rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-0359 diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Problem types: description: writes to arbitrary locations
Affected products: vendor: Debian
product: diffoscope
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0360 
file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: tryton-server before 3.4.0-3+deb8u3
Published: 2017-04-04T17:00:00.000Z
CVE-2017-0361 api.log contains passwords in plaintext
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.
Problem types: description: information disclosure
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0362 "Mark all pages visited" on the watchlist does not require a CSRF token
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.
Problem types: description: missing requirement on token
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0363 Special:UserLogin?returnto=interwiki:foo will redirect to external sites
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.
Problem types: description: redirection to other external sites
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0364 Special:Search allows redirects to any interwiki link
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.
Problem types: description: rediretion to any interwiki link
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0365 XSS in SearchHighlighter::highlightText() [requires non-default config]
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
Problem types: description: cross-site scripting
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0366 SVG filter evasion using default attribute values in DTD declaration
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.
Problem types: description: bypass filter
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0367 Having LocalisationCache directory default to system tmp directory is insecure
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.
Problem types: description: usafe use of system tmp directory.
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0368 Make rawHTML mode not apply to system messages
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.
Problem types: description: missing sanitization
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0369 Sysops can undelete pages, although the page is protected against it
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.
Problem types: description: restriction bypass
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0370 Spam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.
Problem types: description: blacklist ineffective on certain URLs
Affected products: vendor: mediawiki
product: mediawiki
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0371 
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T22:29:30.000Z
CVE-2017-0372 Parameters injection in SyntaxHighlight results in multiple vulnerabilities
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
Problem types: description: parameter injection
Affected products: vendor: mediawiki
product: mediawiki (SyntaxHighlight extension)
Published: 2018-04-13T16:00:00.000Z
CVE-2017-0373 
The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model (aka libconfig-model-perl) before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file.
Problem types: description: library mishandling
Affected products: vendor: n/a
product: libconfig-model-perl
Published: 2017-05-23T18:00:00.000Z
CVE-2017-0374 
lib/Config/Model.pm in Config-Model (aka libconfig-model-perl) before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array.
Problem types: description: untrusted include directory
Affected products: vendor: n/a
product: libconfig-model-perl
Published: 2017-05-23T18:00:00.000Z
CVE-2017-0375 
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.
Problem types: description: reachable assertion
Affected products: vendor: n/a
product: Tor before 0.3.0.8
Published: 2017-06-09T17:00:00.000Z
CVE-2017-0376 
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
Problem types: description: reachable assertion
Affected products: vendor: n/a
product: Tor before 0.3.0.8
Published: 2017-06-09T17:00:00.000Z
CVE-2017-0377 
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
Problem types: description: privacy bypass
Affected products: vendor: n/a
product: Tor
Published: 2017-07-02T15:00:00.000Z
CVE-2017-0378 
XSS exists in the login_form function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATH_INFO to main.php.
Problem types: description: XSS
Affected products: vendor: n/a
product: phamm before 0.6.7
Published: 2017-07-20T17:00:00.000Z
CVE-2017-0379 
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.
Problem types: description: local side-channel attack
Affected products: vendor: n/a
product: libgcrypt
Published: 2017-08-29T22:00:00.000Z
CVE-2017-0380 
The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.
Problem types: description: use of uninitialized stack data
Affected products: vendor: n/a
product: Tor before 0.3.1.7
Published: 2017-09-18T16:00:00.000Z
CVE-2017-0381 
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0382 
A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses the Framesequence library. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32338390.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0383 
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1. Android ID: A-31677614.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0384 
An elevation of privilege vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32095626.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0385 
An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32585400.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0386 
An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32255299.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0387 
An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32660278.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0388 
An elevation of privilege vulnerability in the External Storage Provider could enable a local secondary user to read data from an external storage SD card inserted by the primary user. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32523490.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0389 
A denial of service vulnerability in core networking could enable a remote attacker to use specially crafted network packet to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31850211.
Problem types: description: Denial of service
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0390 
A denial of service vulnerability in Tremolo/dpen.s in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31647370.
Problem types: description: Denial of service
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0391 
A denial of service vulnerability in decoder/ihevcd_decode.c in libhevc in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32322258.
Problem types: description: Denial of service
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0392 
A denial of service vulnerability in VBRISeeker.cpp in libstagefright in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32577290.
Problem types: description: Denial of service
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0393 
A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-30436808.
Problem types: description: Denial of service
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0394 
A denial of service vulnerability in Telephony could enable a remote attacker to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31752213.
Problem types: description: Denial of service
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0395 
An elevation of privilege vulnerability in Contacts could enable a local malicious application to silently create contact information. This issue is rated as Moderate because it is a local bypass of user interaction requirements (access to functionality that would normally require either user initiation or user permission). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32219099.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0396 
An information disclosure vulnerability in visualizer/EffectVisualizer.cpp in libeffects in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31781965.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0397 
An information disclosure vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32377688.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0398 
An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android IDs: A-32438594, A-32635664.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-13T16:00:00.000Z
CVE-2017-0399 
An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32588756.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0400 
An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32584034.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0401 
An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32588016.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0402 
An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32436341.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0403 
An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32402548.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0404 
An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32510733.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2017-0405 
A remote code execution vulnerability in Surfaceflinger could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Surfaceflinger process. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-31960359.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2017-02-08T15:00:00.000Z
CVE-2017-0406 
A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. This affects the libhevc library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32915871.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2017-02-08T15:00:00.000Z
CVE-2017-0407 
A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. This affects the libhevc library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32873375.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2017-02-08T15:00:00.000Z
CVE-2017-0408 
A remote code execution vulnerability in libgdx could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 7.1.1. Android ID: A-32769670.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2017-02-08T15:00:00.000Z
CVE-2017-0409 
A remote code execution vulnerability in libstagefright could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31999646.
Problem types: description: Remote code execution
Affected products: vendor: Google Inc.
product: Android
Published: 2017-02-08T15:00:00.000Z