yahoo-inc/cve-impacts huggingface dataset:
CVE-2017-5667: The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.
Key phrases: execute arbitrary code, denial of service (out-of-bounds heap access and crash), cause a denial of service (out-
CVE-2017-5668: bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.
Key phrases: execute arbitrary code, denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.
Key phrases: bypass a protection, consequently bypass, map page zero
CVE-2017-5670: Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate attackers to obtain sensitive information by reading raw disk blocks.
Key phrases: obtain sensitive information, secure vault, raw disk blocks
CVE-2017-5671: Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriting the /etc/shadow file.
Key phrases: obtain root privileges, conduct a BusyBox jailbreak attack and obtain root, busybox jailbreak
CVE-2017-5672: Kony Enterprise Mobile Management (EMM) before 4.2.5.2 has the vulnerability of disclosing the private key in clear-text when changing the parameters of the request.
Key phrases: clear-text
CVE-2017-5673: In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject (aka topic subject) accepts JavaScript, leading to XSS. Six files are affected: crypsis/layouts/message/item/default.php, crypsis/layouts/message/item/top/default.php, crypsis/layouts/message/item/bottom/default.php, crypsisb3/layouts/message/item/default.php, crypsisb3/layouts/message/item/top/default.php, and crypsisb3/layouts/message/item/bottom/default.php. This is fixed in 5.0.5.
Key phrases: xss
CVE-2017-5674: A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\\\\n\\\\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.
Key phrases: craft a malformed HTTP ("GET system.ini
CVE-2017-5675: A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will be executed with root privileges.
Key phrases: inject a command into the receiver1 field in, command-injection, command injection, root privilege
CVE-2017-5677: PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression.
Key phrases: remote code execution, php object injection
CVE-2017-5681: The RSA-CRT implementation in the Intel QuickAssist Technology (QAT) Engine for OpenSSL versions prior to 0.5.19 may allow remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.
Key phrases: obtain private RSA keys by conducting a Lenstra, lenstra side-channel
CVE-2017-5682: Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives, Intel Math Kernel Library, Intel Data Analytics Acceleration Library, and Intel Threading Building Blocks before 2017 Update 2 allows an attacker to launch a process with escalated privileges.
Key phrases: launch a process with escalated privileges, escalate privilege
CVE-2017-5683: Privilege escalation in IntelHAXM.sys driver in the Intel Hardware Accelerated Execution Manager before version 6.0.6 allows a local user to gain system level access.
Key phrases: gain system level access, privilege escalation
CVE-2017-5684: The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system to gain access to personal information.
Key phrases: gain access, the system to gain access to personal information, physical access
CVE-2017-5685: The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system to gain access to personal information.
Key phrases: gain access, the system to gain access to personal information, physical access
CVE-2017-5686: The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system to gain access to personal information.
Key phrases: gain access, the system to gain access to personal information, physical access
CVE-2017-5688: There is an escalation of privilege vulnerability in the Intel Solid State Drive Toolbox versions before 3.4.5 which allow a local administrative attacker to load and execute arbitrary code.
Key phrases: execute arbitrary code, load and execute arbitrary code, escalation of privilege, escalation privilege
CVE-2017-5689: An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
Key phrases: gain system privileges
CVE-2017-5691: Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state.
Key phrases: impact SGX security via incorrect early system state, compromised system firmware, sgx security
CVE-2017-5692: Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local users to perform a denial of service attack.
Key phrases: perform a denial of service attack, out-of-bounds read condition, out of bounds read
CVE-2017-5693: Firmware in the Intel Puma 5, 6, and 7 Series might experience resource depletion or timeout, which allows a network attacker to create a denial of service via crafted network traffic.
Key phrases: create a denial of service via crafted network, resource depletion, timeout
CVE-2017-5694: Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P, PSF109P allows local users to cause a denial of service via unspecified vectors.
Key phrases: cause a denial of service via unspecified vectors, data corruption
CVE-2017-5695: Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware versions LSBG200, LSF031C, LSF036C, LBF010C, LSBG100, LSF031C, LSF036C, LBF010C, LSF031P, LSF036P, LBF010P, LSF031P, LSF036P, LBF010P, LSMG200, LSF031E, LSF036E, LSMG100, LSF031E, LSF036E, LSDG200, LSF031D, LSF036D allows local users to cause a denial of service via unspecified vectors.
Key phrases: cause a denial of service via unspecified vectors, data corruption
CVE-2017-5696: Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access.
Key phrases: elevate privileges via local access, untrusted search path
CVE-2017-5697: Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 11.6.25.1129 potentially allowing a remote attacker to hijack users web clicks via attacker's crafted web page.
