rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-18534 
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T11:47:47.000Z
CVE-2017-18535 
The smokesignal plugin before 1.2.7 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:15:11.000Z
CVE-2017-18536 
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T11:40:37.000Z
CVE-2017-18537 
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T11:55:02.000Z
CVE-2017-18538 
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T11:56:13.000Z
CVE-2017-18539 
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T11:57:30.000Z
CVE-2017-18540 
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T11:59:06.000Z
CVE-2017-18541 
The xo-security plugin before 1.5.3 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:23:02.000Z
CVE-2017-18542 
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:22:32.000Z
CVE-2017-18543 
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:17:56.000Z
CVE-2017-18544 
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:17:16.000Z
CVE-2017-18545 
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:16:41.000Z
CVE-2017-18546 
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:16:02.000Z
CVE-2017-18547 
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T20:14:10.000Z
CVE-2017-18548 
The note-press plugin before 0.1.2 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T13:42:38.000Z
CVE-2017-18549 
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send_raw_srb does not initialize the reply structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-19T01:51:54.000Z
CVE-2017-18550 
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-19T01:51:40.000Z
CVE-2017-18551 
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-19T01:51:01.000Z
CVE-2017-18552 
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-19T01:50:43.000Z
CVE-2017-18553 
The ad-buttons plugin before 2.3.2 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:48:18.000Z
CVE-2017-18554 
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:49:31.000Z
CVE-2017-18555 
The booking-sms plugin before 1.1.0 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:50:39.000Z
CVE-2017-18556 
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:51:55.000Z
CVE-2017-18557 
The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:53:03.000Z
CVE-2017-18558 
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:54:24.000Z
CVE-2017-18559 
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:12:14.000Z
CVE-2017-18560 
The content-audit plugin before 1.9.2 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:55:29.000Z
CVE-2017-18561 
The embed-comment-images plugin before 0.6 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:07:02.000Z
CVE-2017-18562 
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T18:06:27.000Z
CVE-2017-18563 
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T17:20:04.000Z
CVE-2017-18564 
The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T17:19:19.000Z
CVE-2017-18565 
The updater plugin before 1.35 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-21T12:36:06.000Z
CVE-2017-18566 
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T15:02:14.000Z
CVE-2017-18567 
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T15:00:32.000Z
CVE-2017-18568 
The my-wp-translate plugin before 1.0.4 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T14:54:17.000Z
CVE-2017-18569 
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-20T14:53:21.000Z
CVE-2017-18570 
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T12:13:05.000Z
CVE-2017-18571 
The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T12:19:28.000Z
CVE-2017-18572 
The gnucommerce plugin before 1.4.2 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T12:31:50.000Z
CVE-2017-18573 
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T12:34:58.000Z
CVE-2017-18574 
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T12:42:15.000Z
CVE-2017-18575 
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T12:59:44.000Z
CVE-2017-18576 
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:03:20.000Z
CVE-2017-18577 
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:08:09.000Z
CVE-2017-18578 
The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T19:43:12.000Z
CVE-2017-18579 
The corner-ad plugin before 1.0.8 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T19:42:32.000Z
CVE-2017-18580 
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:32:55.000Z
CVE-2017-18581 
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:35:13.000Z
CVE-2017-18582 
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:35:51.000Z
CVE-2017-18583 
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:42:35.000Z
CVE-2017-18584 
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:43:39.000Z
CVE-2017-18585 
The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T19:37:36.000Z
CVE-2017-18586 
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T18:50:08.000Z
CVE-2017-18587 
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T12:05:05.000Z
CVE-2017-18588 
An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T17:18:39.000Z
CVE-2017-18589 
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T17:14:55.000Z
CVE-2017-18590 
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:52:56.000Z
CVE-2017-18591 
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T12:03:27.000Z
CVE-2017-18592 
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T12:07:17.000Z
