Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7870 State: PUBLISHED Published: 2017-04-14T04:30:00 Last Updated: 2024-08-05T16:19:29.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3837 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372 - http://www.securityfocus.com/bid/97671 - https://access.redhat.com/errata/RHSA-2017:1975 - https://github.com/LibreOffice/core/commit/62a97e6a561ce65e88d4c537a1b82c336f012722 - http:/
com/errata/RHSA-2017:1975 - https://github.com/LibreOffice/core/commit/62a97e6a561ce65e88d4c537a1b82c336f012722 - http://www.securitytracker.com/id/1039029 - http://www.libreoffice.org/about-us/security/advisories/cve-2017-7870/ - https://security.gentoo.org/glsa/201706-28
CVE ID: CVE-2017-7871 State: PUBLISHED Published: 2017-04-14T18:00:00Z Last Updated: 2024-09-17T00:11:20.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/trollepierre/tdm/commit/2e89019d6a491f0a5ac3db8732181f6eb1d219aa - https://github.com/trollepierre/tdm/issues/50
CVE ID: CVE-2017-7874 State: REJECTED Published: 2017-04-15T16:00:00 Last Updated: 2017-04-19T11:57:01 Description: No description available.
CVE ID: CVE-2017-7875 State: PUBLISHED Published: 2017-04-14T18:00:00 Last Updated: 2024-08-05T16:19:28.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201707-08 - https://feh.finalrewind.org/ - http://www.securityfocus.com/bid/97689 - https://github.com/derf/feh/commit/f7a547b7ef8fc8ebdeaa4c28515c9d72e592fb6d - https://lists.de
rityfocus.com/bid/97689 - https://github.com/derf/feh/commit/f7a547b7ef8fc8ebdeaa4c28515c9d72e592fb6d - https://lists.debian.org/debian-lts-announce/2020/05/msg00021.html
CVE ID: CVE-2017-7876 State: PUBLISHED Published: 2017-06-15T20:00:00 Last Updated: 2024-08-05T16:19:29.065Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS 4.2.6 build 20170517, QTS 4.3.3.0174 build 20170503 and later versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/release-notes/qts/4.3.3.0174/20170503 - https://www.qnap.com/en/release-notes/qts/4.2.6/20170517 - https://www.qnap.com/zh-tw/security-ad
/4.3.3.0174/20170503 - https://www.qnap.com/en/release-notes/qts/4.2.6/20170517 - https://www.qnap.com/zh-tw/security-advisory/nas-201707-12
CVE ID: CVE-2017-7877 State: PUBLISHED Published: 2017-04-14T18:00:00 Last Updated: 2024-08-05T16:19:29.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flatCore/flatCore-CMS/issues/27 - http://www.securityfocus.com/bid/97709
CVE ID: CVE-2017-7878 State: PUBLISHED Published: 2017-04-14T18:00:00Z Last Updated: 2024-09-16T22:45:38.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flatCore/flatCore-CMS/issues/29
CVE ID: CVE-2017-7879 State: PUBLISHED Published: 2017-04-14T18:00:00Z Last Updated: 2024-09-16T22:41:15.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flatCore/flatCore-CMS/issues/28
CVE ID: CVE-2017-7881 State: PUBLISHED Published: 2017-04-15T16:00:00 Last Updated: 2024-08-05T16:19:28.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/_header.php and patched in core/inc/bigtree/admin.php on 2017-04-14. Additional Analyst Notes: - CVE Program Container: References: - https://www.cdxy.me/?p=765 - https://github.com/bigtreecms/BigTree-CMS/commit/7761481ac40d83ac29fef42bc6b3c07c86694b56
CVE ID: CVE-2017-7882 State: PUBLISHED Published: 2017-04-15T16:00:00 Last Updated: 2024-08-05T16:19:28.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=860 - https://github.com/LibreOffice/core/commit/65dcd1d8195069c8c8acb3a188b8e5616c51029c - http://www.securityfocus.com/bid/97684 - http://www.libreoffice.org/about-us/security/advisories/cve-2017-7882/
CVE ID: CVE-2017-7884 State: PUBLISHED Published: 2017-06-16T13:00:00 Last Updated: 2024-08-05T16:19:29.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by replacing the service executable apcupsd.exe with a malicious executable that will run with SYSTEM privileges at startup. This occurs because of "RW NT AUTHORITY\Authenticated Users" permissions for %SYSTEMDRIVE%\apcupsd\bin\apcupsd.exe. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id
upsd\bin\apcupsd.exe. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038707 - http://www.securityfocus.com/bid/99092 - http://seclists.org/fulldisclosure/2017/Jun/20
CVE ID: CVE-2017-7885 State: PUBLISHED Published: 2017-04-17T00:00:00 Last Updated: 2024-08-05T16:19:29.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2_decode_symbol_dict function in jbig2_symbol_dict.c in libjbig2dec.a during operation on a crafted .jb2 file. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3855 - https://security.gentoo.org/glsa/201708-10 - https://bugs.ghostscript.com/show_bug.cgi?id=697703
