Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7973 State: PUBLISHED Published: 2017-09-25T19:00:00Z Last Updated: 2024-09-16T16:13:23.912Z Vendors: Schneider Electric SE Products: U.Motion Problem Types: SQL Injection Description: A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can use calls to various paths allowing performance of arbitrary SQL commands against the underlying database. Additional Analyst Notes: - CVE Program Container: References: - http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - http://www.securityfocus.com/bid/99344
CVE ID: CVE-2017-7974 State: PUBLISHED Published: 2017-09-25T19:00:00Z Last Updated: 2024-09-16T20:02:51.051Z Vendors: Schneider Electric SE Products: U.Motion Problem Types: Path Traversal Description: A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can execute arbitrary code and exfiltrate files. Additional Analyst Notes: - CVE Program Container: References: - http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ - http://www.securityfocus.com/bid/99344
CVE ID: CVE-2017-7975 State: PUBLISHED Published: 2017-04-19T16:00:00 Last Updated: 2024-08-05T16:19:29.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file, leading to a denial of service (application crash) or possibly execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3855 - https://bugs.ghostscript.com/show_bug.cgi?id=697693 - https://security.gentoo.org/glsa/201708-10
CVE ID: CVE-2017-7976 State: PUBLISHED Published: 2017-04-19T17:00:00 Last Updated: 2024-08-05T16:19:29.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file, leading to a denial of service (application crash) or disclosure of sensitive information from process memory. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=697683 - http://www.debian.org/security/2017/dsa-3855 - https://security.gentoo.org/glsa/201708-10
CVE ID: CVE-2017-7977 State: PUBLISHED Published: 2017-07-19T18:00:00 Last Updated: 2024-08-05T16:19:29.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root privileges by inserting commands in a local configuration dialog in the control panel. Additional Analyst Notes: - CVE Program Container: References: - https://www.myelux.com/cvesingle.htm?cve_id=CVE-2017-7977
CVE ID: CVE-2017-7978 State: PUBLISHED Published: 2017-04-19T22:00:00Z Last Updated: 2024-09-17T03:29:08.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Android devices with L(5.0/5.1), M(6.0), and N(7.x) software allow attackers to obtain sensitive information by reading a world-readable log file after an unexpected reboot. The Samsung ID is SVE-2017-8290. Additional Analyst Notes: - CVE Program Container: References: - http://security.samsungmobile.com/smrupdate.html#SMR-APR-2017
CVE ID: CVE-2017-7979 State: PUBLISHED Published: 2017-04-19T23:00:00 Last Updated: 2024-08-05T16:19:29.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cookie feature in the packet action API implementation in net/sched/act_api.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, which allows local users to cause a denial of service (uninitialized memory access and refcount underflow, and system hang or crash) or possibly have unspecified other impact via "tc filter add" commands in certain contexts. NOTE: this does not affect stable kernels, such as 4.10.x, from kernel.org. Additional Analyst Notes: - CVE Program Container: References: - http://m
able kernels, such as 4.10.x, from kernel.org. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=linux-netdev&m=149251041420195 - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1682368 - https://bugzilla.proxmox.com/show_bug.cgi?id=1351 - http://marc.info/?l=linux-netdev&m=149200742616349 - http://marc.info/?l=linux-netdev&m=149200746116365 - http://marc.info/?l=linux-netdev&m=149251041420194 - http://marc.info/?l=linux-netdev&m=149200746116366 - http://www.securityfocus.com/bid/97969
CVE ID: CVE-2017-7980 State: PUBLISHED Published: 2017-07-25T14:00:00 Last Updated: 2024-08-05T16:19:29.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:0983 - http://www.openwall.com/lists/oss-security/2017/04/21/1 - https://access.redhat.com/errata/RHSA-2017:0982 - https://lists.debian.org/debian-lts-a
