Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-9427 State: PUBLISHED Published: 2017-06-04T14:00:00 Last Updated: 2024-08-05T17:02:44.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a crafted table name at admin/developer/modules/designer/ and the injection is visible at admin/dashboard/vitals-statistics/integrity/check/?external=true. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/288
CVE ID: CVE-2017-9428 State: PUBLISHED Published: 2017-06-04T14:00:00 Last Updated: 2024-08-05T17:02:44.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary files via ..\ sequences in the directory parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/289
CVE ID: CVE-2017-9429 State: PUBLISHED Published: 2017-06-13T18:00:00 Last Updated: 2024-08-05T17:02:44.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42173/
CVE ID: CVE-2017-9430 State: PUBLISHED Published: 2017-06-05T11:12:00 Last Updated: 2024-08-05T17:02:44.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv[0]. An example threat model is a web application that launches dnstracer with an untrusted name string. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42115/ - https://cxsecurity.com/issue/WLB-2017060030 - https://www.exploit-d
nces: - https://www.exploit-db.com/exploits/42115/ - https://cxsecurity.com/issue/WLB-2017060030 - https://www.exploit-db.com/exploits/42424/ - https://packetstormsecurity.com/files/142799/DNSTracer-1.8.1-Buffer-Overflow.html
CVE ID: CVE-2017-9431 State: PUBLISHED Published: 2017-06-05T02:47:00 Last Updated: 2024-08-05T17:02:44.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grpc/grpc/pull/10492 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1018
CVE ID: CVE-2017-9432 State: PUBLISHED Published: 2017-06-05T02:47:00 Last Updated: 2024-08-05T17:11:00.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fosnola/libstaroffice/commit/2d6253c7a692a3d92785dd990fce7256ea05e794 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1029
CVE ID: CVE-2017-9433 State: PUBLISHED Published: 2017-06-05T02:47:00 Last Updated: 2024-08-05T17:11:00.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in lib/MsWrd1Parser.cxx. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/libmwaw/libmwaw/ci/68b3b74569881248bfb6cbb4266177cc253b292f/ - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1037 - http://www.debian.org/security/2017/dsa-3875
CVE ID: CVE-2017-9434 State: PUBLISHED Published: 2017-06-05T14:00:00 Last Updated: 2024-08-05T17:11:00.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/06/06/2 - https://github.com/weidai11/cryptopp/issues/414 - https://github.com/weidai11/cryptopp/commit/07dbcc3d9644b18e05c1776db2a57fe04d780965 - http://www.securityfocus.com/bid/99007 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5G
99007 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7IL5A6465IEPW5GAWGXB2ENJPFYVWTJM/
CVE ID: CVE-2017-9435 State: PUBLISHED Published: 2017-06-05T14:00:00Z Last Updated: 2024-09-16T17:07:49.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/commit/70636cc59ffa1ffbc0ce3dba315d7d9b837aad04 - https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog
CVE ID: CVE-2017-9436 State: PUBLISHED Published: 2017-06-05T14:00:00Z Last Updated: 2024-09-16T16:58:54.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nilsteampassnet/TeamPass/blob/master/changelog.md
CVE ID: CVE-2017-9437 State: PUBLISHED Published: 2017-06-05T14:00:00Z Last Updated: 2024-09-17T00:06:04.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Openbravo Business Suite 3.0 is affected by SQL injection. This vulnerability could allow remote authenticated attackers to inject arbitrary SQL code. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-005
CVE ID: CVE-2017-9438 State: PUBLISHED Published: 2017-06-05T17:00:00 Last Updated: 2024-08-05T17:11:00.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VirusTotal/yara/issues/674 - https://github.com/VirusTotal/yara/commit/10e8bd3071677dd1fa76beeef4bc2fc427cea5e7 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor
/10e8bd3071677dd1fa76beeef4bc2fc427cea5e7 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXM224OLGI6KAOROLDPPGGCZ2OQVQ6HH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD/
CVE ID: CVE-2017-9439 State: PUBLISHED Published: 2017-06-05T18:00:00 Last Updated: 2024-08-05T17:11:01.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98907 - https://github.com/ImageMagick/ImageMagick/issues/460
CVE ID: CVE-2017-9440 State: PUBLISHED Published: 2017-06-05T18:00:00 Last Updated: 2024-08-05T17:11:00.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98908 - https://github.com/ImageMagick/ImageMagick/issues/462
CVE ID: CVE-2017-9441 State: PUBLISHED Published: 2017-06-05T19:00:00Z Last Updated: 2024-09-16T23:20:36.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in manifest.json. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all h
nstall\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/290
CVE ID: CVE-2017-9442 State: PUBLISHED Published: 2017-06-05T19:00:00Z Last Updated: 2024-09-17T00:40:29.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files. Additional
must implicitly trust any package or extension you install as they all have the ability to write PHP files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/291
CVE ID: CVE-2017-9443 State: PUBLISHED Published: 2017-06-05T19:00:00Z Last Updated: 2024-09-17T04:20:20.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and core\admin\modules\developer\packages\install\process.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
the ability to write PHP files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/292
CVE ID: CVE-2017-9444 State: PUBLISHED Published: 2017-06-05T19:00:00Z Last Updated: 2024-09-17T03:37:36.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/293
CVE ID: CVE-2017-9445 State: PUBLISHED Published: 2017-06-28T06:00:00 Last Updated: 2024-08-05T17:11:01.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.net/bugs/1695546 - http://www.securitytracker.com/id/1038806 - http://www.securityfocus.com/b
ences: - https://launchpad.net/bugs/1695546 - http://www.securitytracker.com/id/1038806 - http://www.securityfocus.com/bid/99302 - http://openwall.com/lists/oss-security/2017/06/27/8