Key phrases: hijack users web clicks via attacker's crafted
CVE-2017-5698: Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollback will not prevent upgrading to firmware version 11.6.x.1xxx which is vulnerable to CVE-2017-5689 and can be performed by a local user with administrative privileges.
CVE-2017-5699: Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs.
Key phrases: cause denial of service via UEFI APIs, input validation error
CVE-2017-5700: Insufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to bypass Administrator and User passwords via access to password storage.
Key phrases: bypass Administrator and User passwords via access to password storage, insufficient protection of password storage
CVE-2017-5701: Insecure platform configuration in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows an attacker with physical presence to run arbitrary code via unauthorized firmware modification during BIOS Recovery.
Key phrases: run arbitrary code, run arbitrary code via unauthorized firmware modification during, insecure platform configuration
CVE-2017-5703: Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.
Key phrases: alter the behavior of the SPI flash potentially, denial of service
CVE-2017-5704: Platform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7th Gen Intel Core Processor potentially exposes password information in memory to a local attacker with administrative privileges.
CVE-2017-5705: Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.
Key phrases: execute arbitrary code, the system to execute arbitrary code, buffer overflows
CVE-2017-5706: Multiple buffer overflows in kernel in Intel Server Platform Services Firmware 4.0 allow attacker with local access to the system to execute arbitrary code.
Key phrases: execute arbitrary code, the system to execute arbitrary code, buffer overflows
CVE-2017-5707: Multiple buffer overflows in kernel in Intel Trusted Execution Engine Firmware 3.0 allow attacker with local access to the system to execute arbitrary code.
Key phrases: execute arbitrary code, the system to execute arbitrary code, buffer overflows
CVE-2017-5708: Multiple privilege escalations in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow unauthorized process to access privileged content via unspecified vector.
Key phrases: access privileged content via unspecified vector, privilege escalations
CVE-2017-5709: Multiple privilege escalations in kernel in Intel Server Platform Services Firmware 4.0 allows unauthorized process to access privileged content via unspecified vector.
Key phrases: access privileged content via unspecified vector, privilege escalations
CVE-2017-5710: Multiple privilege escalations in kernel in Intel Trusted Execution Engine Firmware 3.0 allows unauthorized process to access privileged content via unspecified vector.
Key phrases: access privileged content via unspecified vector, privilege escalations
CVE-2017-5711: Multiple buffer overflows in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code with AMT execution privilege.
Key phrases: execute arbitrary code, the system to execute arbitrary code with AMT, buffer overflows
CVE-2017-5712: Buffer overflow in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allows attacker with remote Admin access to the system to execute arbitrary code with AMT execution privilege.
Key phrases: execute arbitrary code, the system to execute arbitrary code with AMT, buffer overflow
CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
Key phrases: an attacker with local user access via a, unauthorized disclosure, side-channel analysis
CVE-2017-5717: Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileges via local access.
Key phrases: elevate privileges via local access, type confusion
CVE-2017-5719: A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a local user.
Key phrases: remotely execute code as a local user
CVE-2017-5721: Insufficient input validation in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to execute arbitrary code via manipulation of memory.
Key phrases: execute arbitrary code, execute arbitrary code via manipulation of memory, insufficient input validation
CVE-2017-5722: Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows attackers with local or physical access to bypass enforcement of integrity protections via manipulation of firmware storage.
Key phrases: bypass enforcement of integrity protections, bypass enforcement of integrity protections via manipulation of, physical access, manipulation of firmware storage
CVE-2017-5727: Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to elevate privileges via local access.
Key phrases: elevate privileges via local access, pointer dereference
CVE-2017-5729: Frame replay vulnerability in Wi-Fi subsystem in Intel Dual-Band and Tri-Band Wireless-AC Products allows remote attacker to replay frames via channel-based man-in-the-middle.
Key phrases: replay frames via channel-based man-, frame replay, man in the middle
CVE-2017-5731: Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Key phrases: potentially enable an escalation of privilege via local, local access, escalation privilege
CVE-2017-5736: An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code as administrator.
Key phrases: execute arbitrary code, execute arbitrary code as administrator, elevation of privilege, elevation privilege
CVE-2017-5738: Escalation of privilege vulnerability in admin portal for Intel Unite App versions 3.1.32.12, 3.1.41.18 and 3.1.45.26 allows an attacker with network access to cause a denial of service and/or information disclosure.
