Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-5866 State: PUBLISHED Published: 2017-03-03T15:00:00 Last Updated: 2024-08-05T15:11:48.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2017-002 - http://www.securityfocus.com/bid/96426
CVE ID: CVE-2017-5867 State: PUBLISHED Published: 2017-03-03T15:00:00 Last Updated: 2024-08-05T15:11:48.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and logfile flooding) via a one bit BMP file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96430 - https://owncloud.org/security/advisory/?id=oc-sa-2017-003
CVE ID: CVE-2017-5868 State: PUBLISHED Published: 2017-05-25T19:00:00 Last Updated: 2024-08-05T15:11:48.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/ - http://www.securitytracker.com/id/1038547 - http://www.o
8-openvpn-access-server-crlf-injection-with-session-fixation/ - http://www.securitytracker.com/id/1038547 - http://www.openwall.com/lists/oss-security/2017/05/23/13
CVE ID: CVE-2017-5869 State: PUBLISHED Published: 2017-03-24T14:00:00 Last Updated: 2024-08-05T15:11:48.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. (dot dot) in the X-File-Name header. Additional Analyst Notes: - CVE Program Container: References: - https://sysdream.com/news/lab/2017-03-23-cve-2017-5869-nuxeo-platform-remote-code-execution/ - http://www.openwall.com/lists/oss-security/2017/03/23/6 - https://www.exploit-db.com/exploits/41748/ - http://www.securityfocus.com/bid/97083
CVE ID: CVE-2017-5870 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-05T15:11:49.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) transport parameter to domain/add; the (3) name parameter to mailbox/add/did/<domain id>; the (4) goto parameter to alias/add/did/<domain id>; or the (5) captchatext parameter to auth/lost-password. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/05/03/8 - https://sysdream.com/news/lab/2017-05-03-cve-2017-
ferences: - http://www.openwall.com/lists/oss-security/2017/05/03/8 - https://sysdream.com/news/lab/2017-05-03-cve-2017-5870-multiple-xss-vulnerabilities-in-vimbadmin/
CVE ID: CVE-2017-5871 State: PUBLISHED Published: 2019-05-22T19:33:41 Last Updated: 2024-08-05T15:11:48.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote). Additional Analyst Notes: - CVE Program Container: References: - https://www.odoo.com - https://sysdream.com/news/lab/2017-11-20-cve-2017-5871-odoo-url-redirection-to-distrusted-site-open-redirect/
CVE ID: CVE-2017-5872 State: PUBLISHED Published: 2017-03-10T02:00:00 Last Updated: 2024-08-05T15:11:48.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1.2 service, allows remote attackers to cause a denial of service (network connectivity disruption) via a client hello with a signature_algorithms extension above those defined in RFC 5246, which triggers a full memory dump. Additional Analyst Notes: - CVE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID
VE Program Container: References: - https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=42 - http://www.securityfocus.com/bid/96782
CVE ID: CVE-2017-5873 State: PUBLISHED Published: 2017-04-11T15:00:00 Last Updated: 2024-08-05T15:11:48.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unquoted Windows search path vulnerability in the guest service in Unisys s-Par before 4.4.20 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe. Additional Analyst Notes: - CVE Program Container: References: - http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=41
CVE ID: CVE-2017-5874 State: PUBLISHED Published: 2017-03-22T05:31:00 Last Updated: 2024-08-05T15:11:48.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authentication and insert XSS sequences or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96999 - http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10072
CVE ID: CVE-2017-5875 State: PUBLISHED Published: 2017-02-06T15:00:00 Last Updated: 2024-08-05T15:11:48.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/issues/10643 - http://www.securityfocus.com/bid/96115
CVE ID: CVE-2017-5876 State: PUBLISHED Published: 2017-02-06T15:00:00 Last Updated: 2024-08-05T15:11:48.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/issues/10643 - http://www.securityfocus.com/bid/96115
