rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-17621 
Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17622 
Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17623 
Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17624 
PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat or chid1 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17625 
Professional Service Script 1.0 has SQL Injection via the service-list city parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17626 
Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17627 
Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17628 
Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17629 
Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17630 
Yoga Class Script 1.0 has SQL Injection via the /list city parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17631 
Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17632 
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17633 
Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17634 
Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17635 
MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17636 
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17637 
Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17638 
Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17639 
Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17640 
Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17641 
Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17642 
Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T09:00:00.000Z
CVE-2017-17643 
FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T09:00:00.000Z
CVE-2017-17645 
Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T09:00:00.000Z
CVE-2017-17648 
Entrepreneur Dating Script 2.0.1 has SQL Injection via the search_result.php marital, gender, country, or profileid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T16:00:00.000Z
CVE-2017-17649 
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T09:00:00.000Z
CVE-2017-17651 
Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-18T09:00:00.000Z
CVE-2017-17652 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Count method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4238.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17653 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupOptionSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4286.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17654 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup ClientList method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4287.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17655 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup PluginList method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4289.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17656 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup JobList method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4292.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17657 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup TimeRange method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4294.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17658 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobDefinitions Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4316.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17659 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobHistory Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4906.
Problem types: cwe_id: CWE-89
description: CWE-89-Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Quest
product: Quest NetVault Backup
Published: 2018-02-08T18:00:00.000Z
CVE-2017-17662 
Directory traversal in the HTTP server on Yawcam 0.2.6 through 0.6.0 devices allows attackers to read arbitrary files through a sequence of the form '.x./' or '....\x/' where x is a pattern composed of one or more (zero or more for the second pattern) of either \ or ..\ -- for example a '.\./', '....\/' or '...\./' sequence. For files with no extension, a single dot needs to be appended to ensure the HTTP server does not alter the request, e.g., a "GET /.\./.\./.\./.\./.\./.\./.\./windows/system32/drivers/etc/hosts." request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-10T18:00:00.000Z
CVE-2017-17663 
The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T17:00:00.000Z
CVE-2017-17664 
A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T20:00:00.000Z
CVE-2017-17665 
In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T20:00:00.000Z
CVE-2017-17668 
Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T14:00:00.000Z
CVE-2017-17669 
There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-13T00:00:00.000Z
CVE-2017-17670 
In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T09:00:00.000Z
CVE-2017-17671 
vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-14T00:00:00.000Z
CVE-2017-17672 
In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-14T00:00:00.000Z
CVE-2017-17674 
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-19T13:10:53.000Z
CVE-2017-17675 
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-19T13:11:13.000Z
CVE-2017-17677 
BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-19T13:11:22.000Z
CVE-2017-17678 
BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-19T13:11:01.000Z
CVE-2017-17680 
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of service via a crafted xpm image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-14T06:00:00.000Z
CVE-2017-17681 
In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted psd image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-14T06:00:00.000Z
CVE-2017-17682 
In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted wpg image file that triggers a ReadWPGImage call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-14T06:00:00.000Z
CVE-2017-17683 
Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-14T06:00:00.000Z
CVE-2017-17684 
Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-14T06:00:00.000Z
CVE-2017-17688 
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-16T19:00:00.000Z
CVE-2017-17689 
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-16T19:00:00.000Z
CVE-2017-17691 
Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client instances, which allows remote attackers to obtain sensitive information via a man in the middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-07T22:00:00.000Z
CVE-2017-17692 
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T19:00:00.000Z
CVE-2017-17693 
Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T09:00:00.000Z
CVE-2017-17694 
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T09:00:00.000Z
CVE-2017-17695 
Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T09:00:00.000Z
CVE-2017-17696 
Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T09:00:00.000Z
CVE-2017-17697 
The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T09:00:00.000Z
CVE-2017-17698 
Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T19:00:00.000Z
CVE-2017-17699 
K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T20:00:00.000Z
CVE-2017-17700 
K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T20:00:00.000Z
CVE-2017-17701 
K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-15T20:00:00.000Z
CVE-2017-17703 
Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-04T01:00:00.000Z
CVE-2017-17704 
A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-31T02:00:00.000Z