rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-5125 
Heap buffer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5126 
A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Use after free
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5127 
Use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Problem types: description: Use after free
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5128 
Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, related to WebGL.
Problem types: description: Heap buffer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5129 
A use after free in WebAudio in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5130 
An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.
Problem types: description: Integer overflow
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5131 
An integer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an out-of-bounds write.
Problem types: description: Integer Overflow
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5132 
Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka incorrect WebAssembly stack manipulation.
Problem types: description: Inappropriate implementation
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5133 
Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and potentially execute code via a crafted PDF file.
Problem types: description: Out of bounds read and write
Affected products: vendor: n/a
product: Google Chrome prior to 62.0.3202.62
Published: 2018-02-07T23:00:00.000Z
CVE-2017-5135 
Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. The Technicolor (formerly Cisco) DPC3928SL with firmware D3928SL-P15-13-A386-c3420r55105-160127a could be reached by any SNMP community string from the Internet; also, you can write in the MIB because it provides write properties, aka Stringbleed. NOTE: the string-bleed/StringBleed-CVE-2017-5135 GitHub repository is not a valid reference as of 2017-04-27; it contains Trojan horse code purported to exploit this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-27T15:00:00.000Z
CVE-2017-5136 
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. The application failed to check the access control of the request which could result in an attacker being able to shutdown the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-05T18:00:00.000Z
CVE-2017-5137 
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspective.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-05T18:00:00.000Z
CVE-2017-5139 
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password.
Problem types: description: Honeywell XL Web II Controller Plaintext Storage of a Password
Affected products: vendor: n/a
product: Honeywell XL Web II Controller
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5140 
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text.
Problem types: description: Honeywell XL Web II Controller Password is stored in clear text
Affected products: vendor: n/a
product: Honeywell XL Web II Controller
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5141 
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated sessions (SESSION FIXATION).
Problem types: description: Honeywell XL Web II Controller SESSION FIXATION
Affected products: vendor: n/a
product: Honeywell XL Web II Controller
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5142 
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management.
Problem types: description: Honeywell XL Web II Controller Improper Privilege Management
Affected products: vendor: n/a
product: Honeywell XL Web II Controller
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5143 
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authenticating can make a directory traversal attack by accessing a specific URL.
Problem types: description: Honeywell XL Web II Controller directory traversal
Affected products: vendor: n/a
product: Honeywell XL Web II Controller
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5144 
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. The access control flaw allows access to most application functions without authentication.
Problem types: description: Carlo Gavazzi VMU-C EM and VMU-C PV access control flaw
Affected products: vendor: n/a
product: Carlo Gavazzi VMU-C EM and VMU-C PV
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5145 
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.
Problem types: description: Carlo Gavazzi VMU-C EM and VMU-C PV csrf
Affected products: vendor: n/a
product: Carlo Gavazzi VMU-C EM and VMU-C PV
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5146 
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Sensitive information is stored in clear-text.
Problem types: description: Carlo Gavazzi VMU-C EM and VMU-C PV clear-text storage
Affected products: vendor: n/a
product: Carlo Gavazzi VMU-C EM and VMU-C PV
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5147 
An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1. An uncontrolled search path element vulnerability has been identified, which may execute malicious DLL files that have been placed within the search path.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: n/a
product: AzeoTech DAQFactory
Published: 2017-09-09T01:00:00.000Z
CVE-2017-5149 
An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability). The identities of the endpoints for the communication channel between the transmitter and St. Jude Medical's web site, Merlin.net, are not verified. This may allow a man-in-the-middle attacker to access or influence communications between the identified endpoints.
Problem types: description: St. Jude Merlin@home Transmitter Vulnerability MITM
Affected products: vendor: n/a
product: St. Jude Merlin@home Transmitter before 8.2.2
Published: 2017-02-13T22:00:00.000Z
CVE-2017-5151 
An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow remote code execution.
Problem types: description: VideoInsight Web Client SQL Injection
Affected products: vendor: n/a
product: VideoInsight Web Client 6.3.5.11 and previous
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5152 
An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access pages unrestricted (AUTHENTICATION BYPASS).
