Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-15637 State: PUBLISHED Published: 2018-01-11T16:00:00 Last Updated: 2024-08-05T19:57:27.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_server.lua file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt - http://www.securityfocus.com/archive/1/541655/100/0/threaded
CVE ID: CVE-2017-15638 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T19:57:27.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SuSEfirewall2 package before 3.6.312-2.13.1 in SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12 SP2; before 3.6.312.333-3.10.1 in SLE Desktop 12 SP3 and Server 12 SP3; before 3.6_SVNr208-2.18.3.1 in SLE Server 11 SP4; before 3.6.312-5.9.1 in openSUSE Leap 42.2; and before 3.6.312.333-7.1 in openSUSE Leap 42.3 might allow remote attackers to bypass intended access restrictions on the portmap service by leveraging a missing source net restriction for _rpc_ services. Additional Analys
restrictions on the portmap service by leveraging a missing source net restriction for _rpc_ services. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2017-11/msg00014.html
CVE ID: CVE-2017-15639 State: PUBLISHED Published: 2017-10-19T19:00:00 Last Updated: 2024-08-05T19:57:27.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43045/ - http://www.securityfocus.com/bid/101603 - http://www.getmura.com/blog/critical-security-update-for-mura-cms-version-6-1-and-earlier/
CVE ID: CVE-2017-15640 State: PUBLISHED Published: 2018-04-21T21:00:00 Last Updated: 2024-08-05T19:57:27.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpipam/phpipam/releases/tag/1.3.1 - https://github.com/phpipam/phpipam/issues/1521
CVE ID: CVE-2017-15642 State: PUBLISHED Published: 2017-10-19T19:00:00 Last Updated: 2024-08-05T19:57:27.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: In lsx_aiffstartread in aiff.c in Sound eXchange (SoX) 14.4.2, there is a Use-After-Free vulnerability triggered by supplying a malformed AIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/sox/bugs/298/ - https://lists.debian.org/debian-lts-announce/2017/11/msg00043.html - https://security.gentoo.org/glsa/201810-02 - https://sourceforge.net/p/sox/bugs/297/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00042.html
CVE ID: CVE-2017-15643 State: PUBLISHED Published: 2017-10-19T22:00:00Z Last Updated: 2024-09-17T03:22:55.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP for updates along with a CRC32 checksum and an update value for verification of the downloaded files. The attacker first forces the client to initiate an update transaction by modifying an update field within an HTTP 200 response, so that it refers to a nonexistent update. The attacker then modifies the HTTP 404 response so that it specifies a successfully found update
a nonexistent update. The attacker then modifies the HTTP 404 response so that it specifies a successfully found update, with a Trojan horse executable file (e.g., guardxup.exe) and the correct CRC32 checksum for that file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3485 - https://www.ikarussecurity.com/about-ikarus/security-blog/vulnerability-in-windows-antivirus-products-ik-sa-2017-0001/
CVE ID: CVE-2017-15644 State: PUBLISHED Published: 2017-10-19T22:00:00Z Last Updated: 2024-09-16T20:07:05.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000. Additional Analyst Notes: - CVE Program Container: References: - http://www.webmin.com/security.html - https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9 - https://blogs.securiteam.com/index.php/archives/3430 - http://www.webmin.com/changes.html
CVE ID: CVE-2017-15645 State: PUBLISHED Published: 2017-10-19T22:00:00Z Last Updated: 2024-09-16T17:53:07.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - http://www.webmin.com/security.html - https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9 - https://blogs.securiteam.com/index.php/archives/3430 - http://www.webmin.com/changes.html
CVE ID: CVE-2017-15646 State: PUBLISHED Published: 2017-10-19T22:00:00Z Last Updated: 2024-09-17T00:11:41.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element. Additional Analyst Notes: - CVE Program Container: References: - http://www.webmin.com/security.html - ht
input element. Additional Analyst Notes: - CVE Program Container: References: - http://www.webmin.com/security.html - https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9 - https://blogs.securiteam.com/index.php/archives/3430 - http://www.webmin.com/changes.html
CVE ID: CVE-2017-15647 State: PUBLISHED Published: 2017-10-19T22:00:00Z Last Updated: 2024-09-16T18:44:22.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3472
CVE ID: CVE-2017-15648 State: PUBLISHED Published: 2017-10-19T22:00:00Z Last Updated: 2024-09-16T17:43:46.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.phpsugar.com/blog/2017/10/php-melody-v2-7-3-maintenance-release/ - https://blogs.securiteam.com/index.php/archives/3464
