rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-16409 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of the Adobe graphics module responsible for displaying textual data. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16410 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is a result of untrusted input that is used to calculate an array index; the calculation occurs in the image conversion module, when processing GIF files. The vulnerability leads to an operation that can write to a memory location that is outside of the memory addresses allocated for the data structure. The specific scenario leads to a write access to a memory location that does not belong to the relevant process address space.
Problem types: description: Improper Validation of Array Index
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16411 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of the WebCapture module, related to an internal hash table implementation. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Untrusted Pointer Dereference
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16412 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability occurs because of a computation that reads data that is past the end of the target buffer; the computation is part of the XPS conversion module, when handling a JPEG resource. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16413 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a computation that writes data past the end of the intended buffer; the computation is part of the XPS to PDF conversion module, when processing TIFF files. The vulnerability is a result of an out of range pointer offset that is used to access sub-elements of an internal data structure. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.
Problem types: description: Out-of-bounds Write
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16414 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is a part of the JavaScript API module responsible for form field computation. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16415 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a computation that writes data past the end of the intended buffer; the computation is a part of the functionality that handles font encodings. The vulnerability is a result of out of range pointer offset that is used to access sub-elements of an internal data structure. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.
Problem types: description: Out-of-bounds Write
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16416 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a computation that writes data past the end of the intended buffer; the computation is part of the image conversion module that handles Enhanced Metafile Format Plus (EMF+) data. The vulnerability is a result of an out of range pointer offset that is used to access sub-elements of an internal data structure. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.
Problem types: description: Out-of-bounds Write
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16417 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is a part of the font parsing module. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16418 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is a part of the image conversion module that handles XPS files. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16419 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The issue is a stack exhaustion problem within the JavaScript API, where the computation does not correctly control the amount of recursion that can happen with respect to system resources.
Problem types: description: StackExhaustion
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16420 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is in the part of the JavaScript engine that handles annotation abstraction. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Problem types: description: Out-of-bounds Read
Affected products: vendor: n/a
product: Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Published: 2017-12-09T06:00:00.000Z
CVE-2017-16510 
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-02T16:00:00.000Z
CVE-2017-16512 
The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-29T22:00:00.000Z
CVE-2017-16513 
Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations field, aka WSCLT-1729.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-03T15:00:00.000Z
CVE-2017-16514 
Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (Site Title) in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T17:00:00.000Z
CVE-2017-16516 
In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-03T00:00:00.000Z
CVE-2017-16520 
Inedo BuildMaster before 5.8.2 does not properly restrict creation of RequireManageAllPrivileges event listeners.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-11T00:00:00.000Z
CVE-2017-16521 
In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-10T09:00:00.000Z
CVE-2017-16522 
MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-03T17:00:00.000Z
CVE-2017-16523 
MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices have a zyad1234 password for the zyad1234 account, which is equivalent to root and undocumented.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-03T17:00:00.000Z
CVE-2017-16524 
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the file in the upload/ directory. To authenticate for this attack, one can obtain web-interface credentials in cleartext by leveraging the existing Local File Read Vulnerability referenced as CVE-2015-8279, which allows remote attackers to read the web-interface credentials via a request for the cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T08:00:00.000Z
CVE-2017-16525 
The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16526 
drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16527 
sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16528 
sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16529 
The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16530 
The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16531 
drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16532 
The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16533 
The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16534 
The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16535 
The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16536 
The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16537 
The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16538 
drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T01:00:00.000Z
CVE-2017-16539 
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T17:00:00.000Z
CVE-2017-16540 
OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T19:00:00.000Z
CVE-2017-16541 
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-04T18:00:00.000Z
CVE-2017-16542 
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-05T17:00:00.000Z
CVE-2017-16543 
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-05T17:00:00.000Z
CVE-2017-16544 
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-20T15:00:00.000Z
CVE-2017-16545 
The ReadWPGImage function in coders/wpg.c in GraphicsMagick 1.3.26 does not properly validate colormapped images, which allows remote attackers to cause a denial of service (ImportIndexQuantumType invalid write and application crash) or possibly have unspecified other impact via a malformed WPG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-05T22:00:00.000Z
CVE-2017-16546 
The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-05T22:00:00.000Z
CVE-2017-16547 
The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords, which allows remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T05:00:00.000Z
CVE-2017-16548 
The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T05:00:00.000Z
CVE-2017-16549 
K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z
CVE-2017-16550 
K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-16T19:00:00.000Z