacker needs network connectivity to the Internet to trigger this vulnerability.
Problem types: description: routing exploit
Affected products: vendor: Circle Media
product: Circle
Published: 2017-11-07T16:00:00.000Z
CVE-2017-12086 
An exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12087 
An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this vulnerability.
Problem types: description: heap overflow
Affected products: vendor: geekman
product: Tinysvcmdns
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12088 
An exploitable denial of service vulnerability exists in the Ethernet functionality of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted packet can cause a device power cycle resulting in a fault state and deletion of ladder logic. An attacker can send one unauthenticated packet to trigger this vulnerability
Problem types: description: denial of service
Affected products: vendor: Talos
product: Allen Bradley
Published: 2018-04-05T21:00:00.000Z
CVE-2017-12089 
An exploitable denial of service vulnerability exists in the program download functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a device fault resulting in halted operations. An attacker can send an unauthenticated packet to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: Talos
product: Allen Bradley
Published: 2018-04-05T21:00:00.000Z
CVE-2017-12090 
An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted snmp-set request, when sent without associated firmware flashing snmp-set commands, can cause a device power cycle resulting in downtime for the device. An attacker can send one packet to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: Talos
product: Allen Bradley
Published: 2018-04-05T21:00:00.000Z
CVE-2017-12092 
An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a file write resulting in a new program being written to the memory module. An attacker can send an unauthenticated packet to trigger this vulnerability.
Problem types: description: information exposure
Affected products: vendor: Talos
product: Allen Bradley
Published: 2018-06-04T20:00:00.000Z
CVE-2017-12093 
An exploitable insufficient resource pool vulnerability exists in the session communication functionality of Allen Bradley Micrologix 1400 Series B Firmware 21.2 and before. A specially crafted stream of packets can cause a flood of the session resource pool resulting in legitimate connections to the PLC being disconnected. An attacker can send unauthenticated packets to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: Talos
product: Allen Bradley
Published: 2018-04-05T21:00:00.000Z
CVE-2017-12094 
An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary sed commands. An attacker needs to setup an access point reachable by the device to trigger this vulnerability.
Problem types: description: arbitrary code execution
Affected products: vendor: Circle Media
product: Circle
Published: 2017-11-07T16:00:00.000Z
CVE-2017-12095 
An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. A series of WiFi packets can force Circle to setup an Access Point with default credentials. An attacker needs to send a series of spoofed "de-auth" packets to trigger this vulnerability.
Problem types: description: wi-fi access point vulnerability
Affected products: vendor: Circle Media
product: Circle
Published: 2018-04-05T19:00:00.000Z
CVE-2017-12096 
An exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted Access Point with the same name as the legitimate one can be used to make Circle connect to an untrusted network. An attacker needs to setup an Access Point reachable by the device and to send a series of spoofed "deauth" packets to trigger this vulnerability.
Problem types: description: access point deauthorization
Affected products: vendor: Circle Media
product: Circle
Published: 2017-11-07T16:00:00.000Z
CVE-2017-12097 
An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Problem types: description: XSS
Affected products: vendor: Talos
product: delayed_job_web rails gem
Published: 2018-01-19T20:00:00.000Z
CVE-2017-12098 
An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-19T19:00:00.000Z
CVE-2017-12099 
An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12100 
An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12101 
An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12102 
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12103 
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12104 
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12105 
An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifier to a Mesh. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Blender
product: Blender
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12106 
A memory corruption vulnerability exists in the .TGA parsing functionality of Computerinsel Photoline 20.02. A specially crafted .TGA file can cause an out of bounds write resulting in potential code execution. An attacker can send a specific .TGA file to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Talos
product: Computerinsel Photoline
Published: 2017-10-05T19:00:00.000Z
CVE-2017-12107 
An memory corruption vulnerability exists in the .PCX parsing functionality of Computerinsel Photoline 20.02. A specially crafted .PCX file can cause a vulnerability resulting in potential code execution. An attacker can send a specific .PCX file to trigger this vulnerability.
