Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- https://blogs.gentoo.org/ago/2017/03/27/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862-and-cve-2016-8866/ - http://www.securityfocus.com/bid/97166
CVE ID: CVE-2017-7276 State: PUBLISHED Published: 2017-07-04T18:00:00 Last Updated: 2024-08-05T15:56:36.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is reflected XSS in TOPdesk before 5.7.6 and 6.x and 7.x before 7.03.019. Additional Analyst Notes: - CVE Program Container: References: - http://page.topdesk.com/cve-2017-7276
CVE ID: CVE-2017-7277 State: PUBLISHED Published: 2017-03-28T06:04:00 Last Updated: 2024-08-05T15:56:36.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TCP stack in the Linux kernel through 4.10.6 mishandles the SCM_TIMESTAMPING_OPT_STATS feature, which allows local users to obtain sensitive information from the kernel's internal socket data structures or cause a denial of service (out-of-bounds read) via crafted system calls, related to net/core/skbuff.c and net/socket.c. Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.ozlabs.org/patch/740636/ - https://lkml.org/lkml/2017/3/15/485 - https://github.com/torvalds/linux/commit/8605330aac5a5
.ozlabs.org/patch/740636/ - https://lkml.org/lkml/2017/3/15/485 - https://github.com/torvalds/linux/commit/8605330aac5a5785630aec8f64378a54891937cc - https://patchwork.ozlabs.org/patch/740639/ - http://www.securityfocus.com/bid/97141 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ef1b2869447411ad3ef91ad7d4891a83c1a509a - https://github.com/torvalds/linux/commit/4ef1b2869447411ad3ef91ad7d4891a83c1a509a - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8605330aac5a5785630aec8f64378a54891937cc
CVE ID: CVE-2017-7278 State: PUBLISHED Published: 2017-08-18T14:00:00 Last Updated: 2024-08-05T15:56:36.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in ASSA ABLOY APTUS Styra Porttelefonkort 4400 before A2 has unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.aptus.se/sv/site/aptusse/support/sakerhetsuppdatering/
CVE ID: CVE-2017-7279 State: PUBLISHED Published: 2017-04-12T22:00:00 Last Updated: 2024-08-05T15:56:36.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login. Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1/
CVE ID: CVE-2017-7280 State: PUBLISHED Published: 2017-04-12T22:00:00 Last Updated: 2024-08-05T15:56:36.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable. Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1/
CVE ID: CVE-2017-7281 State: PUBLISHED Published: 2017-04-12T22:00:00 Last Updated: 2024-08-05T15:56:36.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated user to create a randomly named file on disk with a user-controlled extension, contents, and path, leading to remote code execution, aka Unrestricted File Upload. Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1/
CVE ID: CVE-2017-7282 State: PUBLISHED Published: 2017-04-20T02:43:00 Last Updated: 2024-08-05T15:56:36.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI). Additional Analyst Notes: - CVE Program Container: References: - https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1 - https://rhinosecuritylabs.com/research/rem
rt.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1 - https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/
CVE ID: CVE-2017-7283 State: PUBLISHED Published: 2017-04-20T02:43:00 Last Updated: 2024-08-05T15:56:36.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php. Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/ - https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWBAA0/000005557?r=1
CVE ID: CVE-2017-7284 State: PUBLISHED Published: 2017-04-12T22:00:00 Last Updated: 2024-08-05T15:56:36.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the logged in account without knowing the current password. This allows for an account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-1/
CVE ID: CVE-2017-7285 State: PUBLISHED Published: 2017-03-29T14:00:00 Last Updated: 2024-08-05T15:56:36.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets, preventing the affected router from accepting new TCP connections. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2017030242 - https://www.exploit-db.com/exploits/41752/ - http://www.securityfocus.com/bid/97266
CVE ID: CVE-2017-7286 State: REJECTED Published: 2017-04-10T10:56:00 Last Updated: 2017-04-13T11:57:01 Description: No description available.
