Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
sure blood pressure levels of a person. This allows an attacker who is in vicinity of Wireless signal generated by the Blipcare device to easily sniff the credentials. Also, an attacker can connect to the open wireless network "Blip" exposed by the device and modify the HTTP response presented to the user by the device to execute other attacks such as convincing the user to download and execute a malicious binary that would infect a user's computer or mobile device with malware. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.html - https:
19/Jun/8 - http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdf
CVE ID: CVE-2017-11580 State: PUBLISHED Published: 2019-07-02T20:49:56 Last Updated: 2024-08-05T18:12:40.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Blip" open wireless connection provided by the device, if a large string is sent as a part of the HTTP request in any part of the HTTP headers, the device could become completely unresponsive. Presumably this happens as the memory footprint provided to this device is very small. According to the specs from Rezolt, the Wi-Fi module only has 256k of memory. As a result, an incorrect string co
small. According to the specs from Rezolt, the Wi-Fi module only has 256k of memory. As a result, an incorrect string copy operation using either memcpy, strcpy, or any of their other variants could result in filling up the memory space allocated to the function executing and this would result in memory corruption. To test the theory, one can modify the demo application provided by the Cypress WICED SDK and introduce an incorrect "memcpy" operation and use the compiled application on the evaluation board provided by Cypress semiconductors with exactly the same Wi-Fi SOC. The results were identical where the device would completely stop responding to any of the ping or web requests. Additiona
e results were identical where the device would completely stop responding to any of the ping or web requests. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/8 - http://packetstormsecurity.com/files/153225/Blipcare-Clear-Text-Communication-Memory-Corruption.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Blipcare_sec_issues.pdf
CVE ID: CVE-2017-11581 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '<' character. Additional Analyst Notes: - CVE Program Container: References: - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#Reflected-XSS
CVE ID: CVE-2017-11582 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php. Additional Analyst Notes: - CVE Program Container: References: - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#SQL-injection-after-limit-via-system-num-parameter
CVE ID: CVE-2017-11583 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php. Additional Analyst Notes: - CVE Program Container: References: - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#SQL-injection-in-action-related-catid-parameter
CVE ID: CVE-2017-11584 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php. Additional Analyst Notes: - CVE Program Container: References: - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#SQL-injection-via-system-field-parameter
CVE ID: CVE-2017-11585 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection. Additional Analyst Notes: - CVE Program Container: References: - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#remote-php-code-execution
CVE ID: CVE-2017-11586 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php. Additional Analyst Notes: - CVE Program Container: References: - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#URL-Redirector-Abuse
CVE ID: CVE-2017-11587 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is directory traversal in the filename parameter to the /download.conf URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100484 - http://seclists.org/fulldisclosure/2017/Jul/26
CVE ID: CVE-2017-11588 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible at /PingMsg.cmd. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99963 - http://seclists.org/fulldisclosure/2017/Jul/26
CVE ID: CVE-2017-11589 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is no access control for info.html, wancfg.cmd, rtroutecfg.cmd, arpview.cmd, cpuview.cmd, memoryview.cmd, statswan.cmd, statsatm.cmd, scsrvcntr.cmd, scacccntr.cmd, logview.cmd, voicesipview.cmd, usbview.cmd, wlmacflt.cmd, wlwds.cmd, wlstationlist.cmd, HPNAShow.cmd, HPNAView.cmd, qoscls.cmd, qosqueue.cmd, portmap.cmd, scmacflt.cmd, scinflt.cmd, scoutfl
