Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-17716 State: PUBLISHED Published: 2017-12-17T17:00:00Z Last Updated: 2024-09-16T17:17:49.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/30420 - https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/ - https://about.gitlab.com/2017/07/22/gitlab-
30420 - https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/ - https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification
CVE ID: CVE-2017-17717 State: PUBLISHED Published: 2017-12-17T17:00:00Z Last Updated: 2024-09-16T19:15:53.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/12/17/3
CVE ID: CVE-2017-17718 State: PUBLISHED Published: 2017-12-17T21:00:00 Last Updated: 2024-08-05T20:59:17.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/12/17/10 - https://github.com/ruby-ldap/ruby-net-ldap/issues/258 - https://github.com/ruby-ldap/ruby-net-ldap/pull/279
CVE ID: CVE-2017-17719 State: PUBLISHED Published: 2017-12-19T20:00:00 Last Updated: 2024-08-05T20:59:17.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the result_message parameter to includes/concours_page.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Dec/71 - https://wpvulndb.com/vulnerabilities/8981
CVE ID: CVE-2017-17721 State: PUBLISHED Published: 2017-12-18T16:00:00 Last Updated: 2024-08-05T20:59:17.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.cyber-security.ro/blog/2017/12/20/beims-contractorweb-5-18-0-0-sql-injection/ - https://cxsecurity.com/issue/WLB-2017120155 - https://www.exploit-db.com/exploits/43379/ - https://becomepentester.blogspot.com/2017/12/ZUUSE-BEIMS-Contract
7120155 - https://www.exploit-db.com/exploits/43379/ - https://becomepentester.blogspot.com/2017/12/ZUUSE-BEIMS-ContractorWeb-SQLInjection-CVE-2017-17721.html - https://packetstormsecurity.com/files/145511/BEIMS-ContractorWeb-5.18.0.0-SQL-Injection.html - https://0day.today/exploit/29277
CVE ID: CVE-2017-17722 State: PUBLISHED Published: 2018-02-12T22:00:00 Last Updated: 2024-08-05T20:59:17.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafted TIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1524116
CVE ID: CVE-2017-17723 State: PUBLISHED Published: 2018-02-12T22:00:00 Last Updated: 2024-08-05T20:59:17.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit this vulnerability to disclose memory data or cause a denial of service via a crafted TIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1524104 - https://security.gentoo.org/glsa/201811-14
CVE ID: CVE-2017-17724 State: PUBLISHED Published: 2018-02-12T22:00:00 Last Updated: 2024-08-05T20:59:17.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" case. Remote attackers can exploit this vulnerability to cause a denial of service via a crafted TIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/263 - https://github.com/xiaoqx/pocs/blob/master/exiv2/readme.md - https://security.gentoo.org/glsa/201811-14 - https://bugzilla.redhat.com/show_bug.cgi?id=1524107 - https://access
e.md - https://security.gentoo.org/glsa/201811-14 - https://bugzilla.redhat.com/show_bug.cgi?id=1524107 - https://access.redhat.com/errata/RHSA-2019:2101
CVE ID: CVE-2017-17725 State: PUBLISHED Published: 2018-02-12T22:00:00 Last Updated: 2024-08-05T20:59:17.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. Remote attackers can exploit the vulnerability to cause a denial of service via a crafted image file. Note that this vulnerability is different from CVE-2017-14864, which is an invalid memory address dereference. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/188 - https://bugzilla.redhat.com/show_bug.cgi?id=1525055
CVE ID: CVE-2017-17727 State: PUBLISHED Published: 2017-12-18T05:00:00Z Last Updated: 2024-09-16T21:04:16.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-20050
CVE ID: CVE-2017-17730 State: PUBLISHED Published: 2017-12-18T05:00:00Z Last Updated: 2024-09-16T20:37:12.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php. Additional Analyst Notes: - CVE Program Container: References: - http://0day5.com/archives/1542/
CVE ID: CVE-2017-17731 State: PUBLISHED Published: 2017-12-18T05:00:00Z Last Updated: 2024-09-16T18:55:41.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php. Additional Analyst Notes: - CVE Program Container: References: - http://0day5.com/archives/1346/
CVE ID: CVE-2017-17733 State: PUBLISHED Published: 2017-12-18T05:00:00Z Last Updated: 2024-09-16T23:50:30.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request. Additional Analyst Notes: - CVE Program Container: References: - http://www.0day5.com/archives/4383/
CVE ID: CVE-2017-17734 State: PUBLISHED Published: 2017-12-18T06:00:00Z Last Updated: 2024-09-16T19:19:33.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions. Additional Analyst Notes: - CVE Program Container: References: - https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737 - https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa
CVE ID: CVE-2017-17735 State: PUBLISHED Published: 2017-12-18T06:00:00Z Last Updated: 2024-09-16T16:14:07.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies. Additional Analyst Notes: - CVE Program Container: References: - https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737 - https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa
CVE ID: CVE-2017-17736 State: PUBLISHED Published: 2018-03-23T15:00:00 Last Updated: 2024-08-05T20:59:17.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard. Additional Analyst Notes: - CVE Program Container: References: - https://blog.hivint.com/advisory-access-control-bypass-in-kentico-cms-cve-2017-17736-49e1e43ae55b
CVE ID: CVE-2017-17737 State: PUBLISHED Published: 2017-12-18T06:00:00 Last Updated: 2024-08-05T20:59:17.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html - https://www.exploit-db.com/exploits/43364/
CVE ID: CVE-2017-17738 State: PUBLISHED Published: 2017-12-18T06:00:00 Last Updated: 2024-08-05T20:59:17.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html - https://www.exploit-db.com/exploits/43364/
CVE ID: CVE-2017-17739 State: PUBLISHED Published: 2017-12-18T06:00:00 Last Updated: 2024-08-05T20:59:17.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files. Additional Analyst Notes: - CVE Program Container: References: - http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html - https://www.exploit-db.com/exploits/43364/
CVE ID: CVE-2017-17740 State: PUBLISHED Published: 2017-12-18T06:00:00 Last Updated: 2024-08-05T20:59:17.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html - https://www.oracle.com/s
09/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html - https://www.oracle.com/security-alerts/cpuapr2022.html - http://www.openldap.org/its/index.cgi/Incoming?id=8759 - https://kc.mcafee.com/corporate/index?page=content&id=SB10365
CVE ID: CVE-2017-17741 State: PUBLISHED Published: 2017-12-18T08:00:00 Last Updated: 2024-08-05T20:59:17.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://usn.ubuntu.com/3617-3/ - https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html -
y/2018/dsa-4082 - https://usn.ubuntu.com/3617-3/ - https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html - https://usn.ubuntu.com/3632-1/ - http://www.securityfocus.com/bid/102227 - https://usn.ubuntu.com/3620-2/ - https://www.spinics.net/lists/kvm/msg160796.html - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/3617-2/ - https://usn.ubuntu.com/3620-1/ - https://usn.ubuntu.com/3619-1/
CVE ID: CVE-2017-17742 State: PUBLISHED Published: 2018-04-03T00:00:00 Last Updated: 2024-08-05T20:59:17.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3685-1/ - https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/ - http://www.securityfocus.com/bid/103684 - https://access.redhat.com/errata/RHSA-2018:3729 - http://www.securitytracker.com/
p://www.securityfocus.com/bid/103684 - https://access.redhat.com/errata/RHSA-2018:3729 - http://www.securitytracker.com/id/1042004 - https://access.redhat.com/errata/RHSA-2018:3730 - https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html - https://access.redhat.com/errata/RHSA-2018:3731 - https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/ - https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html - https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/ - https://www.debian.org/security/2018/dsa-4259 - https://www.ruby-lang.org/en/news/2018/03/28/ru
8/ruby-2-4-4-released/ - https://www.debian.org/security/2018/dsa-4259 - https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/ - https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:2028 - https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
CVE ID: CVE-2017-17743 State: PUBLISHED Published: 2018-03-22T05:00:00 Last Updated: 2024-08-05T20:59:17.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.19, and 5.1.x before 5.1.11 allows authenticated remote attackers to escape the shell and escalate their privileges by uploading a .bashrc file containing the /bin/sh string. In some situations, authentication can be achieved via the bhu85tgb default password for the admin account. Additional Analyst Notes: - CVE Program Container: References: - https://securite.intrinsec.com/2018/03/19/c
in account. Additional Analyst Notes: - CVE Program Container: References: - https://securite.intrinsec.com/2018/03/19/cve-2017-17743-ucopia-shell-escape/
CVE ID: CVE-2017-17744 State: PUBLISHED Published: 2017-12-19T20:00:00 Last Updated: 2024-08-05T20:59:17.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter to view/advancedsettings.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8982 - http://seclists.org/fulldisclosure/2017/Dec/72