Problem types: description: parsing code execution
Affected products: vendor: Computerinsel
product: Photoline
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12108 
An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: libxls
product: libxls
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12109 
An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULRK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: libxls
product: libxls
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12110 
An exploitable integer overflow vulnerability exists in the xls_appendSST function of libxls 1.4.A specially crafted XLS file can cause memory corruption resulting in remote code execution.
Problem types: description: remote code execution
Affected products: vendor: libxls
product: libxls
Published: 2017-11-20T22:00:00.000Z
CVE-2017-12111 
An exploitable out-of-bounds vulnerability exists in the xls_addCell function of libxls 1.4. A specially crafted XLS file with a formula record can cause memory corruption resulting in remote code execution. An attacker can send a malicious XLS file to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: libxls
product: libxls
Published: 2017-11-20T22:00:00.000Z
CVE-2017-12112 
An exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.
Problem types: description: authorization bypass
Affected products: vendor: Talos
product: CPP-Ethereum
Published: 2018-01-19T22:00:00.000Z
CVE-2017-12113 
An exploitable improper authorization vulnerability exists in admin_nodeInfo API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.
Problem types: description: authorization bypass
Affected products: vendor: Talos
product: CPP-Ethereum
Published: 2018-01-19T23:00:00.000Z
CVE-2017-12114 
An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.
Problem types: description: authorization bypass
Affected products: vendor: Talos
product: CPP-Ethereum
Published: 2018-01-19T22:00:00.000Z
CVE-2017-12115 
An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass.
Problem types: description: authorization bypass
Affected products: vendor: Talos
product: CPP-Ethereum
Published: 2018-01-19T22:00:00.000Z
CVE-2017-12116 
An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.
Problem types: description: authorization bypass
Affected products: vendor: Talos
product: CPP-Ethereum
Published: 2018-01-19T23:00:00.000Z
CVE-2017-12117 
An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.
Problem types: description: authorization bypass
Affected products: vendor: Talos
product: CPP-Ethereum
Published: 2018-01-19T22:00:00.000Z
CVE-2017-12118 
An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). An attacker can send JSON to trigger this vulnerability.
Problem types: description: authorization bypass
Affected products: vendor: Talos
product: CPP-Ethereum
Published: 2018-01-19T23:00:00.000Z
CVE-2017-12119 
An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted JSON requests can cause an unhandled exception resulting in denial of service. An attacker can send malicious JSON to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: Talos
product: CPP-Ethereum
Published: 2018-01-19T23:00:00.000Z
CVE-2017-12120 
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation, resulting in a root shell. An attacker can inject OS commands into the ip= parm in the "/goform/net_WebPingGetValue" URI to trigger this vulnerability.
Problem types: description: command injection
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12121 
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the rsakey\_name= parm in the "/goform/WebRSAKEYGen" uri to trigger this vulnerability.
Problem types: description: command injection
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12122 
An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a heap overflow resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Sam Lantinga and Mattias Engdegård
product: Simple DirectMedia Layer
Published: 2018-04-24T19:00:00.000Z
CVE-2017-12123 
An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin.
Problem types: description: Cleartext Transmission of Sensitive Information
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12124 
An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in the web server crashing. An attacker can send a crafted URI to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12125 
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the CN= parm in the "/goform/net_WebCSRGen" uri to trigger this vulnerability.
Problem types: description: OS command injection
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12126 
An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP packet can cause cross-site request forgery. An attacker can create malicious HTML to trigger this vulnerability.
Problem types: description: Cross-site request forgery
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12127 
A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract passwords in clear text from the device.
Problem types: description: Plaintext storage of password
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12128 
An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packet can cause information disclosure. An attacker can send a crafted TCP packet to trigger this vulnerability.
Problem types: description: Information disclosure
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12129 
An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could intercept weakly encrypted passwords and could brute force them.
Problem types: description: weak cryptography
Affected products: vendor: Talos
product: Moxa
Published: 2018-05-14T20:00:00.000Z
CVE-2017-12130 
An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to a server crash and denial of service. An attacker needs to send a DNS query to trigger this vulnerability.
Problem types: description: denial of service
Affected products: vendor: Talos
product: Tinysvcmdns
Published: 2018-01-20T00:00:00.000Z
CVE-2017-12131 
The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-01T05:00:00.000Z