Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-17837 State: PUBLISHED Published: 2018-01-04T15:00:00Z Last Updated: 2024-09-17T02:21:15.482Z Vendors: Apache Software Foundation Products: Apache DeltaSpike Problem Types: Information Disclosure Description: The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/DELTASPIKE-1307 - https://git-wip-us.apache.org/repos/asf?p=deltaspike.git%3Bh=4e25023 - https://lists.apache
ira/browse/DELTASPIKE-1307 - https://git-wip-us.apache.org/repos/asf?p=deltaspike.git%3Bh=4e25023 - https://lists.apache.org/thread.html/r78565f0f4ecb4ad32a6c405b45b9ee568dfc4729ba63e7d7cb6adf88%40%3Cdev.deltaspike.apache.org%3E - https://lists.apache.org/thread.html/r17b326c0eb35d8c71c84c171eda83e3e1f011dc757781e34f2846018%40%3Cdev.deltaspike.apache.org%3E
CVE ID: CVE-2017-17838 State: REJECTED Published: 2018-01-18T17:00:00 Last Updated: 2018-01-18T16:57:01 Description: No description available.
CVE ID: CVE-2017-17839 State: REJECTED Published: 2018-01-18T17:00:00 Last Updated: 2018-01-18T16:57:01 Description: No description available.
CVE ID: CVE-2017-17840 State: PUBLISHED Published: 2017-12-22T09:00:00Z Last Updated: 2024-09-16T16:53:48.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation. Additional Analyst Notes: - CVE Program Container: References: - https://bugz
e payload length before a write operation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.opensuse.org/show_bug.cgi?id=1072312 - http://www.openwall.com/lists/oss-security/2017/12/13/2
CVE ID: CVE-2017-17841 State: PUBLISHED Published: 2018-01-10T18:00:00 Last Updated: 2024-08-05T21:06:48.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalProtect portal or gateway, might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102458 - http://www.securitytracker.com/id/1040149 - https://security.paloaltonetworks.com/CVE-2017-17841
CVE ID: CVE-2017-17843 State: PUBLISHED Published: 2017-12-22T23:00:00 Last Updated: 2024-08-05T21:06:48.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002. Additional Analyst Notes: - CVE Program Container: References: - https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf - https://lists.debian.org/debian-sec
ail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf - https://lists.debian.org/debian-security-announce/2017/msg00333.html - https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html - https://www.debian.org/security/2017/dsa-4070
CVE ID: CVE-2017-17844 State: PUBLISHED Published: 2017-12-22T23:00:00 Last Updated: 2024-08-05T21:06:49.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 "replay" issue. Additional Analyst Notes: - CVE Program Container: References: - https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf - https://lists.debian.org/deb
//enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf - https://lists.debian.org/debian-security-announce/2017/msg00333.html - https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html - https://www.debian.org/security/2017/dsa-4070
CVE ID: CVE-2017-17845 State: PUBLISHED Published: 2017-12-22T23:00:00 Last Updated: 2024-08-05T21:06:49.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001. Additional Analyst Notes: - CVE Program Container: References: - https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf - https://lists.debian.org/debian-security-announce/2017/msg00333.html - https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html - https://lists.debian.org/debian-lts-announce/2017/12/ms
w.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html - https://www.debian.org/security/2017/dsa-4070
CVE ID: CVE-2017-17846 State: PUBLISHED Published: 2017-12-22T23:00:00 Last Updated: 2024-08-05T21:06:48.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003. Additional Analyst Notes: - CVE Program Container: References: - https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf - https://lists.debian.org/debian-security-announce/2017/msg00333.html - https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html - https://lists.debian.org/debian-lts-announ
- https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html - https://www.debian.org/security/2017/dsa-4070
CVE ID: CVE-2017-17847 State: PUBLISHED Published: 2017-12-22T23:00:00 Last Updated: 2024-08-05T21:06:49.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format. Additional Analyst Notes: - CVE Program Container: References: - https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf - https://sou
erences: - https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf - https://sourceforge.net/p/enigmail/bugs/709/ - https://lists.debian.org/debian-security-announce/2017/msg00333.html - https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html - https://www.debian.org/security/2017/dsa-4070