Problem types: description: Advantech WebAccess AUTHENTICATION BYPASS
Affected products: vendor: n/a
product: Advantech WebAccess 8.1
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5153 
An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords to become exposed for the affected services, potentially leading to unauthorized shutdown of the affected PI services as well as potential reuse of domain credentials.
Problem types: description: OSIsoft PI Coresight and PI Web API information exposure
Affected products: vendor: n/a
product: OSIsoft PI Coresight and PI Web API
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5154 
An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to the WebAccess software. Successful attack could result in administrative access to the application and its data files.
Problem types: description: Advantech WebAccess SQL injection
Affected products: vendor: n/a
product: Advantech WebAccess 8.1
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5155 
An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, which can allow a malicious entity to compromise Historian databases. In some installation scenarios, resources beyond those created by Wonderware Historian may be compromised as well.
Problem types: description: Schneider Electric Wonderware Historian default passwords
Affected products: vendor: n/a
product: Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5156 
A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: n/a
product: Schneider Electric Wonderware InTouch Access Anywhere
Published: 2017-04-20T19:00:00.000Z
CVE-2017-5157 
An issue was discovered in Schneider Electric homeLYnk Controller, LSS100100, all versions prior to V1.5.0. The homeLYnk controller is susceptible to a cross-site scripting attack. User inputs can be manipulated to cause execution of JavaScript code.
Problem types: description: Schneider Electric homeLYnk Controller XSS
Affected products: vendor: n/a
product: Schneider Electric homeLYnk Controller prior to V1.5.0
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5158 
An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified.
Problem types: description: Information Exposure
Affected products: vendor: n/a
product: Schneider Electric Wonderware InTouch Access Anywhere
Published: 2017-04-20T19:00:00.000Z
CVE-2017-5159 
An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value.
Problem types: description: Phoenix Contact mGuard default admin password
Affected products: vendor: n/a
product: Phoenix Contact mGuard 8.4.0
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5160 
An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The software will connect via Transport Layer Security without verifying the peer's SSL certificate properly.
Problem types: description: Inadequate Encryption Strength
Affected products: vendor: n/a
product: Schneider Electric Wonderware InTouch Access Anywhere
Published: 2017-04-20T19:00:00.000Z
CVE-2017-5161 
An issue was discovered in Sielco Sistemi Winlog Lite SCADA Software, versions prior to Version 3.02.01, and Winlog Pro SCADA Software, versions prior to Version 3.02.01. An uncontrolled search path element (DLL Hijacking) vulnerability has been identified. Exploitation of this vulnerability could give an attacker access to the system with the same level of privilege as the application that utilizes the malicious DLL.
Problem types: description: Sielco Sistemi Winlog SCADA Software DLL Hijacking
Affected products: vendor: n/a
product: Sielco Sistemi Winlog SCADA Software prior to Version 3.02.01
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5162 
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for remote service gives access to application set up and configuration.
Problem types: description: BINOM3 Electric Power Quality Meter Lack of authentication
Affected products: vendor: n/a
product: BINOM3 Electric Power Quality Meter
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5163 
An issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. After an administrator downloads a configuration file, a copy of the configuration file, which includes hashes of user passwords, is saved to a location that is accessible without authentication by path traversal.
Problem types: description: Belden Hirschmann GECKO path traversal
Affected products: vendor: n/a
product: Belden Hirschmann GECKO 2.0.00 and prior
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5164 
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Input sent from a malicious client is not properly verified by the server. An attacker can execute arbitrary script code in another user's browser session (CROSS-SITE SCRIPTING).
Problem types: description: BINOM3 Electric Power Quality Meter XSS
Affected products: vendor: n/a
product: BINOM3 Electric Power Quality Meter
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5165 
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. There is no CSRF Token generated per page and/or per (sensitive) function. Successful exploitation of this vulnerability can allow silent execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.
Problem types: description: BINOM3 Electric Power Quality Meter csrf
Affected products: vendor: n/a
product: BINOM3 Electric Power Quality Meter
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5166 
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. An INFORMATION EXPOSURE flaw can be used to gain privileged access to the device.