CVE ID: CVE-2017-7288 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-05T15:56:36.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98081 - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.1 - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE ID: CVE-2017-7290 State: PUBLISHED Published: 2017-03-30T07:00:00 Last Updated: 2024-08-05T15:56:36.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/jk1986/3b304ac6b4ae52ae667bba380c2dce19 - http://www.securityfocus.com/bid/97230
CVE ID: CVE-2017-7293 State: PUBLISHED Published: 2017-04-26T05:28:00 Last Updated: 2024-08-05T15:56:36.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary system privileges, because these services have .NET code for DCOM. This affects Dolby Audio X2 (DAX2) 1.0, 1.0.1, 1.1, 1.1.1, 1.2, 1.3, 1.3.1, 1.3.2, 1.4, 1.4.1, 1.4.2, 1.4.3, and 1.4.4 and Dolby Audio X3 (DAX3) 1.0 and 1.1. An example affected driver is Realtek Audio Driver 6.0.1.7898 on a Lenovo P50. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/e
.0.1.7898 on a Lenovo P50. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41933/ - https://bugs.chromium.org/p/project-zero/issues/detail?id=1075
CVE ID: CVE-2017-7294 State: PUBLISHED Published: 2017-03-29T01:32:00 Last Updated: 2024-08-05T15:56:36.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1436798 - https://access.redhat.com/
- CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1436798 - https://access.redhat.com/errata/RHSA-2018:1062 - https://access.redhat.com/errata/RHSA-2018:0676 - https://lists.freedesktop.org/archives/dri-devel/2017-March/137094.html - http://www.securityfocus.com/bid/97177
CVE ID: CVE-2017-7295 State: PUBLISHED Published: 2017-05-28T00:00:00 Last Updated: 2024-08-05T15:56:36.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki Operating System 3.0. A use-after-free vulnerability exists in httpd-simple.c in cc26xx-web-demo httpd, where upon a connection close event, the http_state structure was not deallocated properly, resulting in a NULL pointer dereference in the output processing function. This resulted in a board crash, which can be used to perform denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/jackmcbride/c9328627f1ee104ce84f3fb7eff42f1e
CVE ID: CVE-2017-7296 State: PUBLISHED Published: 2017-05-28T00:00:00 Last Updated: 2024-08-05T15:56:36.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Contiki Operating System 3.0. A Persistent XSS vulnerability is present in the MQTT/IBM Cloud Config page (aka mqtt.html) of cc26xx-web-demo. The cc26xx-web-demo features a webserver that runs on a constrained device. That particular page allows a user to remotely configure that device's operation by sending HTTP POST requests. The vulnerability consists of improper input sanitisation of the text fields on the MQTT/IBM Cloud config page, allowing for JavaScript code injection. Additional Analyst Note
on of the text fields on the MQTT/IBM Cloud config page, allowing for JavaScript code injection. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/jackmcbride/c9328627f1ee104ce84f3fb7eff42f1e - http://www.securityfocus.com/bid/98790
CVE ID: CVE-2017-7297 State: PUBLISHED Published: 2017-03-29T00:00:00 Last Updated: 2024-08-05T15:56:36.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97180 - https://github.com/rancher/rancher/issues/8296
CVE ID: CVE-2017-7298 State: PUBLISHED Published: 2017-03-29T05:23:00 Last Updated: 2024-08-05T15:56:36.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element. Additional Analyst Notes: - CVE Program Container: References: - http://www.daimacn.com/index.php/post/12.html - http://www.securityfocus.com/bid/97182 - http://www.daimacn.com/post/12.html
CVE ID: CVE-2017-7299 State: PUBLISHED Published: 2017-03-29T15:00:00 Last Updated: 2024-08-05T15:56:36.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=20908 - http://www.securityfocus.com/bid/97217
CVE ID: CVE-2017-7300 State: PUBLISHED Published: 2017-03-29T15:00:00 Last Updated: 2024-08-05T15:56:36.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97219 - https://sourceware.org/bugzilla/show_bug.cgi?id=20909
CVE ID: CVE-2017-7301 State: PUBLISHED Published: 2017-03-29T15:00:00 Last Updated: 2024-08-05T15:56:36.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97218 - https://sourceware.org/bugzilla/show_bug.cgi?id=20924
CVE ID: CVE-2017-7302 State: PUBLISHED Published: 2017-03-29T15:00:00 Last Updated: 2024-08-05T15:56:36.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=20921 - http://www.securityfocus.com/bid/97216
CVE ID: CVE-2017-7303 State: PUBLISHED Published: 2017-03-29T15:00:00 Last Updated: 2024-08-05T15:56:36.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=20922 - http://www.securityfocus.com/bid/97213
CVE ID: CVE-2017-7304 State: PUBLISHED Published: 2017-03-29T15:00:00 Last Updated: 2024-08-05T15:56:36.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97215 - https://sourceware.org/bugzilla/show_bug.cgi?id=20931