ists/oss-security/2017/04/21/1 - https://access.redhat.com/errata/RHSA-2017:0982 - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://access.redhat.com/errata/RHSA-2017:1430 - https://security.gentoo.org/glsa/201706-03 - http://ubuntu.com/usn/usn-3289-1 - https://access.redhat.com/errata/RHSA-2017:1206 - http://www.securityfocus.com/bid/97955 - http://www.securityfocus.com/bid/102129 - https://access.redhat.com/errata/RHSA-2017:0984 - https://access.redhat.com/errata/RHSA-2017:0988 - https://access.redhat.com/errata/RHSA-2017:1441 - https://bugzilla.redhat.com/show_bug.cgi?id=1430056 - https://access.redhat.com/errata/RHSA-2017:0981 - https://access.redhat.com/errat
a.redhat.com/show_bug.cgi?id=1430056 - https://access.redhat.com/errata/RHSA-2017:0981 - https://access.redhat.com/errata/RHSA-2017:0980 - https://access.redhat.com/errata/RHSA-2017:1205 - https://support.citrix.com/article/CTX230138
CVE ID: CVE-2017-7981 State: PUBLISHED Published: 2017-04-29T16:00:00 Last Updated: 2024-08-05T16:19:29.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument, and an authenticated Tuleap user can control this value, even with shell metacharacters, as demonstrated by a '<?plugin SyntaxHighlighter syntax="c;id"' line to execute the id command. Additional Analyst Notes: - CVE Program Container: References: - https://tuleap.net/file/shownotes.
cute the id command. Additional Analyst Notes: - CVE Program Container: References: - https://tuleap.net/file/shownotes.php?release_id=137#/linked-artifacts - https://github.com/xdrr/vulnerability-research/blob/master/webapp/tuleap/2017.04.tuleap-auth-ci.md - https://tuleap.net/plugins/tracker/?aid=10159 - https://www.exploit-db.com/exploits/41953/
CVE ID: CVE-2017-7982 State: PUBLISHED Published: 2017-04-20T14:00:00 Last Updated: 2024-08-05T16:19:29.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libimobiledevice/libplist/issues/103 - https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html
CVE ID: CVE-2017-7983 State: PUBLISHED Published: 2017-04-25T18:00:00 Last Updated: 2024-08-05T16:19:29.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98016 - https://developer.joomla.org/security-centre/683-20170401-core-information-disclosure
CVE ID: CVE-2017-7984 State: PUBLISHED Published: 2017-04-25T18:00:00 Last Updated: 2024-08-05T16:19:29.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering leads to XSS in the template manager component. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/684-20170402-core-xss-vulnerability - http://www.securityfocus.com/bid/98018
CVE ID: CVE-2017-7985 State: PUBLISHED Published: 2017-04-25T18:00:00 Last Updated: 2024-08-05T16:19:29.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/zeroday/FG-VD-17-109 - https://fortiguard.com/zeroday/FG-VD-17-107 - http://www.securitytracker.com/id/1038817 - https://developer.joomla.org/security-centre/685-20170403-core-xss-vulnerability - https://fortiguard.com/zeroday/FG-VD-17-108 - http://www.securityfocus.com/bid/98020
CVE ID: CVE-2017-7986 State: PUBLISHED Published: 2017-04-25T18:00:00 Last Updated: 2024-08-05T16:19:29.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/686-20170404-core-xss-vulnerability - http://www.securityfocus.com/bid/98024
CVE ID: CVE-2017-7987 State: PUBLISHED Published: 2017-04-25T18:00:00 Last Updated: 2024-08-05T16:19:29.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98021 - https://developer.joomla.org/security-centre/687-20170405-core-xss-vulnerability
CVE ID: CVE-2017-7988 State: PUBLISHED Published: 2017-04-25T18:00:00 Last Updated: 2024-08-05T16:19:29.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of form contents allows overwriting the author of an article. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98022 - https://developer.joomla.org/security-centre/688-20170406-core-acl-violations
CVE ID: CVE-2017-7989 State: PUBLISHED Published: 2017-04-25T18:00:00 Last Updated: 2024-08-05T16:19:29.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/689-20170407-core-acl-violations - http://www.securityfocus.com/bid/98029