Problem types: description: BINOM3 Electric Power Quality Meter INFORMATION EXPOSURE
Affected products: vendor: n/a
product: BINOM3 Electric Power Quality Meter
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5167 
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users do not have any option to change their own passwords.
Problem types: description: BINOM3 Electric Power Quality Meter hardcoded passwords
Affected products: vendor: n/a
product: BINOM3 Electric Power Quality Meter
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5168 
An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a malicious page, an attacker can gain access to arbitrary files on the server. Smart Security Manager Versions 1.4 and prior to 1.31 are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.
Problem types: description: Hanwha Techwin Smart Security Manager Path Traversal
Affected products: vendor: n/a
product: Hanwha Techwin Smart Security Manager Versions 1.5 and prior
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5169 
An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Post requests, an attacker can gain system level access to a remote shell session. Smart Security Manager Versions 1.5 and prior are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.
Problem types: description: Hanwha Techwin Smart Security Manager Cross Site Request Forgery
Affected products: vendor: n/a
product: Hanwha Techwin Smart Security Manager 1.5 and prior
Published: 2017-02-13T21:00:00.000Z
CVE-2017-5170 
An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path element (DLL Hijacking) vulnerability has been identified. To exploit this vulnerability, an attacker could rename a malicious DLL to meet the criteria of the application, and the application would not verify that the DLL is correct. The attacker needs to have administrative access to the default install location in order to plant the insecure DLL. Once loaded by the application, the DLL could run malicious code at the privilege level of the application.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: n/a
product: Moxa SoftNVR-IA Live Viewer
Published: 2018-01-18T19:00:00.000Z
CVE-2017-5173 
An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An improper neutralization of special elements vulnerability has been identified. If special elements are not properly neutralized, an attacker can call multiple parameters that can allow access to the root level operating system which could allow remote code execution.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Geutebruck IP Cameras
Published: 2017-05-19T02:43:00.000Z
CVE-2017-5174 
An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.
Problem types: cwe_id: CWE-288
description: CWE-288
Affected products: vendor: n/a
product: Geutebruck IP Cameras
Published: 2017-05-19T02:43:00.000Z
CVE-2017-5175 
Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Affected products: vendor: ICS-CERT
product: Advantech WebAccess Versions 8.1 and prior.
Published: 2018-05-09T19:00:00.000Z
CVE-2017-5176 
A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench (CCW). The following versions are affected: Connected Components Workbench - Developer Edition, v9.01.00 and earlier: 9328-CCWDEVENE, 9328-CCWDEVZHE, 9328-CCWDEVFRE, 9328-CCWDEVITE, 9328-CCWDEVDEE, 9328-CCWDEVESE, and 9328-CCWDEVPTE; and Connected Components Workbench - Free Standard Edition (All Supported Languages), v9.01.00 and earlier. Certain DLLs included with versions of CCW software can be potentially hijacked to allow an attacker to gain rights to a victim's affected personal computer. Such access rights can be at the same or potentially higher level of privileges as the compromised user account, including and up to computer administrator privileges.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: n/a
product: Rockwell Automation Connected Components Workbench
Published: 2017-05-19T02:43:00.000Z
CVE-2017-5177 
A Stack Buffer Overflow issue was discovered in VIPA Controls WinPLC7 5.0.45.5921 and prior. A stack-based buffer overflow vulnerability has been identified, where an attacker with a specially crafted packet could overflow the fixed length buffer. This could allow remote code execution.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: VIPA Controls WinPLC7
Published: 2017-05-19T02:43:00.000Z
CVE-2017-5178 
An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system account that is installed by default. The default system account is difficult to configure with non-default credentials after installation, and changing the default credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated security (Active Directory), the software is not vulnerable. However, when Tableau Server is used with local authentication mode, the software is vulnerable. The default system account could be used to gain unauthorized access.
Problem types: description: default system account
Affected products: vendor: n/a
product: Schneider Electric Wonderware Intelligence 2014R3 and prior
Published: 2017-03-08T08:37:00.000Z
CVE-2017-5179 
Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-05T22:00:00.000Z
CVE-2017-5180 
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T18:00:00.000Z