CVE ID: CVE-2017-9447 State: PUBLISHED Published: 2018-02-28T15:00:00 Last Updated: 2024-08-05T17:11:01.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. A remote, unauthenticated attacker could exploit this weakness to read arbitrary files from the vulnerable system using path traversal sequences. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/442321/ - https://blog.runesec.com/2018/02/22/parallels-ras-path-tra
: References: - https://www.exploit-db.com/exploits/442321/ - https://blog.runesec.com/2018/02/22/parallels-ras-path-traversal/
CVE ID: CVE-2017-9448 State: PUBLISHED Published: 2017-06-06T15:00:00Z Last Updated: 2024-09-16T23:02:10.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged (administrator) users can attack high-privileged (Developer) users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/294
CVE ID: CVE-2017-9449 State: PUBLISHED Published: 2017-06-06T15:00:00Z Last Updated: 2024-09-16T22:36:45.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible at admin/ajax/auto-modules/views/searchable-page/ or admin/modules_name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/295
CVE ID: CVE-2017-9450 State: PUBLISHED Published: 2017-10-30T14:00:00 Last Updated: 2024-08-05T17:11:01.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/aws-cfn-bootstrap-local-code-execution-as-root.txt - https://alas.aws.amazon.com/ALAS-2017-861.html - http://www.securityfocus.com/bid/99972
CVE ID: CVE-2017-9451 State: PUBLISHED Published: 2017-06-06T16:00:00 Last Updated: 2024-08-05T17:11:01.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flatCore/flatCore-CMS/commit/f1b42b338693a9c240182e76ef2131057f2c2a87 - https://github.com/flatCore/flatCore-CMS/issues/34
CVE ID: CVE-2017-9452 State: PUBLISHED Published: 2017-06-06T16:00:00Z Last Updated: 2024-09-17T00:01:09.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/667
CVE ID: CVE-2017-9453 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T17:41:24.472Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.bmc.com/docs/serverautomation/2002/notification-of-critical-security-issue-in-bmc-server-automation-cve-2017-9453-1020706453.html
CVE ID: CVE-2017-9454 State: PUBLISHED Published: 2017-08-18T14:00:00 Last Updated: 2024-08-05T17:11:01.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted DNS response. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/resiprocate/resiprocate/commit/d67a9ca6fd06ca65d23e313bdbad1ef4dd3aa0df - https://list.resiprocate.org/archive/resiprocate-users/msg02700.html
CVE ID: CVE-2017-9457 State: PUBLISHED Published: 2017-07-25T14:00:00 Last Updated: 2024-08-05T17:11:01.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/56 - http://packetstormsecurity.com/files/143481/Compulab-Intense-PC-MintBox-2-Signature-Verification.html - https://watchmysys.com/blog/2017/07/cve-2017-9457-compulab-intense-pc-
ntense-PC-MintBox-2-Signature-Verification.html - https://watchmysys.com/blog/2017/07/cve-2017-9457-compulab-intense-pc-lacks-firmware-validation/
CVE ID: CVE-2017-9458 State: PUBLISHED Published: 2017-09-07T13:00:00 Last Updated: 2024-08-05T17:11:01.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to obtain sensitive information, cause a denial of service, or conduct server-side request forgery (SSRF) attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039256 - http://www.securityfocus.com/bid/100614 - https://
Container: References: - http://www.securitytracker.com/id/1039256 - http://www.securityfocus.com/bid/100614 - https://security.paloaltonetworks.com/CVE-2017-9458
CVE ID: CVE-2017-9459 State: PUBLISHED Published: 2017-08-02T19:00:00 Last Updated: 2024-08-05T17:11:01.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038974 - http://www.securityfocus.com/bid/99902 - https://security.paloaltonetworks.com/CVE-2017-9459
CVE ID: CVE-2017-9461 State: PUBLISHED Published: 2017-06-06T21:00:00 Last Updated: 2024-08-05T17:11:01.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99455 - https://access.redhat.com/errata/RHSA-2017:2778 - https://access.redhat.com/errata/RHSA-2017:1950 - https://access.redhat.com/errata/RHSA-2017:2338 - https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=10c3e3923022485c720f
https://access.redhat.com/errata/RHSA-2017:2338 - https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=10c3e3923022485c720f322ca4f0aca5d7501310 - https://bugzilla.samba.org/show_bug.cgi?id=12572 - https://bugs.debian.org/864291 - https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html
CVE ID: CVE-2017-9462 State: PUBLISHED Published: 2017-06-06T21:00:00 Last Updated: 2024-08-05T17:11:01.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1576 - https://www.mercurial-scm.org/repo/hg/rev/77eaf9539499 - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29 - https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html - http://www.debian.o
rcurial_4.1.3_.282017-4-18.29 - https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html - http://www.debian.org/security/2017/dsa-3963 - https://security.gentoo.org/glsa/201709-18 - https://bugs.debian.org/861243 - http://www.securityfocus.com/bid/99123
CVE ID: CVE-2017-9463 State: PUBLISHED Published: 2017-06-14T19:00:00 Last Updated: 2024-08-05T17:11:01.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: The application Piwigo is affected by a SQL injection vulnerability in version 2.9.0 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The user_list_backend.php component is affected: values of the iDisplayStart & iDisplayLength parameters are not sanitized; these are used to construct a SQL query and retrieve a list of registered users into the application. Additional Analyst Notes: - CVE Pro
construct a SQL query and retrieve a list of registered users into the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/705 - https://github.com/Piwigo/Piwigo/commit/42920897ce927c236728d387f61bf03d117109a2 - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-003
CVE ID: CVE-2017-9464 State: PUBLISHED Published: 2017-06-14T19:00:00 Last Updated: 2024-08-05T17:11:01.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the "redirect" parameter is not validated. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/706 - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-007