CVE ID: CVE-2017-7990 State: PUBLISHED Published: 2017-04-21T00:00:00Z Last Updated: 2024-09-16T22:25:18.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=pfrIaNvIuFY - https://github.com/openmrs/openmrs-module-reporting/pull/141/commits/0023a659288538d2763835847d3414ecb18b931a#diff-50e25eddc5909110fa3d31090877c2fd
CVE ID: CVE-2017-7991 State: PUBLISHED Published: 2017-04-22T01:00:00 Last Updated: 2024-08-05T16:19:29.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/142258/Exponent-CMS-2.4.1-SQL-Injection.html - http://seclists.org/fulldisclosure/2017/Apr/78 - https://gist.github.com/404notf0und/ab59234d71fbf35b4926ffd646324f29 - https://github.com/exponentcms/exponent-cms/commit/67a9c2f0229de120431f3eecb0f501707
/ab59234d71fbf35b4926ffd646324f29 - https://github.com/exponentcms/exponent-cms/commit/67a9c2f0229de120431f3eecb0f5017075517105
CVE ID: CVE-2017-7992 State: PUBLISHED Published: 2017-04-21T14:00:00Z Last Updated: 2024-09-16T23:30:58.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hps/heartland-php/issues/28
CVE ID: CVE-2017-7994 State: PUBLISHED Published: 2017-04-21T16:00:00 Last Updated: 2024-08-05T16:19:29.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97980 - https://icepng.github.io/2017/04/21/PoDoFo-1/ - https://github.com/icepng/PoC/tree/master/PoC1
CVE ID: CVE-2017-7995 State: PUBLISHED Published: 2017-05-03T19:00:00 Last Updated: 2024-08-05T16:19:29.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98314 - https://bugzilla.suse.com/show_bug.cgi?id=1033948 - http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00005.html
CVE ID: CVE-2017-7997 State: PUBLISHED Published: 2018-01-08T19:00:00 Last Updated: 2024-08-05T16:19:29.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jan/14 - https://sysdream.com/news/lab/2018-01-02-cve-2017-7997-gespage-sql-injection-vulnerability/ - https://www.exploit-db.com/exploits/43447/
CVE ID: CVE-2017-7998 State: PUBLISHED Published: 2018-01-08T19:00:00 Last Updated: 2024-08-05T16:19:29.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) printer name when adding a printer in the admin panel or (2) username parameter to webapp/users/user_reg.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jan/13 - https://sysdream.com/news/lab/2018-01-02-cve-2017-7998-gespage-stored-cross-site-scripting-xss-vulnerability/
CVE ID: CVE-2017-7999 State: PUBLISHED Published: 2017-06-01T16:00:00 Last Updated: 2024-08-05T16:19:29.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atlassian Eucalyptus before 4.4.1, when in EDGE mode, allows remote authenticated users with certain privileges to cause a denial of service (E2 service outage) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://eucalyptus.atlassian.net/wiki/display/advisories/ESA-33
CVE ID: CVE-2017-8000 State: PUBLISHED Published: 2017-07-17T14:00:00 Last Updated: 2024-08-05T16:19:29.488Z Vendors: n/a Products: RSA Authentication Manager 8.2 SP1 and earlier Problem Types: Stored Cross-Site Scripting Vulnerabilities Description: In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a token profile and store the profile name in the RSA Authentication Manager database. The profile name could include a crafted script (with an XSS payload) that could be executed when viewing or editing the assigned token profile in the token by another administrator's browser session. Additional Analyst Notes: - CVE Program Contain
d token profile in the token by another administrator's browser session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038878 - http://seclists.org/fulldisclosure/2017/Jul/25 - http://www.securityfocus.com/bid/99572
CVE ID: CVE-2017-8001 State: PUBLISHED Published: 2017-11-28T07:00:00 Last Updated: 2024-08-05T16:19:29.773Z Vendors: n/a Products: EMC ScaleIO EMC ScaleIO 2.0.1.x Problem Types: Sensitive Information Disclosure Description: An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the server where the script was executed to recover exposed credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101997 - http:
ntials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101997 - http://seclists.org/fulldisclosure/2017/Nov/35