CVE ID: CVE-2017-5877 State: PUBLISHED Published: 2017-02-06T15:00:00 Last Updated: 2024-08-05T15:11:48.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/issues/10643 - http://www.securityfocus.com/bid/96115
CVE ID: CVE-2017-5878 State: PUBLISHED Published: 2017-06-08T16:00:00 Last Updated: 2024-08-05T15:11:49.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data. Additional Analyst Notes: - CVE Program Container: References: - https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true - http://www.openwall.com/lists/oss-security/2017/05/22/2
CVE ID: CVE-2017-5879 State: PUBLISHED Published: 2017-02-06T15:00:00 Last Updated: 2024-08-05T15:11:48.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects source_selector.php and the following parameter: src. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/exponentcms/exponent-cms/issues/73 - http://www.securityfocus.com/bid/96039
CVE ID: CVE-2017-5880 State: PUBLISHED Published: 2017-02-04T05:20:00 Last Updated: 2024-08-05T15:11:48.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13, 6.1.x before 6.1.12, 6.0.x before 6.0.13, 5.0.x before 5.0.17 and Splunk Light versions before 6.5.2 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted GET request, aka SPL-130279. Additional Analyst Notes: - CVE Program Container: References: - http://www.splunk.com/view/SP-CAAAPW8
CVE ID: CVE-2017-5881 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:11:48.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: GOM Player 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted fpx file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41367/
CVE ID: CVE-2017-5882 State: PUBLISHED Published: 2017-02-04T18:00:00 Last Updated: 2024-08-05T15:11:48.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.asp in SANADATA SanaCMS 7.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96038 - https://cxsecurity.com/issue/WLB-2017020038
CVE ID: CVE-2017-5884 State: PUBLISHED Published: 2017-02-28T18:00:00 Last Updated: 2024-08-05T15:11:48.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/02/03/5 - http://www.securityfocus.com/bid/96016 - https://bugzilla.gnome.org/show_bug.cgi?id=778048 - https://access.redhat.com/errata/RHSA-2017:2258 - https://lists.fedoraproject.org/arch
nome.org/show_bug.cgi?id=778048 - https://access.redhat.com/errata/RHSA-2017:2258 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/ - https://git.gnome.org/browse/gtk-vnc/commit/?id=ea0386933214c9178aaea9f2f85049ea3fa3e14a - http://www.openwall.com/lists/oss-security/2017/02/05/5
CVE ID: CVE-2017-5885 State: PUBLISHED Published: 2017-02-28T18:00:00 Last Updated: 2024-08-05T15:11:48.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://git.gnome.org/browse/gtk-vnc/commit/?id=c8583fd3783c5b811590fcb7bae4ce6e7344963e - http://www.openwall.com/lists/oss-security/2017/02/03/5 - http://www.securityfo
583fd3783c5b811590fcb7bae4ce6e7344963e - http://www.openwall.com/lists/oss-security/2017/02/03/5 - http://www.securityfocus.com/bid/96016 - https://access.redhat.com/errata/RHSA-2017:2258 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/ - http://www.openwall.com/lists/oss-security/2017/02/05/5 - https://bugzilla.gnome.org/show_bug.cgi?id=778050
CVE ID: CVE-2017-5886 State: PUBLISHED Published: 2017-03-01T15:00:00 Last Updated: 2024-08-05T15:11:48.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/02/03/podofo-heap-based-buffer-overflow-in-podofopdftokenizergetnexttoken-pdftokenizer-cpp/ - http://www.securityfocus.com/bid/96512
CVE ID: CVE-2017-5887 State: PUBLISHED Published: 2017-04-06T14:00:00 Last Updated: 2024-08-05T15:11:48.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pinning should occur in the initStreamsWithData function). Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2017/Apr/67 - https://github.com/daltoniam/Starscream/releases/tag/2.0.4 - https://github.com/daltoniam/Starscream/commit/dbeb1190b8dcbff4f0b797f9e9d9b9b864d1f0d6
CVE ID: CVE-2017-5891 State: PUBLISHED Published: 2017-05-10T05:14:00 Last Updated: 2024-08-05T15:11:48.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wwws.nightwatchcybersecurity.com/2017/05/09/multiple-vulnerabilities-in-asus-routers/ - https://www.asus.com/support/Download/11/2/0/161/45/