Key phrases: cause a denial of service and/or information disclosure, escalation of privilege, escalation privilege
CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
Key phrases: an attacker with local user access via a, unauthorized disclosure, side-channel analysis
CVE-2017-5754: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Key phrases: an attacker with local user access via a, unauthorized disclosure, side-channel analysis
CVE-2017-5780: A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Key phrases: remote clickjacking
CVE-2017-5781: A CSRF vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Key phrases: csrf
CVE-2017-5782: A missing HSTS Header vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Key phrases: hsts header
CVE-2017-5783: A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Key phrases: remote clickjacking
CVE-2017-5784: A missing HSTS Header vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Key phrases: hsts header
CVE-2017-5785: A remote information disclosure vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Key phrases: remote information disclosure
CVE-2017-5786: A local Unauthorized Data Modification vulnerability in HPE OfficeConnect Network Switches version PT.02.01 including PT.01.03 through PT.01.14
Key phrases: unauthorized data modification
CVE-2017-5787: A remote denial of service vulnerability in HPE Version Control Repository Manager (VCRM) in all versions prior to 7.6 was found.
Key phrases: remote denial of service
CVE-2017-5788: A Local Disclosure of Sensitive Information vulnerability in HPE NonStop Software Essentials version T0894 T0894H02 through T0894H02^AAI was found.
Key phrases: local disclosure of sensitive information
CVE-2017-5789: HPE LoadRunner before 12.53 Patch 4 and HPE Performance Center before 12.53 Patch 4 allow remote attackers to execute arbitrary code via unspecified vectors. At least in LoadRunner, this is a libxdrutil.dll mxdr_string heap-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, heap-based buffer overflow, heap based buffer overflow
CVE-2017-5790: A remote deserialization of untrusted data vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found.
Key phrases: remote deserialization, deserialization of untrusted data
CVE-2017-5791: The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI.
Key phrases: bypass of authentication, remote bypass, remote bypass of authentication via unspecified strings in, bypass authentication
CVE-2017-5792: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
Key phrases: remote code execution
CVE-2017-5793: A Remote Arbitrary Code Execution vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found.
Key phrases: remote arbitrary code execution
CVE-2017-5794: A Remote Arbitrary File Download vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found.
Key phrases: remote arbitrary file download
CVE-2017-5795: A Local Arbitrary File Download vulnerability in HPE Intelligent Management Center (IMC) version PLAT 7.2 E0403P06 was found.
Key phrases: local arbitrary file download
CVE-2017-5796: A Remote Cross Site Request Forgery (CSRF) vulnerability in HPE 2620 Series Network Switches version RA.15.05.0006 was found.
Key phrases: remote cross site request forgery (csrf)
CVE-2017-5797: A Remote Unauthenticated Disclosure of Information vulnerability in HPE Intelligent Management Center (IMC) SOM version v7.3 (E0501) was found.
Key phrases: remote unauthenticated disclosure
CVE-2017-5798: A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3.x), all versions prior to 4.4.7 RP702 (for OCMP 4.x).
Key phrases: remote code execution, ocmp versions prior to
CVE-2017-5799: A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3.x), all versions prior to 4.4.7 RP702 (for OCMP 4.x).
Key phrases: remote code execution, ocmp versions prior to
CVE-2017-5800: A Remote Cross-Site Scripting (XSS) vulnerability in HPE Operations Bridge Analytics version v3.0 was found.
Key phrases: remote cross-site scripting (xss)
CVE-2017-5801: A Remote Unauthorized Access to Data vulnerability in HPE Business Process Monitor version v09.2x, v09.30 was found.
Key phrases: remote unauthorized access to data
CVE-2017-5802: A Remote Gain Privileged Access vulnerability in HPE Vertica Analytics Platform version v4.1 and later was found.
Key phrases: Gain Privileged, remote gain privileged access
CVE-2017-5803: A Remote Disclosure of Information vulnerability in HPE NonStop Servers using SSH Service version L series: T0801L02 through T0801L02^ABX; J and H series: T0801H01 through T0801H01^ACA was found.
Key phrases: remote disclosure
CVE-2017-5804: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.2 was found.
Key phrases: remote code execution
CVE-2017-5805: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.2 was found.
Key phrases: remote code execution
CVE-2017-5806: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.2 was found.