CVE ID: CVE-2017-7305 State: PUBLISHED Published: 2017-04-04T16:00:00 Last Updated: 2024-08-05T15:56:36.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism via a crafted boot. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contains correct computational logic for a bootloader password; however, this password is optional to meet different customers' needs Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - http://seclists.org/fulldi
mers' needs Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Feb/25 - https://supportkb.riverbed.com/support/index?page=content&id=S30065
CVE ID: CVE-2017-7306 State: PUBLISHED Published: 2017-04-04T16:00:00 Last Updated: 2024-08-05T15:56:36.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Riverbed RiOS through 9.6.0 has a weak default password for the secure vault, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism by leveraging knowledge of the password algorithm and the appliance serial number. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contains correct computational logic for supporting arbitrary password changes by customers; however, a password change is optional to meet different customers' needs Ad
ng arbitrary password changes by customers; however, a password change is optional to meet different customers' needs Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Feb/25 - https://supportkb.riverbed.com/support/index?page=content&id=S30065
CVE ID: CVE-2017-7307 State: PUBLISHED Published: 2017-04-04T16:00:00 Last Updated: 2024-08-05T15:56:36.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Riverbed RiOS before 9.0.1 does not properly restrict shell access in single-user mode, which makes it easier for physically proximate attackers to obtain root privileges and access decrypted data by replacing the /opt/tms/bin/cli file. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Feb/25 - https://supportkb.riverbed.com/support/index?page=content&id=S30065
CVE ID: CVE-2017-7308 State: PUBLISHED Published: 2017-03-29T20:00:00 Last Updated: 2024-08-05T15:56:36.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1308 - https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.h
s.redhat.com/errata/RHSA-2017:1308 - https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html - https://source.android.com/security/bulletin/2017-07-01 - https://access.redhat.com/errata/RHSA-2018:1854 - http://www.securityfocus.com/bid/97234 - https://patchwork.ozlabs.org/patch/744812/ - https://www.exploit-db.com/exploits/41994/ - https://patchwork.ozlabs.org/patch/744813/ - https://www.exploit-db.com/exploits/44654/ - https://patchwork.ozlabs.org/patch/744811/ - https://access.redhat.com/errata/RHSA-2017:1298 - https://access.redhat.com/errata/RHSA-2017:1297
CVE ID: CVE-2017-7309 State: PUBLISHED Published: 2017-03-31T04:26:00 Last Updated: 2024-08-05T15:56:36.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Additional Analyst Notes: - CVE Program Container: References: - http://www.mantisbt.org/bugs/view.php?id=22579 - http://openwall.com/lists/oss-security/2017/03/30/4 - http://www.securitytracker.com/id/1038169 - http://www.securityfocus.com/bid/97251
CVE ID: CVE-2017-7310 State: PUBLISHED Published: 2017-03-29T21:00:00 Last Updated: 2024-08-05T15:56:36.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout before 10.6, and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML file containing a long name attribute of a classify element. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41771/ - https://www.exploit-db.com/exploits/43875/ - https://www.exploit-db.com/exploits/441
ww.exploit-db.com/exploits/41771/ - https://www.exploit-db.com/exploits/43875/ - https://www.exploit-db.com/exploits/44157/ - https://www.exploit-db.com/exploits/41773/ - http://www.dupscout.com/news.html - http://www.diskpulse.com/news.html - http://www.diskboss.com/news.html - http://www.vxsearch.com/news.html - http://www.disksorter.com/news.html - http://www.securityfocus.com/bid/97237 - https://www.exploit-db.com/exploits/41772/ - http://www.disksavvy.com/news.html - http://www.syncbreeze.com/news.html
CVE ID: CVE-2017-7312 State: PUBLISHED Published: 2017-06-07T13:00:00 Last Updated: 2024-08-05T15:56:36.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data (including usernames and passwords). Additional Analyst Notes: - CVE Program Container: References: - https://amswoes.wordpress.com/2017/06/06/first-blog-post/
CVE ID: CVE-2017-7313 State: PUBLISHED Published: 2017-06-07T13:00:00 Last Updated: 2024-08-05T15:56:36.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required. Additional Analyst Notes: - CVE Program Container: References: - https://amswoes.wordpress.com/2017/06/06/cve-2017-7313-how-to-dump-personify-customer-data-with-one-click-23/
CVE ID: CVE-2017-7314 State: PUBLISHED Published: 2017-06-07T13:00:00 Last Updated: 2024-08-05T15:56:36.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available. Additional Analyst Notes: - CVE Program Container: References: - https://amswoes.wordpress.com/2017/06/06/cve-2017-7314-dump-personify-database-schema-33/
CVE ID: CVE-2017-7315 State: PUBLISHED Published: 2017-07-04T02:00:00 Last Updated: 2024-08-05T15:56:36.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jun/45