CVE ID: CVE-2017-17848 State: PUBLISHED Published: 2017-12-22T23:00:00 Last Updated: 2024-08-05T21:06:48.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/enigmail/bugs/709/ - https://lists.debian.org/debian-security-announce/2017/msg00
eferences: - https://sourceforge.net/p/enigmail/bugs/709/ - https://lists.debian.org/debian-security-announce/2017/msg00333.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html - https://www.debian.org/security/2017/dsa-4070 - http://www.openwall.com/lists/oss-security/2019/04/30/4 - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
CVE ID: CVE-2017-17849 State: PUBLISHED Published: 2017-12-24T18:00:00 Last Updated: 2024-08-05T21:06:49.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long response. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45087/ - https://packetstormsecurity.com/files/145530/GetGo-Download-Manager-5.3.0.2712-Buffer-Overflow.html - https://www.exploit-db.com/exploits/43391/
CVE ID: CVE-2017-17850 State: PUBLISHED Published: 2017-12-23T00:00:00 Last Updated: 2024-08-05T21:06:49.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point. Add
is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point. Additional Analyst Notes: - CVE Program Container: References: - https://issues.asterisk.org/jira/browse/ASTERISK-27480 - http://www.securitytracker.com/id/1040056 - https://security.gentoo.org/glsa/201811-11 - http://downloads.asterisk.org/pub/security/AST-2017-014.html
CVE ID: CVE-2017-17852 State: PUBLISHED Published: 2017-12-23T04:00:00 Last Updated: 2024-08-05T21:06:48.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/12/21/2 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=468f6eafa6c44cb2c5d8aad35e12f06c240a812a - https://github.com/torvalds/linux/commit/468f6eafa6c44cb2c5d8aad35e12f06c240a81
8f6eafa6c44cb2c5d8aad35e12f06c240a812a - https://github.com/torvalds/linux/commit/468f6eafa6c44cb2c5d8aad35e12f06c240a812a
CVE ID: CVE-2017-17853 State: PUBLISHED Published: 2017-12-23T04:00:00 Last Updated: 2024-08-05T21:06:48.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/12/21/2 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4374f256ce8182019353c0c639bb8d0695b4c941 - https://github.com/torvalds/linux/commit/4374f256ce8182019353c0c
t/commit/?id=4374f256ce8182019353c0c639bb8d0695b4c941 - https://github.com/torvalds/linux/commit/4374f256ce8182019353c0c639bb8d0695b4c941
CVE ID: CVE-2017-17854 State: PUBLISHED Published: 2017-12-23T04:00:00 Last Updated: 2024-08-05T21:06:49.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bb7f0f989ca7de1153bd128a40a71709e339fa03 - https://github.com/torvalds/linux/commit/bb7f0f989ca7de1153bd128a40a71709e339fa03 - http://www.
bd128a40a71709e339fa03 - https://github.com/torvalds/linux/commit/bb7f0f989ca7de1153bd128a40a71709e339fa03 - http://www.openwall.com/lists/oss-security/2017/12/21/2
CVE ID: CVE-2017-17855 State: PUBLISHED Published: 2017-12-23T04:00:00 Last Updated: 2024-08-05T21:06:48.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/12/21/2 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=179d1c5602997fef5a940c6ddcf31212cbfebd14 - https://github.com/torvalds/linux/commit/179d1c5602997fef5a940c6
t/commit/?id=179d1c5602997fef5a940c6ddcf31212cbfebd14 - https://github.com/torvalds/linux/commit/179d1c5602997fef5a940c6ddcf31212cbfebd14
CVE ID: CVE-2017-17856 State: PUBLISHED Published: 2017-12-23T04:00:00 Last Updated: 2024-08-05T21:06:49.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/a5ec6ae161d72f01411169a938fa5f8baea16e8f - http://www.openwall.com/lists/oss-security/2017/12/21/2 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a5ec6ae161d72f014111
s-security/2017/12/21/2 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a5ec6ae161d72f01411169a938fa5f8baea16e8f
CVE ID: CVE-2017-17857 State: PUBLISHED Published: 2017-12-23T04:00:00 Last Updated: 2024-08-05T21:06:49.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/12/21/2 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea25f914dc164c8d56b36147ecc86bc65f83c469 - https://github.com
el.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea25f914dc164c8d56b36147ecc86bc65f83c469 - https://github.com/torvalds/linux/commit/ea25f914dc164c8d56b36147ecc86bc65f83c469
CVE ID: CVE-2017-17858 State: PUBLISHED Published: 2018-01-22T15:00:00 Last Updated: 2024-08-05T21:06:49.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-15 - https://bugs.ghostscript.com/show_bug.cgi?id=698819 - https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.md - http://git.ghostscript.com/?p=mupdf.git%3
https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.md - http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=55c3f68d638ac1263a386e0aaa004bb6e8bde731