CVE ID: CVE-2017-15649 State: PUBLISHED Published: 2017-10-19T22:00:00 Last Updated: 2024-08-05T19:57:27.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=008ba2a13f2d04c947adc536d19debb8fe66f110 - https://blogs.securite
rg/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=008ba2a13f2d04c947adc536d19debb8fe66f110 - https://blogs.securiteam.com/index.php/archives/3484 - http://www.securityfocus.com/bid/101573 - https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html - https://access.redhat.com/errata/RHSA-2018:0181 - http://patchwork.ozlabs.org/patch/813945/ - https://usn.ubuntu.com/3754-1/ - https://access.redhat.com/errata/RHSA-2018:0152 - http://patchwork.ozlabs.org/patch/818726/ - https://access.redhat.com/errata/RHSA-2018:0151 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4971613c1639d8e5f102c4e797c3bf8f83a5a69e - https://github.com/torvalds/linux/commit/4971613
orvalds/linux.git/commit/?id=4971613c1639d8e5f102c4e797c3bf8f83a5a69e - https://github.com/torvalds/linux/commit/4971613c1639d8e5f102c4e797c3bf8f83a5a69e - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.6 - https://github.com/torvalds/linux/commit/008ba2a13f2d04c947adc536d19debb8fe66f110
CVE ID: CVE-2017-15650 State: PUBLISHED Published: 2017-10-19T23:00:00 Last Updated: 2024-08-05T19:57:27.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses, and thus an attacker can provide an unexpected number by sending A records in a reply to an AAAA query. Additional Analyst Notes: - CVE Program Container: References: - http://git.musl-libc.org/cgit/musl/commit/?id=45ca5d3fcb6f874bf5ba55d0e9651cef68515395 - http://git.musl-libc.org/cgit/musl/tree/WHATSNEW - http://openwall.com/lists/oss-security/2017/10/19/5
CVE ID: CVE-2017-15651 State: PUBLISHED Published: 2017-10-20T00:00:00 Last Updated: 2024-08-05T19:57:27.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG Network Monitor 17.3.33.2830 allows remote authenticated administrators to execute arbitrary code by uploading a .exe file and then proceeding in spite of the error message. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issue-on-prtg-network-manager-ada65b45d37b
CVE ID: CVE-2017-15652 State: PUBLISHED Published: 2019-05-23T14:55:01 Last Updated: 2024-08-05T19:57:27.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga (imagemagick used that). The attack vector is: Someone must open a postscript file though ghostscript. Because of imagemagick also use libga, so it was affected as well. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=698676 - http://git.ghostscript.com/?p=ghostp
gram Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=698676 - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=2fc463d0e - http://www.securityfocus.com/bid/108463
CVE ID: CVE-2017-15653 State: PUBLISHED Published: 2018-01-31T20:00:00 Last Updated: 2024-08-05T19:57:27.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized user to execute any action knowing administrator session token by using a specific User-Agent string. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jan/63 - http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
CVE ID: CVE-2017-15654 State: PUBLISHED Published: 2018-01-31T20:00:00 Last Updated: 2024-08-05T19:57:27.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Highly predictable session tokens in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allow gaining administrative router access. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jan/63 - http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
CVE ID: CVE-2017-15655 State: PUBLISHED Published: 2018-01-31T20:00:00 Last Updated: 2024-08-05T19:57:27.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages. Additional Analyst Notes: - CVE Program Container: References: - http://sploit.tech/2018/01/16/ASUS-part-I.html - http://secli
onal Analyst Notes: - CVE Program Container: References: - http://sploit.tech/2018/01/16/ASUS-part-I.html - http://seclists.org/fulldisclosure/2018/Jan/63 - http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
CVE ID: CVE-2017-15656 State: PUBLISHED Published: 2018-01-31T20:00:00 Last Updated: 2024-08-05T19:57:27.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: Password are stored in plaintext in nvram in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Jan/63 - http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
CVE ID: CVE-2017-15662 State: PUBLISHED Published: 2018-01-10T18:00:00 Last Updated: 2024-08-05T19:57:27.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145764/VX-Search-Enterprise-10.1.12-Denial-Of-Service.html - https://www.exploit-db.com/exploits/43451/
CVE ID: CVE-2017-15663 State: PUBLISHED Published: 2018-01-10T18:00:00 Last Updated: 2024-08-05T19:57:27.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145763/Disk-Pulse-Enterprise-10.1.18-Denial-Of-Service.html - https://www.exploit-db.com/exploits/43589/ - https://www.exploit-db.com/exploits/43452/
CVE ID: CVE-2017-15664 State: PUBLISHED Published: 2018-01-10T18:00:00 Last Updated: 2024-08-05T19:57:27.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145760/Sync-Breeze-Enterprise-10.1.16-Denial-Of-Service.html - https://www.exploit-db.com/exploits/43453/