wlstationlist.cmd, HPNAShow.cmd, HPNAView.cmd, qoscls.cmd, qosqueue.cmd, portmap.cmd, scmacflt.cmd, scinflt.cmd, scoutflt.cmd, certlocal.cmd, or certca.cmd. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/26
CVE ID: CVE-2017-11590 State: PUBLISHED Published: 2017-07-24T01:00:00 Last Updated: 2024-08-05T18:12:40.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1473167
CVE ID: CVE-2017-11591 State: PUBLISHED Published: 2017-07-24T00:00:00 Last Updated: 2024-08-05T18:12:40.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3852-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1473888 - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE ID: CVE-2017-11592 State: PUBLISHED Published: 2017-07-24T01:00:00 Last Updated: 2024-08-05T18:12:40.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1473889
CVE ID: CVE-2017-11593 State: PUBLISHED Published: 2017-07-24T01:00:00 Last Updated: 2024-08-05T18:12:40.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files that are designed to be viewed in the browser as plain text, but that will be converted to HTML without proper sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/volca/markdown-preview/issues/60 - https://github.com/volca/m
- CVE Program Container: References: - https://github.com/volca/markdown-preview/issues/60 - https://github.com/volca/markdown-preview/commit/1181f044a5457d5e1ac35804ecd84e05977f1920
CVE ID: CVE-2017-11594 State: PUBLISHED Published: 2017-07-24T01:00:00 Last Updated: 2024-08-05T18:12:40.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/loomio/loomio/issues/4220 - https://github.com/loomio/loomio/releases/tag/1.8.0 - https://github.com/loomio/loomio/commit/63973f71e337ead8ca7b7ae2a043b837032dc3fe
CVE ID: CVE-2017-11600 State: PUBLISHED Published: 2017-07-24T07:00:00 Last Updated: 2024-08-05T18:12:40.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2003 - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.
https://access.redhat.com/errata/RHSA-2018:2003 - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html - https://access.redhat.com/errata/RHSA-2018:1965 - http://www.securityfocus.com/bid/99928 - http://www.debian.org/security/2017/dsa-3981 - https://source.android.com/security/bulletin/pixel/2017-11-01 - http://seclists.org/bugtraq/2017/Jul/30 - https://access.redhat.com/errata/RHSA-2019:1170 - https://access.redhat.com/errata/RHSA-2019:1190
CVE ID: CVE-2017-11605 State: PUBLISHED Published: 2017-07-24T07:00:00 Last Updated: 2024-08-05T18:12:40.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will lead to a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1474019 - http://www.securityfocus.com/bid/99930
CVE ID: CVE-2017-11608 State: PUBLISHED Published: 2017-07-24T12:00:00Z Last Updated: 2024-09-16T17:34:21.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1474276
CVE ID: CVE-2017-11610 State: PUBLISHED Published: 2017-08-23T14:00:00 Last Updated: 2024-08-05T18:12:40.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3005 - https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt - https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt - https://github.com/Supervisor/
lob/3.3.3/CHANGES.txt - https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt - https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/ - https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/ - http://www.debian.org/security/2017/dsa-3942 - https://github.com/Supervisor/su
sage/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/ - http://www.debian.org/security/2017/dsa-3942 - https://github.com/Supervisor/supervisor/issues/964 - https://www.exploit-db.com/exploits/42779/ - https://security.gentoo.org/glsa/201709-06
CVE ID: CVE-2017-11611 State: PUBLISHED Published: 2017-09-08T10:00:00 Last Updated: 2024-08-05T18:12:40.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wolf CMS 0.8.3.1 allows Cross-Site Scripting (XSS) attacks. The vulnerability exists due to insufficient sanitization of the file name in a "create-file-popup" action, and the directory name in a "create-directory-popup" action, in the HTTP POST method to the "/plugin/file_manager/" script (aka an /admin/plugin/file_manager/browse// URI). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/faizzaidi/Wolfcms-v0.8.3.1-xss-POC-by-Provensec-llc
CVE ID: CVE-2017-11612 State: PUBLISHED Published: 2017-07-26T15:00:00 Last Updated: 2024-08-05T18:12:40.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/701-20170605-core-xss-vulnerability.html - http://www.securitytracker.com/id/1039014
CVE ID: CVE-2017-11613 State: PUBLISHED Published: 2017-07-26T08:00:00 Last Updated: 2024-08-05T18:12:40.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer. Additional Anal