CVE-2017-18593 
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-28T11:18:17.000Z
CVE-2017-18594 
nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-28T23:50:22.000Z
CVE-2017-18595 
An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-04T20:33:56.000Z
CVE-2017-18596 
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T10:55:02.000Z
CVE-2017-18597 
The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T10:56:56.000Z
CVE-2017-18598 
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T10:58:20.000Z
CVE-2017-18599 
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T10:59:53.000Z
CVE-2017-18600 
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:01:21.000Z
CVE-2017-18601 
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:04:01.000Z
CVE-2017-18602 
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:05:06.000Z
CVE-2017-18603 
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:06:49.000Z
CVE-2017-18604 
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:08:36.000Z
CVE-2017-18605 
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:16:21.000Z
CVE-2017-18606 
The avada theme before 5.1.5 for WordPress has stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:17:26.000Z
CVE-2017-18607 
The avada theme before 5.1.5 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:18:24.000Z
CVE-2017-18608 
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:19:29.000Z
CVE-2017-18609 
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:21:24.000Z
CVE-2017-18610 
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:23:49.000Z
CVE-2017-18611 
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-10T11:28:35.000Z
CVE-2017-18612 
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-13T11:40:46.000Z
CVE-2017-18613 
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-13T11:42:42.000Z
CVE-2017-18614 
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-13T11:44:07.000Z
CVE-2017-18615 
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-13T11:45:13.000Z
CVE-2017-18634 
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-16T11:18:24.000Z
CVE-2017-18635 
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-25T22:59:16.000Z
CVE-2017-18636 
CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-30T12:35:52.000Z
CVE-2017-18638 
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T22:01:28.000Z
CVE-2017-18639 
Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title, /Content/Images/LibraryImages/newsimages Parameter : Image Title, /Content/links Parameter : Link Title, /Content/links Parameter : Link Title, or /Content/Videos/LibraryVideos/default-video-library Parameter : Video Title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T15:07:40.000Z
CVE-2017-18640 
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-12T00:00:00.000Z
CVE-2017-18641 
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T00:30:50.000Z
CVE-2017-18642 
Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and replay attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T20:40:11.000Z
CVE-2017-18643 
An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. There is information disclosure of the kbase_context address of a GPU memory node. The Samsung ID is SVE-2017-8907 (December 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T13:12:45.000Z
CVE-2017-18644 
An issue was discovered on Samsung mobile devices with L(5.1), M(6.x), and N(7.x) software. There is a muic_set_reg_sel heap-based buffer overflow during the reading of MUIC register values. The Samsung ID is SVE-2017-10011 (December 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T13:08:19.000Z
CVE-2017-18645 
An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) (Qualcomm chipsets) software. There is a panel_lpm sysfs stack-based buffer overflow. The Samsung ID is SVE-2017-9414 (December 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T13:04:28.000Z
CVE-2017-18646 
An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. An attacker can bypass the password requirement for tablet user switching by folding the magnetic cover. The Samsung ID is SVE-2017-10602 (December 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T12:59:43.000Z
CVE-2017-18647 
An issue was discovered on Samsung mobile devices with M(6,x) and N(7.0) software. The TA Scrypto v1.0 implementation in Secure Driver has a race condition with a resultant buffer overflow. The Samsung IDs are SVE-2017-8973, SVE-2017-8974, and SVE-2017-8975 (November 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T15:58:20.000Z
CVE-2017-18648 
An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) software. Arbitrary file read/write operations can occur in the locked state via a crafted MTP command. The Samsung ID is SVE-2017-10086 (November 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T15:56:17.000Z
CVE-2017-18649 
An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can boot a device with root privileges because the bootloader for the Qualcomm MSM8998 chipset lacks an integrity check of the system image, aka the "SamFAIL" issue. The Samsung ID is SVE-2017-10465 (November 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T15:54:28.000Z
CVE-2017-18650 
An issue was discovered on Samsung mobile devices with N(7.x) software. There is a WifiStateMachine IllegalArgumentException and reboot if a malformed wpa_supplicant.conf is read. The Samsung ID is SVE-2017-9828 (October 2017).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T15:53:07.000Z