CVE ID: CVE-2017-15665 State: PUBLISHED Published: 2018-01-10T18:00:00 Last Updated: 2024-08-05T19:57:27.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 8094. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43454/ - http://packetstormsecurity.com/files/145756/DiskBoss-Enterprise-8.5.12-Denial-Of-Service.html
CVE ID: CVE-2017-15667 State: PUBLISHED Published: 2017-12-28T17:00:00 Last Updated: 2024-08-05T19:57:27.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9221. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43403/
CVE ID: CVE-2017-15670 State: PUBLISHED Published: 2017-10-20T17:00:00 Last Updated: 2024-08-05T19:57:27.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22320 - http://www.securityfocus.com/bid/101521 - https://access.redhat.com/errata/RHSA-2018:1879 - https://access.redhat.com/errata/RHSA-2018:0805
CVE ID: CVE-2017-15671 State: PUBLISHED Published: 2017-10-20T17:00:00 Last Updated: 2024-08-05T19:57:27.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak). Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22325 - http://www.securityfocus.com/bid/101517
CVE ID: CVE-2017-15672 State: PUBLISHED Published: 2017-11-06T17:00:00 Last Updated: 2024-08-05T19:57:27.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101690 - http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c20f4fcb74da2d0432c7b54499bb98f48236b904 - http://www.openwall.com/lists/oss-security/2017/11/03/4 - https://lists.debian.org/debian-lts-announce/2019/01/msg000
- http://www.openwall.com/lists/oss-security/2017/11/03/4 - https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html - https://www.debian.org/security/2017/dsa-4049 - https://github.com/FFmpeg/FFmpeg/commit/d893253fcd93d11258e98857175e93be7d158708
CVE ID: CVE-2017-15673 State: PUBLISHED Published: 2017-11-28T15:00:00 Last Updated: 2024-08-05T19:57:27.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom page. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145096/CSC-Cart-4.6.2-Shell-Upload.html
CVE ID: CVE-2017-15680 State: PUBLISHED Published: 2020-11-27T17:34:32 Last Updated: 2024-08-05T19:57:27.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data. Additional Analyst Notes: - CVE Program Container: References: - http://crafter.com - https://docs.craftercms.org/en/3.0/security/advisory.html
CVE ID: CVE-2017-15681 State: PUBLISHED Published: 2020-11-27T17:33:24 Last Updated: 2024-08-05T19:57:27.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE. Additional Analyst Notes: - CVE Program Container: References: - http://crafter.com - https://docs.craftercms.org/en/3.0/security/advisory.html
CVE ID: CVE-2017-15682 State: PUBLISHED Published: 2020-11-27T17:32:08 Last Updated: 2024-08-05T19:57:27.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel. Additional Analyst Notes: - CVE Program Container: References: - http://crafter.com - https://docs.craftercms.org/en/3.0/security/advisory.html
CVE ID: CVE-2017-15683 State: PUBLISHED Published: 2020-11-27T17:30:54 Last Updated: 2024-08-05T19:57:27.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band. Additional Analyst Notes: - CVE Program Container: References: - http://crafter.com - https://docs.craftercms.org/en/3.0/security/advisory.html
CVE ID: CVE-2017-15684 State: PUBLISHED Published: 2020-11-27T17:28:19 Last Updated: 2024-08-05T19:57:27.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system. Additional Analyst Notes: - CVE Program Container: References: - http://crafter.com - https://docs.craftercms.org/en/3.0/security/advisory.html
CVE ID: CVE-2017-15685 State: PUBLISHED Published: 2020-11-27T17:26:43 Last Updated: 2024-08-05T19:57:27.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band. Additional Analyst Notes: - CVE Program Container: References: - http://crafter.com - https://docs.craftercms.org/en/3.0/security/advisory.html
CVE ID: CVE-2017-15686 State: PUBLISHED Published: 2020-11-27T17:24:46 Last Updated: 2024-08-05T20:04:48.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.0/security/advisory.html
CVE ID: CVE-2017-15687 State: PUBLISHED Published: 2017-10-23T08:00:00 Last Updated: 2024-08-05T20:04:48.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43024/ - https://fireshellsecurity.team/assets/pdf/DOM-Based-Cross-Site-Scripting-_XSS_-Logitech-Media-Server.pdf
CVE ID: CVE-2017-15691 State: PUBLISHED Published: 2018-04-26T17:00:00Z Last Updated: 2024-09-16T23:42:23.280Z Vendors: Apache Software Foundation Products: Apache UIMA Problem Types: Information Disclosure Description: In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content. Additional Analy
hich could be tainted in ways to cause inadvertent disclosure of local files or other internal content. Additional Analyst Notes: - CVE Program Container: References: - https://uima.apache.org/security_report#CVE-2017-15691 - https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:1545