rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-8019 
An issue was discovered in EMC ScaleIO 2.0.1.x. A vulnerability in message parsers (MDM, SDS, and LIA) could potentially allow an unauthenticated remote attacker to send specifically crafted packets to stop ScaleIO services and cause a denial of service situation.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: EMC ScaleIO EMC ScaleIO 2.0.1.x version family (2.0.1.3, 2.0.1.2, 2.0.1.1, 2.0.1)
Published: 2017-11-28T07:00:00.000Z
CVE-2017-8020 
An issue was discovered in EMC ScaleIO 2.0.1.x. A buffer overflow vulnerability in the SDBG service may potentially allow a remote unauthenticated attacker to execute arbitrary commands with root privileges on an affected server.
Problem types: description: Service Buffer Overflow
Affected products: vendor: n/a
product: EMC ScaleIO EMC ScaleIO 2.0.1.x version family (2.0.1.3, 2.0.1.2, 2.0.1.1, 2.0.1)
Published: 2017-11-28T07:00:00.000Z
CVE-2017-8021 
EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by malicious users to compromise the affected system.
Problem types: description: Undocumented Account Vulnerability
Affected products: vendor: n/a
product: EMC Elastic Cloud Storage all versions prior to 3.1
Published: 2017-10-02T05:00:00.000Z
CVE-2017-8022 
An issue was discovered in EMC NetWorker (prior to 8.2.4.9, all supported 9.0.x versions, prior to 9.1.1.3, prior to 9.2.0.4). The Server service (nsrd) is affected by a buffer overflow vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on vulnerable installations of the software, or cause a denial of service, depending on the target system's platform.
Problem types: description: Buffer Overflow Vulnerability
Affected products: vendor: n/a
product: EMC NetWorker prior to 8.2.4.9, 9.0.x (all supported versions), prior to 9.1.1.3, prior to 9.2.0.4
Published: 2017-10-18T15:00:00.000Z
CVE-2017-8023 EMC Networker Remote Code Execution Vulnerability
EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when oldauth authentication method is used. An unauthenticated remote attacker could send arbitrary commands via RPC service to be executed on the host system with the privileges of the nsrexecd service, which runs with administrative privileges.
Problem types: description: Remote Code Execution Vulnerability
Affected products: vendor: Dell EMC
product: Networker
Published: 2019-04-01T20:54:47.193Z
CVE-2017-8024 
EMC Isilon OneFS (versions prior to 8.1.0.1, versions prior to 8.0.1.2, versions prior to 8.0.0.6, version 7.2.1.x) is impacted by a reflected cross-site scripting vulnerability that may potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Reflected Cross Site Scripting Vulnerability
Affected products: vendor: n/a
product: EMC Isilon OneFS EMC Isilon OneFS versions prior to 8.1.0.1, EMC Isilon OneFS versions prior to 8.0.1.2, EMC Isilon OneFS versions prior to 8.0.0.6, EMC Isilon OneFS 7.2.1.x
Published: 2017-10-18T09:00:00.000Z
CVE-2017-8025 
RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server.
Problem types: description: Arbitrary File Upload Vulnerability
Affected products: vendor: n/a
product: RSA Archer GRC Platform prior to 6.2.0.5
Published: 2017-10-11T19:00:00.000Z
CVE-2017-8028 
In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.
Problem types: description: authentication with arbitrary password
Affected products: vendor: n/a
product: Spring-LDAP Spring-LDAP versions 1.3.0 2.3.1
Published: 2017-11-27T10:00:00.000Z
CVE-2017-8031 
An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: cf-release and UAA cf-release: All versions prior to v279, UAA: 30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1
Published: 2017-11-27T10:00:00.000Z
CVE-2017-8032 
In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider.
Problem types: description: Admin Privilege Escalation
Affected products: vendor: n/a
product: Cloud Foundry
Published: 2017-07-10T20:00:00.000Z
CVE-2017-8033 
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM.
Problem types: description: API filesystem traversal vulnerability
Affected products: vendor: n/a
product: Cloud Controller API CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268
Published: 2017-07-25T04:00:00.000Z
CVE-2017-8034 
The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: Cloud Foundry
Published: 2017-07-17T14:00:00.000Z
CVE-2017-8035 
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation.
Problem types: description: API access to CC VM contents
Affected products: vendor: n/a
product: Cloud Controller
Published: 2017-07-25T04:00:00.000Z
CVE-2017-8036 
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only). The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application.
Problem types: description: API regression
Affected products: vendor: n/a
product: Cloud Controller API CAPI-release version 1.33.0 only
Published: 2017-07-24T18:00:00.000Z
CVE-2017-8037 
In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure.