CVE ID: CVE-2017-7886 State: PUBLISHED Published: 2017-05-10T14:00:00 Last Updated: 2024-08-05T16:19:28.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxmole.com/advisories/foxmole-2017-02-23.txt
CVE ID: CVE-2017-7887 State: PUBLISHED Published: 2017-05-10T14:00:00 Last Updated: 2024-08-05T16:19:29.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxmole.com/advisories/foxmole-2017-02-23.txt
CVE ID: CVE-2017-7888 State: PUBLISHED Published: 2017-05-10T14:00:00 Last Updated: 2024-08-05T16:19:28.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxmole.com/advisories/foxmole-2017-02-23.txt
CVE ID: CVE-2017-7889 State: PUBLISHED Published: 2017-04-17T00:00:00 Last Updated: 2024-08-05T16:19:28.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94 - http://git.kernel.
er: References: - https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a4866aa812518ed1a37d8ea0c881dc946409de94 - https://usn.ubuntu.com/3583-2/ - https://access.redhat.com/errata/RHSA-2017:2669 - https://access.redhat.com/errata/RHSA-2018:1854 - https://usn.ubuntu.com/3583-1/ - http://www.debian.org/security/2017/dsa-3945 - http://www.securityfocus.com/bid/97690 - https://access.redhat.com/errata/RHSA-2017:2077 - http://www.openwall.com/lists/oss-security/2017/04/16/4 - https://access.redhat.com/errata/RHSA-2017:1842 - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?i
https://access.redhat.com/errata/RHSA-2017:1842 - https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=b8f254aa17f720053054c4ecff3920973a83b9d6
CVE ID: CVE-2017-7890 State: PUBLISHED Published: 2017-08-02T19:00:00 Last Updated: 2024-08-05T16:19:29.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/patch-display.php?bug=74435&patch=fix-74435-php-7.0&revision=1497970038 - https://www.tenab
nces: - https://bugs.php.net/patch-display.php?bug=74435&patch=fix-74435-php-7.0&revision=1497970038 - https://www.tenable.com/security/tns-2017-12 - http://www.debian.org/security/2017/dsa-3938 - https://access.redhat.com/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https://security.netapp.com/advisory/ntap-20180112-0001/ - http://www.securityfocus.com/bid/99492 - http://php.net/ChangeLog-7.php - https://access.redhat.com/errata/RHSA-2018:0406 - https://bugs.php.net/bug.php?id=74435
CVE ID: CVE-2017-7891 State: PUBLISHED Published: 2017-04-17T14:00:00 Last Updated: 2024-08-05T16:19:29.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: sourcebans-pp (SourceBans++) 1.5.4.7 has XSS in admin.comms.php via the rebanid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97710 - https://github.com/sbpp/sourcebans-pp/issues/253
CVE ID: CVE-2017-7892 State: PUBLISHED Published: 2017-04-17T21:00:00Z Last Updated: 2024-09-17T02:48:10.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sandstor
r pointer within a message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sandstorm-io/capnproto/blob/master/security-advisories/2017-04-17-0-apple-clang-elides-bounds-check.md
CVE ID: CVE-2017-7893 State: PUBLISHED Published: 2018-04-23T22:00:00 Last Updated: 2024-08-05T16:19:28.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master. Additional Analyst Notes: - CVE Program Container: References: - https://docs.saltstack.com/en/2017.7/topics/releases/2016.3.6.html
CVE ID: CVE-2017-7894 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:19:29.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: WinDjView 2.1 might allow user-assisted attackers to execute code via a crafted .djvu file, because of a "User Mode Write AV near NULL" in WinDjView.exe. One threat model is a victim who obtains an untrusted .djvu file from a remote location and issues several user-defined commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-7894
CVE ID: CVE-2017-7895 State: PUBLISHED Published: 2017-04-28T10:00:00 Last Updated: 2024-08-05T16:19:29.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2732 - https://access.redhat.com/errata/RHSA-2017:2412 - https://access.redhat.com/errata/RHSA-2017:1798 - https://git
7:2732 - https://access.redhat.com/errata/RHSA-2017:2412 - https://access.redhat.com/errata/RHSA-2017:1798 - https://github.com/torvalds/linux/commit/13bf9fbff0e5e099e2b6f003a0ab8ae145436309 - https://access.redhat.com/errata/RHSA-2017:1723 - https://access.redhat.com/errata/RHSA-2017:1615 - https://access.redhat.com/errata/RHSA-2017:1647 - https://access.redhat.com/errata/RHSA-2017:1766 - https://access.redhat.com/errata/RHSA-2017:1616 - https://access.redhat.com/errata/RHSA-2017:2429 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13bf9fbff0e5e099e2b6f003a0ab8ae145436309 - http://www.debian.org/security/2017/dsa-3886 - https://access.redhat.com/errata/RHSA-2