CVE ID: CVE-2017-5892 State: PUBLISHED Published: 2017-05-10T05:14:00 Last Updated: 2024-08-05T15:11:49.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map. Additional Analyst Notes: - CVE Program Container: References: - https://wwws.nightwatchcybersecurity.com/2017/05/09/multiple-vulnerabilities-in-asus-routers/ - https://www.asus.com/support/Download/11/2/0/161/45/
CVE ID: CVE-2017-5896 State: PUBLISHED Published: 2017-02-15T19:00:00 Last Updated: 2024-08-05T15:11:48.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the fz_subsample_pixmap function in fitz/pixmap.c in MuPDF 1.10a allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/02/07/1 - https://bugs.ghostscript.com/show_bug.cgi?id=697515 - http://git.ghostscript.com/?p=mupdf.git%3Bh=2c4e5867ee699b1081527bc6c6ea0e99a35a5c27 - http://www.debian.org/security/2017/dsa-3797 - http://www.securityfo
.git%3Bh=2c4e5867ee699b1081527bc6c6ea0e99a35a5c27 - http://www.debian.org/security/2017/dsa-3797 - http://www.securityfocus.com/bid/96139 - http://www.openwall.com/lists/oss-security/2017/02/06/3 - https://security.gentoo.org/glsa/201702-12
CVE ID: CVE-2017-5897 State: PUBLISHED Published: 2017-03-23T16:00:00 Last Updated: 2024-08-05T15:11:49.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037794 - http://www.securityfocus.com/bid/96037 - https://source.android.com/security/bulletin/2017-09-01 - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=7892032cfe67f4bde6fc2ee967e45a8fbaf33756 - h
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=7892032cfe67f4bde6fc2ee967e45a8fbaf33756 - https://usn.ubuntu.com/3754-1/ - http://www.openwall.com/lists/oss-security/2017/02/07/2 - http://www.debian.org/security/2017/dsa-3791
CVE ID: CVE-2017-5898 State: PUBLISHED Published: 2017-03-15T19:00:00 Last Updated: 2024-08-05T15:11:48.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00048.html - http://www.openwall.com/lists/oss-security/2017/02/07/3 - https://access.redhat.com/errata/RHSA-
2017-02/msg00048.html - http://www.openwall.com/lists/oss-security/2017/02/07/3 - https://access.redhat.com/errata/RHSA-2017:2392 - https://security.gentoo.org/glsa/201702-28 - http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00045.html - http://www.securityfocus.com/bid/96112 - http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=c7dfbf322595ded4e70b626bf83158a9f3807c6a - https://bugzilla.redhat.com/show_bug.cgi?id=1419699 - https://access.redhat.com/errata/RHSA-2017:1856
CVE ID: CVE-2017-5899 State: PUBLISHED Published: 2017-03-27T15:00:00 Last Updated: 2024-08-05T15:11:49.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and consequently gain root privileges via a .. (dot dot) in the randstr argument. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/02/07/4 - https://www.mail-archive.com/s-nail-users%40lists.sourceforge.net/msg00551.html - http://www.openwall.com/lists/oss-security/2017/01/27/7 - http://www.securityfocus.com/bid
urceforge.net/msg00551.html - http://www.openwall.com/lists/oss-security/2017/01/27/7 - http://www.securityfocus.com/bid/96138
CVE ID: CVE-2017-5900 State: PUBLISHED Published: 2017-03-29T14:00:00 Last Updated: 2024-08-05T15:11:48.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the NetComm NB16WV-02 router with firmware NB16WV_R0.09 allows remote authenticated users to inject arbitrary web script or HTML via the S801F0334 parameter to hdd.htm. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038171 - http://www.securityfocus.com/bid/97161 - http://seclists.org/fulldisclosure/2017/Mar/75
CVE ID: CVE-2017-5901 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5902 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5905 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5906 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5907 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5908 State: REJECTED Published: 2017-05-05T07:04:00 Last Updated: 2017-05-05T07:57:01 Description: No description available.
CVE ID: CVE-2017-5909 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:49.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5911 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5912 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f