CVE ID: CVE-2017-17745 State: PUBLISHED Published: 2017-12-20T20:00:00 Last Updated: 2024-08-05T20:59:17.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Dec/67
CVE ID: CVE-2017-17746 State: PUBLISHED Published: 2017-12-20T20:00:00 Last Updated: 2024-08-05T20:59:17.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. The authentication record is stored on the device; thus if an administrator authenticates from a NAT network, the authentication applies to the IP address of the NAT gateway, and any user behind that NAT gateway is also treated as authenticated. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/20
as authenticated. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Dec/67
CVE ID: CVE-2017-17747 State: PUBLISHED Published: 2017-12-20T20:00:00 Last Updated: 2024-08-05T20:59:17.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Dec/67
CVE ID: CVE-2017-17749 State: PUBLISHED Published: 2018-03-24T18:00:00 Last Updated: 2024-08-05T20:59:17.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora. Additional Analyst Notes: - CVE Program Container: References: - http://aryanitin.com/2017-01-01-CVE-2017-17749/
CVE ID: CVE-2017-17750 State: PUBLISHED Published: 2018-03-24T18:00:00 Last Updated: 2024-08-05T20:59:17.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify. Additional Analyst Notes: - CVE Program Container: References: - http://aryanitin.com/2017-12-20-CVE-2017-17750/
CVE ID: CVE-2017-17751 State: PUBLISHED Published: 2018-03-24T18:00:00 Last Updated: 2024-08-05T20:59:17.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol. Additional Analyst Notes: - CVE Program Container: References: - http://aryanitin.com/2017-12-20-CVE-2017-17751/
CVE ID: CVE-2017-17752 State: PUBLISHED Published: 2017-12-20T16:00:00 Last Updated: 2024-08-05T20:59:17.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43378/
CVE ID: CVE-2017-17753 State: PUBLISHED Published: 2017-12-19T20:00:00 Last Updated: 2024-08-05T20:59:17.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cie_type, (2) cie_import, (3) cie_update, or (4) cie_ignore parameter to includes/admin/views/esb-cie-import-export-page.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Dec/73
CVE ID: CVE-2017-17757 State: PUBLISHED Published: 2017-12-19T07:00:00 Last Updated: 2024-08-05T20:59:17.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt
CVE ID: CVE-2017-17758 State: PUBLISHED Published: 2017-12-19T07:00:00 Last Updated: 2024-08-05T20:59:17.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zone_get_iface_bydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Dhcps_Authenticated_RCE_Record.txt
CVE ID: CVE-2017-17759 State: PUBLISHED Published: 2017-12-19T07:00:00 Last Updated: 2024-08-05T20:59:17.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of service (by deleting the configuration) via a wc.dll?wwMaint~EditConfig request (which reaches an older version of a West Wind Web Connection HTTP service). Additional Analyst Notes: - CVE Program Container: References: - http://www.information-paradox.net/2017/12/conarc-ichannel-unauthenticated.html - https://www.exploit-db.com/exploits/43377/
CVE ID: CVE-2017-17760 State: PUBLISHED Published: 2017-12-29T18:00:00 Last Updated: 2024-08-05T20:59:17.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html - https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html - https://github.com/opencv/opencv/issues/10351 - https://github.com/opencv/opencv/pull/10369/commits/7bbe1a53cfc097b82b1589f7915a2120de39274c - http://www.securityfocus.com/bid/102974 - https://
/opencv/pull/10369/commits/7bbe1a53cfc097b82b1589f7915a2120de39274c - http://www.securityfocus.com/bid/102974 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2017-17761 State: PUBLISHED Published: 2017-12-19T21:00:00 Last Updated: 2024-08-05T20:59:17.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 1300 that allows a remote (LAN) unauthenticated user to run arbitrary commands. This binary requires the "system" XML element for specifying the command. For example, a <system>id</system> command results in a <system_ack>ok</system_ack> response. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102974 - https://blogs.securiteam.com/index.php/archives/3576
CVE ID: CVE-2017-17762 State: PUBLISHED Published: 2018-08-29T19:00:00 Last Updated: 2024-08-05T20:59:17.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/jonaslejon/5f92779848360a1a1e676af0795bd9aa - https://kryptera.se/sarbarhet-i-episerver/
CVE ID: CVE-2017-17763 State: PUBLISHED Published: 2017-12-19T23:00:00Z Last Updated: 2024-09-16T23:20:47.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection. Additional Analyst Notes: - CVE Program Container: References: - https://thinktanksec.github.io/