0e5e099e2b6f003a0ab8ae145436309 - http://www.debian.org/security/2017/dsa-3886 - https://access.redhat.com/errata/RHSA-2017:2428 - http://www.securityfocus.com/bid/98085 - https://access.redhat.com/errata/RHSA-2017:2472 - https://access.redhat.com/errata/RHSA-2017:1715
CVE ID: CVE-2017-7896 State: PUBLISHED Published: 2017-04-18T15:00:00 Last Updated: 2024-08-05T16:19:28.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/1116821-security-bulletin-trend-micro-interscan-messaging-security-virtual-appliance-imsva-9-1-multiple-v - http://www.securityfocus.com/bid/97938
CVE ID: CVE-2017-7897 State: PUBLISHED Published: 2017-04-18T17:00:00 Last Updated: 2024-08-05T16:19:29.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs. Additional Analyst Notes: - CVE Program Container: References: - http://www.mantisbt.org/bugs/view.php?id=22742 - http://www.securitytracker.com/id/1038278 - https://g
er: References: - http://www.mantisbt.org/bugs/view.php?id=22742 - http://www.securitytracker.com/id/1038278 - https://github.com/mantisbt/mantisbt/commit/a1c719313d61b07bbe8700005807b8195fdc32f1 - https://github.com/mantisbt/mantisbt/pull/1094
CVE ID: CVE-2017-7898 State: PUBLISHED Published: 2017-06-30T02:35:00 Last Updated: 2024-08-05T16:19:29.263Z Vendors: n/a Products: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 Problem Types: CWE-307 Description: An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic
; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. There are no penalties for repeatedly entering incorrect passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038546 - https
ords. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038546 - https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04
CVE ID: CVE-2017-7899 State: PUBLISHED Published: 2017-06-30T02:35:00 Last Updated: 2024-08-05T16:19:28.551Z Vendors: n/a Products: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 Problem Types: CWE-200 Description: An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A an
rsion 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. User credentials are sent to the web server using the HTTP GET method, which may result in the credentials being logged. This could make user credentials available for unauthorized retrieval. Additional Analyst Notes: -
entials being logged. This could make user credentials available for unauthorized retrieval. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038546 - https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04
CVE ID: CVE-2017-7901 State: PUBLISHED Published: 2017-06-30T02:35:00 Last Updated: 2024-08-05T16:19:29.159Z Vendors: n/a Products: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 Problem Types: CWE-343 Description: A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1
DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. Insufficiently random TCP initial sequence numbers are generated, which may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connec
allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections, resulting in a denial of service for the target device. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038546 - https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04
CVE ID: CVE-2017-7902 State: PUBLISHED Published: 2017-06-30T02:35:00 Last Updated: 2024-08-05T16:19:28.546Z Vendors: n/a Products: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 Problem Types: CWE-323 Description: A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766
, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. The affected product reuses nonces, which may allow an attacker to capture and replay a valid request until the nonce is changed. Additional Analyst Notes: - CVE Program Container: References: - http
replay a valid request until the nonce is changed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038546 - https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04
CVE ID: CVE-2017-7903 State: PUBLISHED Published: 2017-06-30T02:35:00 Last Updated: 2024-08-05T16:19:29.219Z Vendors: n/a Products: Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 Problem Types: CWE-521 Description: A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series