CVE ID: CVE-2017-8002 State: PUBLISHED Published: 2017-07-09T20:00:00 Last Updated: 2024-08-05T16:19:29.629Z Vendors: n/a Products: EMC Data Protection Advisor prior to 6.4 Problem Types: Multiple Blind SQL Injection Vulnerabilities Description: EMC Data Protection Advisor prior to 6.4 contains multiple blind SQL injection vulnerabilities. A remote authenticated attacker may potentially exploit these vulnerabilities to gain information about the application by causing execution of arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/12 - http://www.securitytracker.com/id/1038841 - http://www.securityfocus.com/bid
//seclists.org/fulldisclosure/2017/Jul/12 - http://www.securitytracker.com/id/1038841 - http://www.securityfocus.com/bid/99487
CVE ID: CVE-2017-8003 State: PUBLISHED Published: 2017-07-09T20:00:00 Last Updated: 2024-08-05T16:19:29.451Z Vendors: n/a Products: EMC Data Protection Advisor prior to 6.4 Problem Types: Path Traversal Vulnerability Description: EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of the application. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/12 - http://www.securitytracker.com/id/1038841 -
am Container: References: - http://seclists.org/fulldisclosure/2017/Jul/12 - http://www.securitytracker.com/id/1038841 - http://www.securityfocus.com/bid/99487
CVE ID: CVE-2017-8004 State: PUBLISHED Published: 2017-07-17T14:00:00 Last Updated: 2024-08-05T16:19:29.462Z Vendors: n/a Products: RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, RSA Identity Management and Governance (RSA IMG) Problem Types: unrestricted file upload Description: The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) allow an application administrator to upload arbitrary files that
Governance (RSA IMG) versions 6.9.1, all patch levels) allow an application administrator to upload arbitrary files that may potentially contain a malicious code. The malicious file could be then executed on the affected system with the privileges of the user the application is running under. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038877 - http://seclists.org/fulldisclosure/2017/Jul/24 - http://www.securityfocus.com/bid/99591
CVE ID: CVE-2017-8005 State: PUBLISHED Published: 2017-07-17T14:00:00 Last Updated: 2024-08-05T16:19:29.512Z Vendors: n/a Products: RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, RSA Identity Management and Governance (RSA IMG) Problem Types: Multiple Stored Cross-Site Scripting Vulnerabilities Description: The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) are affected by multiple stored cros
RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) are affected by multiple stored cross-site scripting vulnerabilities. Remote authenticated malicious users could potentially inject arbitrary HTML code to the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038877 - http://seclists.org/fulldisclosure/2017/Jul/24 - http://www.securityfocus.com/bid/99591
CVE ID: CVE-2017-8006 State: PUBLISHED Published: 2017-07-17T14:00:00 Last Updated: 2024-08-05T16:19:29.763Z Vendors: n/a Products: RSA Authentication Manager 8.2 SP1 Patch 1 and earlier Problem Types: Brute Force PIN-Guessing Vulnerability Description: In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication Manager as a target user can use a brute force attack to attempt to identify that user's PIN. The malicious user could potentially reset the compromised PIN to affect victim's ability to obtain access to protected resources. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.o
obtain access to protected resources. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/23 - http://www.securityfocus.com/bid/99554 - http://www.securitytracker.com/id/1038879
CVE ID: CVE-2017-8007 State: PUBLISHED Published: 2017-09-22T01:00:00 Last Updated: 2024-08-05T16:19:29.489Z Vendors: n/a Products: EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net) for SAS Solution Packs Problem Types: Directory Traversal Description: In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information, and modify or delete data, by supplying specially crafted strings in input parameters of the web service call. Additional Analyst Notes