Key phrases: remote code execution
CVE-2017-5807: A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Key phrases: remote arbitrary code execution
CVE-2017-5808: A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Key phrases: remote arbitrary code execution
CVE-2017-5809: A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Key phrases: remote arbitrary code execution
CVE-2017-5810: A remote sql injection vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Key phrases: remote sql injection
CVE-2017-5811: A remote code execution vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Key phrases: remote code execution
CVE-2017-5812: A remote sql information disclosure vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Key phrases: remote sql information disclosure
CVE-2017-5813: A remote unauthenticated access vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Key phrases: remote unauthenticated access
CVE-2017-5814: A remote sql injection authentication bypass in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Key phrases: bypass in HPE Network Automation version 9.1x, 9.2x, authentication bypass, remote sql injection authentication bypass
CVE-2017-5815: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5816: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5817: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5818: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5819: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5820: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5821: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5822: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5823: A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Key phrases: remote code execution
CVE-2017-5824: An unauthenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Key phrases: remote code execution
CVE-2017-5825: A privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Key phrases: privilege escalation
CVE-2017-5826: An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Key phrases: remote code execution
CVE-2017-5827: A reflected cross site scripting vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Key phrases: cross site scripting
CVE-2017-5828: An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Key phrases: arbitrary command execution, arbitrary commands
CVE-2017-5829: An access restriction bypass vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Key phrases: access restriction bypass
CVE-2017-5830: Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.
Key phrases: execute arbitrary code, execute arbitrary code via serialized data in the
CVE-2017-5831: Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID.
Key phrases: hijack web sessions via the session ID, session fixation
CVE-2017-5832: Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2017-5833: Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2017-5834: The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.
Key phrases: denial of service (out-of-bounds heap read and crash), cause a denial of service (out-, out of bounds heap read
CVE-2017-5835: libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
Key phrases: denial of service (large memory allocation and crash), cause a denial of service (large memory
CVE-2017-5836: The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
Key phrases: denial of service (crash), cause a denial of service (crash), invalid free
CVE-2017-5837: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file.
Key phrases: denial of service (floating point exception and crash), cause a denial of service (floating point
CVE-2017-5838: The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string.
Key phrases: denial of service (out-of-bounds heap read), cause a denial of service (out-, malformed datetime string, out of bounds heap read
CVE-2017-5839: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.
Key phrases: denial of service (stack overflow and crash), cause a denial of service (stack overflow, vectors involving nested waveformatex
CVE-2017-5840: The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.
Key phrases: denial of service (out-of-bounds heap read), cause a denial of service (out-, vectors involving the current stts index, out of bounds heap read
CVE-2017-5841: The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.
Key phrases: denial of service (out-of-bounds heap read), cause a denial of service (out-, vectors involving ncdt tags, out of bounds heap read
CVE-2017-5842: The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNote_Manager.smi.
Key phrases: denial of service (out-of-bounds write), cause a denial of service (out-, out of bounds write
CVE-2017-5843: Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf.
Key phrases: denial of service (crash), cause a denial of service (crash), multiple use-after-free, gst_tag_list_unref, vectors involving stream tags, use after free
CVE-2017-5844: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file.
Key phrases: denial of service (floating point exception and crash), cause a denial of service (floating point
CVE-2017-5845: The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.
Key phrases: denial of service (invalid memory read and crash), cause a denial of service (invalid memory
CVE-2017-5846: The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.
Key phrases: denial of service (invalid memory read and crash), cause a denial of service (invalid memory
CVE-2017-5847: The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
Key phrases: denial of service (out-of-bounds heap read), cause a denial of service (out-, vectors involving extended content descriptors, out of bounds heap read
CVE-2017-5848: The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing.
Key phrases: denial of service (invalid memory read and crash), cause a denial of service (invalid memory, vectors involving psm parsing
CVE-2017-5849: tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
Key phrases: denial of service (out-of-bounds read and write), cause a denial of service (out-, out of bounds read
CVE-2017-5850: httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption
CVE-2017-5851: The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.  NOTE: this typically has no risk; this crash of this command-line program has no further consequences for availability.
Key phrases: denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference, consequences for availability
CVE-2017-5852: The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted file.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2017-5853: Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
Key phrases: have unspecified impact via a crafted file, integer overflow
CVE-2017-5854: base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
Key phrases: denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2017-5855: The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
Key phrases: denial of service (NULL pointer dereference), cause a denial of service (NULL pointer, null pointer dereference
CVE-2017-5856: Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
Key phrases: denial of service (host memory consumption), cause a denial of service (host memory, memory leak
CVE-2017-5857: Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.
Key phrases: denial of service (host memory consumption), cause a denial of service (host memory, memory leak
CVE-2017-5858: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4).
Key phrases: impersonate any user, for various kinds of social engineering attacks
CVE-2017-5859: On Cambium Networks cnPilot R200/201 devices before 4.3, there is a vulnerability involving the certificate of the device and its RSA keys, aka RBN-183.
CVE-2017-5863: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
Key phrases: incorrect access control
CVE-2017-5864: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2017-5865: The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.
Key phrases: enumerate user names via a large number of, large number of password reset attempts
CVE-2017-5866: The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unspecified vectors
CVE-2017-5867: ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and logfile flooding) via a one bit BMP file.