td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99977 - https://usn.ubuntu.com/3606-1/ - https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f - https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html - https://www.debian.org/security/2018/dsa-4349 - https://lists.debian.org/debian-lts-announce/2018/07/msg00002.html
CVE ID: CVE-2017-11614 State: PUBLISHED Published: 2017-07-25T17:00:00Z Last Updated: 2024-09-17T00:05:32.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial information. Connex utilizes an IBM i DB2 user account for database access. The account name is HMSCXPDN. Its password is hard-coded in multiple places in the application. Customers do not have the option to change this password. The account has elevated DB2 r
iple places in the application. Customers do not have the option to change this password. The account has elevated DB2 roles, and can access all objects or database tables on the customer DB2 database. This account can access data through ODBC, FTP, and TELNET. Customers without Connex installed are still vulnerable because the MEDHOST setup program creates this account. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/59
CVE ID: CVE-2017-11615 State: PUBLISHED Published: 2017-07-26T15:00:00 Last Updated: 2024-08-05T18:12:40.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: A sandbox escape in the Lua interface in Wube Factorio before 0.15.31 allows remote game servers or user-assisted attackers to execute arbitrary C code by including and loading a C library. Additional Analyst Notes: - CVE Program Container: References: - https://security.gerhardt.link/RCE-in-Factorio/
CVE ID: CVE-2017-11617 State: PUBLISHED Published: 2017-07-25T17:00:00Z Last Updated: 2024-09-16T21:57:18.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/blog/2017/06/how-i-built-an-xss-worm-on-atmail/ - https://help.atmail.com/hc/en-us/articles/115007169147-Minor-Update-7-8-0-2-ActiveSync-2-3-6
CVE ID: CVE-2017-11624 State: PUBLISHED Published: 2017-07-25T23:00:00 Last Updated: 2024-08-05T18:12:40.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop." Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3638-1/ - http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf.html - https://github.com/qpdf/qpdf/issues/117
CVE ID: CVE-2017-11625 State: PUBLISHED Published: 2017-07-25T23:00:00 Last Updated: 2024-08-05T18:12:40.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop." Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3638-1/ - http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_26.html - https://github.com/qpdf/qpdf/issues/120
CVE ID: CVE-2017-11626 State: PUBLISHED Published: 2017-07-25T23:00:00 Last Updated: 2024-08-05T18:12:40.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop." Additional Analyst Notes: - CVE Program Container: References: - http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_65.html - https://usn.ubuntu.com/3638-1/ - https://github.com/qpdf/qpdf/issues/119
CVE ID: CVE-2017-11627 State: PUBLISHED Published: 2017-07-25T23:00:00 Last Updated: 2024-08-05T18:12:40.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function in PointerHolder.hh, aka an "infinite loop." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qpdf/qpdf/issues/118 - https://usn.ubuntu.com/3638-1/ - http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_21.html
CVE ID: CVE-2017-11628 State: PUBLISHED Published: 2017-07-25T23:00:00 Last Updated: 2024-08-05T18:12:40.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives. Additional Analyst Notes: - CVE Program Container: References: - http:
tion for syntax validation of php.ini directives. Additional Analyst Notes: - CVE Program Container: References: - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=05255749139b3686c8a6a58ee01131ac0047465e - https://access.redhat.com/errata/RHSA-2018:1296 - https://security.netapp.com/advisory/ntap-20180112-0001/ - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=5f8380d33e648964d2d5140f329cf2d4c443033c - https://www.debian.org/security/2018/dsa-4081 - https://www.debian.org/security/2018/dsa-4080 - https://bugs.php.net/bug.php?id=74603 - http://www.securityfocus.com/bid/99489 - https://security.gentoo.org/glsa/201709-21
CVE ID: CVE-2017-11629 State: PUBLISHED Published: 2017-07-26T08:00:00 Last Updated: 2024-08-05T18:12:40.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request. Additional Analyst Notes: - CVE Program Container: References: - http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#api-php-Reflected-XSS
CVE ID: CVE-2017-11630 State: PUBLISHED Published: 2017-07-26T08:00:00 Last Updated: 2024-08-05T18:12:40.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FiyoCMS/FiyoCMS/issues/6