rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-6458 
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2017-6459 
The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2017-6460 
Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2017-6462 
Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2017-6463 
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2017-6464 
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2017-6465 
Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP server it is connecting to; however, it doesn't check the response's length, leading to a buffer overflow situation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T01:00:00.000Z
CVE-2017-6466 
F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download. Man-in-the-middle attackers can replace the file with their own executable which will be executed under the SYSTEM account. Note that when Software Updater is configured to install updates automatically, it checks if the downloaded file is digitally signed by default, but does not check the author of the signature. When running in manual mode (default), no signature check is performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-11T06:46:00.000Z
CVE-2017-6467 
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by changing the restrictions on file size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-04T03:38:00.000Z
CVE-2017-6468 
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating the relationship between pages and records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-04T03:38:00.000Z
CVE-2017-6469 
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-ldss.c by ensuring that memory is allocated for a certain data structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-04T03:38:00.000Z
CVE-2017-6470 
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-iax2.c by constraining packet lateness.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-04T03:38:00.000Z
CVE-2017-6471 
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by validating the capability length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-04T03:38:00.000Z
CVE-2017-6472 
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rtmpt.c by properly incrementing a certain sequence value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-04T03:38:00.000Z
CVE-2017-6473 
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c by validating the relationships between lengths and offsets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-04T03:38:00.000Z
CVE-2017-6474 
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating record sizes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-04T03:38:00.000Z
CVE-2017-6478 
paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php (step parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6479 
FenixHosting/fenix-open-source before 2017-03-04 is vulnerable to a reflected XSS in forums/search.php (search-by-topic parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6480 
groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php (path parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6481 
Multiple Cross-Site Scripting (XSS) issues were discovered in phpipam 1.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages (instructions in app/admin/instructions/preview.php; subnetId in app/admin/powerDNS/refresh-ptr-records.php). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6483 
Multiple Cross-Site Scripting (XSS) issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages (lang_code in themes/*/admin/system_preferences/language_edit.tmpl.php). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6484 
Multiple Cross-Site Scripting (XSS) issues were discovered in INTER-Mediator 5.5. The vulnerabilities exist due to insufficient filtration of user-supplied data (c and cred) passed to the "INTER-Mediator-master/Auth_Support/PasswordReset/resetpassword.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6485 
A Cross-Site Scripting (XSS) issue was discovered in php-calendar before 2017-03-03. The vulnerability exists due to insufficient filtration of user-supplied data (errorMsg) passed to the "php-calendar-master/error.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6486 
A Cross-Site Scripting (XSS) issue was discovered in reasoncms before 4.7.1. The vulnerability exists due to insufficient filtration of user-supplied data (nyroModalSel) passed to the "reasoncms-master/www/nyroModal/demoSent.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6487 
Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (state, element, id, tab, cid) passed to the "EPESI-master/modules/Utils/RecordBrowser/favorites.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6488 
Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (visible, tab, cid) passed to the EPESI-master/modules/Utils/RecordBrowser/Filters/save_filters.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6489 
Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (element, state, cat, id, cid) passed to the EPESI-master/modules/Utils/Watchdog/subscribe.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6490 
Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (cid, value, element, mode, tab, form_name, id) passed to the EPESI-master/modules/Utils/RecordBrowser/grid.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6491 
Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (tooltip_id, callback, args, cid) passed to the EPESI-master/modules/Utils/Tooltip/req.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6492 
SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. The POST parameter dat_cat_id is concatenated into a SQL query without any input validation/sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-05T20:00:00.000Z
CVE-2017-6497 
An issue was discovered in ImageMagick 6.9.7. A specially crafted psd file could lead to a NULL pointer dereference (thus, a DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6498 
An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6499 
An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6500 
An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6501 
An issue was discovered in ImageMagick 6.9.7. A specially crafted xcf file could lead to a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6502 
An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus, a DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6503 
WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6504 
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-06T02:00:00.000Z
CVE-2017-6505 
The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z
CVE-2017-6506 
In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leading to remote code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka "Service ready") string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-10T10:29:00.000Z
CVE-2017-6507 
An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T06:56:00.000Z
CVE-2017-6508 
CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T08:39:00.000Z
CVE-2017-6509 
Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T16:00:00.000Z
CVE-2017-6510 
Easy File Sharing FTP Server version 3.6 is vulnerable to a directory traversal vulnerability which allows an attacker to list and download any file from any folder outside the FTP root Directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-16T14:00:00.000Z
CVE-2017-6511 
andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T19:00:00.000Z
CVE-2017-6512 
Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-01T16:00:00.000Z
CVE-2017-6513 
The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual machines managed by Virtualizor by accessing a modified URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-11T06:46:00.000Z
CVE-2017-6514 
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T17:20:03.000Z
CVE-2017-6516 
A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local attacker to gain a root shell prompt using the right combination of environment variables and command line arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T17:00:00.000Z
CVE-2017-6517 
Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge.The specific flaw exists within the handling of DLL (api-ms-win-core-winrt-string-l1-1-0.dll) loading by the Skype.exe process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2017-6518 
Cross-site scripting (XSS) vulnerability in /sanadata/seo/index.asp in SANADATA SanaCMS 7.3 allows remote attackers to inject arbitrary web script or HTML via the txtFrom parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-08T00:00:00.000Z
CVE-2017-6519 
avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive  information from the responding device via port-5353 UDP packets.  NOTE: this may overlap CVE-2015-2809.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-01T01:00:00.000Z
CVE-2017-6520 
The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-01T01:00:00.000Z
CVE-2017-6526 
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-09T19:00:00.000Z
CVE-2017-6527 
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-09T19:00:00.000Z
CVE-2017-6528 
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-09T19:00:00.000Z
CVE-2017-6529 
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-09T19:00:00.000Z
CVE-2017-6530 
Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 do not check password.shtml authorization, leading to Arbitrary password change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-20T13:00:00.000Z
CVE-2017-6531 
On Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20, the backup/restore feature lacks access control, related to ReadFile.cgi and LoadCfgFile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-20T13:00:00.000Z
CVE-2017-6532 
Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 have cleartext credentials in /mib.db.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-20T13:00:00.000Z
CVE-2017-6533 
A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (benchmark) passed to the webpagetest-master/www/benchmarks/view.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-08T08:37:00.000Z
CVE-2017-6534 
A Cross-Site Scripting (XSS) issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data (pssid) passed to the webpagetest-master/www/pss.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-08T08:37:00.000Z
CVE-2017-6535 
Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (benchmark, url) passed to the webpagetest-master/www/benchmarks/trendurl.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-08T08:37:00.000Z
CVE-2017-6536 
Multiple Cross-Site Scripting (XSS) issues were discovered in webpagetest 3.0. The vulnerabilities exist due to insufficient filtration of user-supplied data (url, pssid) passed to the webpagetest-master/www/weblite.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-08T08:37:00.000Z