Key phrases: denial of service (server hang and logfile flooding), cause a denial of service (server hang, one bit bmp file
CVE-2017-5868: CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.
Key phrases: inject arbitrary HTTP headers, inject arbitrary HTTP headers and consequently conduct session, crlf injection, session fixation, http response splitting
CVE-2017-5869: Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. (dot dot) in the X-File-Name header.
Key phrases: execute arbitrary JSP code, upload and execute arbitrary JSP code via a, directory traversal, arbitrary jsp code
CVE-2017-5870: Multiple cross-site scripting (XSS) vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) transport parameter to domain/add; the (3) name parameter to mailbox/add/did/<domain id>; the (4) goto parameter to alias/add/did/<domain id>; or the (5) captchatext parameter to auth/lost-password.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2017-5871: Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote).
Key phrases: obtain sensitive information, cwe-601, open redirection, sensitive information (remote)
CVE-2017-5872: The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1.2 service, allows remote attackers to cause a denial of service (network connectivity disruption) via a client hello with a signature_algorithms extension above those defined in RFC 5246, which triggers a full memory dump.
Key phrases: denial of service (network connectivity disruption), cause a denial of service (network connectivity, full memory dump
CVE-2017-5873: Unquoted Windows search path vulnerability in the guest service in Unisys s-Par before 4.4.20 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe.
Key phrases: gain privileges, gain privileges via a Trojan horse executable file, windows search path
CVE-2017-5874: CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authentication and insert XSS sequences or possibly have unspecified other impact.
Key phrases: bypass authentication, csrf, xss sequences, unspecified other impact, unspecified impact
CVE-2017-5875: XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter.
Key phrases: xss, authenticated
CVE-2017-5876: XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter.
Key phrases: xss, unauthenticated
CVE-2017-5877: XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter.
Key phrases: xss, unauthenticated
CVE-2017-5878: The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
Key phrases: execute arbitrary code, execute arbitrary code via crafted serialized Java data, amf unmarshallers
CVE-2017-5879: An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects source_selector.php and the following parameter: src.
Key phrases: blind sql injection, out-of-band technique
CVE-2017-5880: Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13, 6.1.x before 6.1.12, 6.0.x before 6.0.13, 5.0.x before 5.0.17 and Splunk Light versions before 6.5.2 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted GET request, aka SPL-130279.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash
CVE-2017-5881: GOM Player 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted fpx file.
Key phrases: denial of service (memory corruption), cause a denial of service (memory corruption, unspecified other impact, unspecified impact
CVE-2017-5882: Cross-site scripting (XSS) vulnerability in index.asp in SANADATA SanaCMS 7.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2017-5884: gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.
Key phrases: execute arbitrary code, execute arbitrary code via the src x
CVE-2017-5885: Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), integer overflows, buffer overflow
CVE-2017-5886: Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
Key phrases: have unspecified impact via a crafted file, heap-based buffer overflow, heap based buffer overflow
CVE-2017-5887: WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pinning should occur in the initStreamsWithData function).
Key phrases: bypass because pinning occurs in the stream function, SSL Pinning bypass, an SSL Pinning bypass because pinning occurs in, ssl pinning bypass
CVE-2017-5891: ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF.
Key phrases: login page csrf, save settings csrf
CVE-2017-5892: ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map.
Key phrases: JSONP Information Disclosure such as a network map, jsonp information disclosure
CVE-2017-5896: Heap-based buffer overflow in the fz_subsample_pixmap function in fitz/pixmap.c in MuPDF 1.10a allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted image.
Key phrases: denial of service (out-of-bounds read and crash), cause a denial of service (out-, heap-based buffer overflow, heap based buffer overflow, out of bounds read
CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.
Key phrases: have unspecified impact via vectors involving GRE flags, out-of-bounds access, out of bounds access
CVE-2017-5898: Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.
Key phrases: denial of service (application crash), cause a denial of service (application crash, integer overflow
CVE-2017-5899: Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and consequently gain root privileges via a .. (dot dot) in the randstr argument.
Key phrases: gain root privileges, write to arbitrary files and consequently gain root, directory traversal
CVE-2017-5900: Cross-site scripting (XSS) vulnerability in the NetComm NB16WV-02 router with firmware NB16WV_R0.09 allows remote authenticated users to inject arbitrary web script or HTML via the S801F0334 parameter to hdd.htm.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2017-5901: The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing
CVE-2017-5902: The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing
CVE-2017-5905: The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing
CVE-2017-5906: The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information via a, man in the middle, spoofing