CVE ID: CVE-2017-17859 State: PUBLISHED Published: 2017-12-24T07:00:00 Last Updated: 2024-08-05T21:06:49.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another part of this MHTML file does not have a document.domain value corresponding to the domain that is hosting the MHTML file, but instead has a document.domain value corresponding to an arbitrary URL within the content of the MHTML file. Additional Analyst
d has a document.domain value corresponding to an arbitrary URL within the content of the MHTML file. Additional Analyst Notes: - CVE Program Container: References: - https://poctestblog.blogspot.com/2017/12/samsung-internet-browser-sop-bypassuxss.html
CVE ID: CVE-2017-17860 State: PUBLISHED Published: 2018-01-18T22:00:00Z Last Updated: 2024-09-16T18:56:05.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intention only if attacker can reveal the Bluetooth address of target device and paired user's smartphone Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/open?id=0B5L-0MoH_v7fcGljUS1SYnlkOHM
CVE ID: CVE-2017-17862 State: PUBLISHED Published: 2017-12-23T17:00:00 Last Updated: 2024-08-05T21:06:48.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/c131187db2d3fa2f8bf32fdf4e9a4ef805168467 - https://usn.ubuntu.com/3619-2/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1
05168467 - https://usn.ubuntu.com/3619-2/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c131187db2d3fa2f8bf32fdf4e9a4ef805168467 - https://www.spinics.net/lists/stable/msg206984.html - http://www.securityfocus.com/bid/102325 - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/usn/usn-3523-2/ - https://anonscm.debian.org/cgit/kernel/linux.git/tree/debian/patches/bugfix/all/bpf-fix-branch-pruning-logic.patch?h=stretch-security - https://usn.ubuntu.com/3619-1/ - http://www.securitytracker.com/id/1040057
CVE ID: CVE-2017-17863 State: PUBLISHED Published: 2017-12-23T17:00:00 Last Updated: 2024-08-05T21:06:48.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040058 - https://usn.ubuntu.com/3523-3/ - https://www.spinics.net/lists/stable/msg206985.html - http://www.securityfocus.com/bid/102321 - https://www.deb
523-3/ - https://www.spinics.net/lists/stable/msg206985.html - http://www.securityfocus.com/bid/102321 - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/usn/usn-3523-2/ - https://anonscm.debian.org/cgit/kernel/linux.git/tree/debian/patches/bugfix/all/bpf-reject-out-of-bounds-stack-pointer-calculation.patch?h=stretch-security
CVE ID: CVE-2017-17864 State: PUBLISHED Published: 2017-12-23T17:00:00 Last Updated: 2024-08-05T21:06:48.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." Additional Analyst Notes: - CVE Program Container: References: - https://anonscm.debian.org/cgit/kernel/linux.git/tree/debian/patches/bugfix/all/bpf-verifier-fix-states_equal-comparison-of-pointer-and-unknown.patch?h=stretch-security - https://anonscm.debian.org/cgit/kernel/
er-fix-states_equal-comparison-of-pointer-and-unknown.patch?h=stretch-security - https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=stretch-security&id=ad775f6ff7eebb93eedc2f592bc974260e7757b0 - http://www.securitytracker.com/id/1040059 - http://www.securityfocus.com/bid/102320 - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/usn/usn-3523-2/
CVE ID: CVE-2017-17866 State: PUBLISHED Published: 2017-12-23T17:00:00 Last Updated: 2024-08-05T21:06:49.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4334 - http://www.ghostscript.com/cgi-bin/findgit.cgi?520cc26d18c9ee245b56e9e91f9d4fcae02be5f0 - https://bugs.ghostscr
a-4334 - http://www.ghostscript.com/cgi-bin/findgit.cgi?520cc26d18c9ee245b56e9e91f9d4fcae02be5f0 - https://bugs.ghostscript.com/show_bug.cgi?id=698699
CVE ID: CVE-2017-17867 State: PUBLISHED Published: 2018-01-04T19:00:00 Last Updated: 2024-08-05T21:06:49.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the /etc/uci-defaults directory was not being used to secure the OpenWrt configuration. Additional Analyst Notes: - CVE Program Container: References: - https://neonsea.uk/blog/2017/12/23/rce-inteno-iopsys.html - http://public.inteno.se/?p=feed-int
Container: References: - https://neonsea.uk/blog/2017/12/23/rce-inteno-iopsys.html - http://public.inteno.se/?p=feed-inteno-openwrt.git%3Ba=commit%3Bh=efcc985a721107e72a66da4db66891ec54441998 - https://www.exploit-db.com/exploits/43428/
CVE ID: CVE-2017-17868 State: PUBLISHED Published: 2017-12-23T23:00:00 Last Updated: 2024-08-05T21:06:48.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2017120169
CVE ID: CVE-2017-17869 State: PUBLISHED Published: 2017-12-23T23:00:00 Last Updated: 2024-08-05T21:06:48.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2017120183