Problem types: description: Information Leak / Disclosure
Affected products: vendor: n/a
product: Cloud Foundry
Published: 2017-08-21T22:00:00.000Z
CVE-2017-8038 
In Cloud Foundry Foundation Credhub-release version 1.1.0, access control lists (ACLs) enforce whether an authenticated user can perform an operation on a credential. For installations using ACLs, the ACL was bypassed for the CredHub interpolate endpoint, allowing authenticated applications to view any credential within the CredHub installation.
Problem types: description: Credentials readable
Affected products: vendor: n/a
product: Credhub Credhub-release version 1.1.0 only
Published: 2017-11-27T10:00:00.000Z
CVE-2017-8039 
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Problem types: description: Data Binding Expression Vulnerability
Affected products: vendor: n/a
product: Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected
Published: 2017-11-27T10:00:00.000Z
CVE-2017-8040 
In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system.
Problem types: description: XXE Vulnerability
Affected products: vendor: n/a
product: PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3
Published: 2017-09-09T01:00:00.000Z
CVE-2017-8041 
In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain Single Sign-On service UI pages by inputting code in the text field for an organization name.
Problem types: description: XSS vulnerability
Affected products: vendor: n/a
product: PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3
Published: 2017-09-09T01:00:00.000Z
CVE-2017-8044 
In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks.
Problem types: description: XSS vulnerability
Affected products: vendor: n/a
product: Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3
Published: 2017-11-27T10:00:00.000Z
CVE-2017-8045 
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
Problem types: description: Remote code execution
Affected products: vendor: n/a
product: Spring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7
Published: 2017-11-27T10:00:00.000Z
CVE-2017-8046 
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Problem types: description: run arbitrary Java code
Affected products: vendor: Pivotal
product: Pivotal Spring Data REST and Spring Boot
Published: 2018-01-04T06:00:00.000Z
CVE-2017-8047 
In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain access to user credentials or other sensitive data. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.
Problem types: description: open redirect
Affected products: vendor: n/a
product: Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274
Published: 2017-10-03T07:00:00.000Z
CVE-2017-8048 
In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-8033 introduces an API regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.
Problem types: description: API regression
Affected products: vendor: n/a
product: Cloud Controller VM capi-release versions 1.33.0 and later, prior to 1.42.0, cf-release versions 268 and later, prior to 274
Published: 2017-10-03T07:00:00.000Z
CVE-2017-8050 
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T18:00:00.000Z
CVE-2017-8051 
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote attacker can inject arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T18:00:00.000Z
CVE-2017-8052 
Craft CMS before 2.6.2974 allows XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-22T01:00:00.000Z
CVE-2017-8053 
PoDoFo 0.9.5 allows denial of service (infinite recursion and stack consumption) via a crafted PDF file in PoDoFo::PdfParser::ReadDocumentStructure (PdfParser.cpp).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-22T21:00:00.000Z
CVE-2017-8054 
The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-22T22:00:00.000Z
CVE-2017-8055 
WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC agent in Fireware v11.12.1 and earlier returns different responses for valid and invalid usernames. An attacker could exploit this vulnerability to enumerate valid usernames on an affected Firebox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-22T22:00:00.000Z
CVE-2017-8056 
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new authenticated sessions until the process has recovered. The Firebox may also experience an overall degradation in performance while the wgagent process recovers. An attacker could continuously send XML-RPC requests that contain references to external entities to perform a limited Denial of Service (DoS) attack against an affected Firebox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-22T22:00:00.000Z
CVE-2017-8057 
In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-25T18:00:00.000Z
CVE-2017-8058 
Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-8059 
Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept login information (username/password), in addition to the static authentication token if the user is already logged in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-8060 
Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T07:04:00.000Z
CVE-2017-8061 
drivers/media/usb/dvb-usb/dvb-usb-firmware.c in the Linux kernel 4.9.x and 4.10.x before 4.10.7 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8062 
drivers/media/usb/dvb-usb/dw2102.c in the Linux kernel 4.9.x and 4.10.x before 4.10.4 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8063 
drivers/media/usb/dvb-usb/cxusb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8064 
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8065 
crypto/ccm.c in the Linux kernel 4.9.x and 4.10.x through 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8066 
drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8067 
drivers/char/virtio_console.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8068 
drivers/net/usb/pegasus.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8069 
drivers/net/usb/rtl8150.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8070 
drivers/net/usb/catc.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8071 
drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 uses a spinlock without considering that sleeping is possible in a USB HID request callback, which allows local users to cause a denial of service (deadlock) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8072 
The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T05:37:00.000Z
CVE-2017-8073 
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T15:00:00.000Z
CVE-2017-8074 
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T16:00:00.000Z
CVE-2017-8075 
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T16:00:00.000Z
CVE-2017-8076 
On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T16:00:00.000Z