Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7597 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ -
//www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/97504
CVE ID: CVE-2017-7598 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/97499
CVE ID: CVE-2017-7599 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://www.securi
security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/97505 - http://www.securityfocus.com/bid/97508
CVE ID: CVE-2017-7600 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:11.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/
CVE ID: CVE-2017-7601 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes - http://www.debian.org/security/2017/dsa-3844 - http://www.securityfocus.com/bid/97511 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.c
17/dsa-3844 - http://www.securityfocus.com/bid/97511 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/
CVE ID: CVE-2017-7602 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes - http://www.securityfocus.com/bid/97500 - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - https://usn.ubuntu.com/3602-1/
CVE ID: CVE-2017-7603 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/ - https://security.gentoo.org/glsa/202209-13
CVE ID: CVE-2017-7604 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/ - https://security.gentoo.org/glsa/202209-13
CVE ID: CVE-2017-7605 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: aacplusenc.c in HE-AAC+ Codec (aka libaacplus) 2.0.2 has an assertion failure, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/ - https://security.gentoo.org/glsa/202209-13
CVE ID: CVE-2017-7606 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98685 - http://www.debian.org/security/2017/dsa-3863 - https://blogs.gentoo.org/ago/2017/04/02/imagemagick-undefined-behavior-in-codersrle-c/
CVE ID: CVE-2017-7607 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:04:12.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3670-1/ - https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c - https://security.gentoo.org/glsa/201710-10 - http://www.securityfocus.com/bid/98608 - http://lists.opensuse.org/opensuse-security-announce
entoo.org/glsa/201710-10 - http://www.securityfocus.com/bid/98608 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
CVE ID: CVE-2017-7608 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:12:26.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3670-1/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c - https://security.gentoo.org
4/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c - https://security.gentoo.org/glsa/201710-10 - http://www.securityfocus.com/bid/98609 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
CVE ID: CVE-2017-7609 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:12:26.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3670-1/ - https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-__libelf_decompress-elf_compress-c - https://security.gentoo.org/glsa/201710-10 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
CVE ID: CVE-2017-7610 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:12:27.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3670-1/ - https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://security.gentoo.org/glsa/201710-10 - http://lists.opensuse.org/opensu
ebian-lts-announce/2019/02/msg00036.html - https://security.gentoo.org/glsa/201710-10 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
CVE ID: CVE-2017-7611 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:12:27.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3670-1/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c - https://security.gentoo.org/glsa/201710-10 - http://lists.opens
-based-buffer-overflow-in-check_symtab_shndx-elflint-c - https://security.gentoo.org/glsa/201710-10 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
CVE ID: CVE-2017-7612 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:12:27.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3670-1/ - https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://security.gentoo.org/glsa/201710-10 - http://lists.opensuse.or
an.org/debian-lts-announce/2019/02/msg00036.html - https://security.gentoo.org/glsa/201710-10 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
CVE ID: CVE-2017-7613 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:12:26.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3670-1/ - https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://security.gentoo.org/glsa/201710-10 - http://lists.opensuse
ebian.org/debian-lts-announce/2019/02/msg00036.html - https://security.gentoo.org/glsa/201710-10 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
CVE ID: CVE-2017-7614 State: PUBLISHED Published: 2017-04-09T14:00:00 Last Updated: 2024-08-05T16:12:26.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/05/binutils-two-null-pointer-dereference-in-elflink-c/ - https://security.gentoo.org/glsa/
/blogs.gentoo.org/ago/2017/04/05/binutils-two-null-pointer-dereference-in-elflink-c/ - https://security.gentoo.org/glsa/201709-02
CVE ID: CVE-2017-7615 State: PUBLISHED Published: 2017-04-16T14:45:00 Last Updated: 2024-08-05T16:12:26.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97707 - https://mantisbt.org/bugs/view.php?id=22690 - http://www.openwall.com/lists/oss-security/2017/04/16/2 - https://www.exploit-db.com/exploits/41890/ - http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt - http://packetstormsecurity.com/files/159219
vista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt - http://packetstormsecurity.com/files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html
CVE ID: CVE-2017-7616 State: PUBLISHED Published: 2017-04-10T14:00:00 Last Updated: 2024-08-05T16:12:26.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cf01fb9985e8deb25ccf0ea54d916b8871ae0e62 - https://source.android.com/security/bulletin/2017-09-01 - https://access.redhat.com/errata/
b25ccf0ea54d916b8871ae0e62 - https://source.android.com/security/bulletin/2017-09-01 - https://access.redhat.com/errata/RHSA-2018:1854 - http://www.securitytracker.com/id/1038503 - https://github.com/torvalds/linux/commit/cf01fb9985e8deb25ccf0ea54d916b8871ae0e62 - https://access.redhat.com/errata/RHSA-2017:2077 - https://access.redhat.com/errata/RHSA-2017:1842 - http://www.securityfocus.com/bid/97527
CVE ID: CVE-2017-7617 State: PUBLISHED Published: 2017-04-10T14:00:00 Last Updated: 2024-08-05T16:12:27.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97377 - https://bugs.debian.org/859910 - http://downloads.asterisk.org/pub/security/AST-2017-001.html
CVE ID: CVE-2017-7618 State: PUBLISHED Published: 2017-04-10T14:00:00 Last Updated: 2024-08-05T16:12:26.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us - http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2 - http://www.securityfocus.com/bid/97534
CVE ID: CVE-2017-7619 State: PUBLISHED Published: 2017-04-10T14:00:00 Last Updated: 2024-08-05T16:12:27.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv. Additional Analyst Notes: - CVE Program Container: References: - https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31506 - http://www.debian.org/security/2017/dsa-3863 - http://www.securityfocus.com/bid/98689
CVE ID: CVE-2017-7620 State: PUBLISHED Published: 2017-05-21T14:00:00 Last Updated: 2024-08-05T16:12:27.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=22816 - http://www.security
Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=22816 - http://www.securitytracker.com/id/1038538 - https://www.exploit-db.com/exploits/42043/ - https://mantisbt.org/bugs/view.php?id=22702 - http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt
CVE ID: CVE-2017-7621 State: PUBLISHED Published: 2017-04-11T10:00:00 Last Updated: 2024-08-05T16:12:27.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. Ltd. eMLi V1.0 allows an Attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the page parameter to code/student_portal/home.php. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0. Additional Analyst Notes: - CVE Program Container: References: - https://sudoat.blogspot.in/2017/04/xss-vulnerability-in-multiple-emli.html
CVE ID: CVE-2017-7622 State: PUBLISHED Published: 2017-04-10T17:00:00Z Last Updated: 2024-09-17T00:06:11.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to identify the user who calls the function through D-Bus. Anybody can change the grub config, even to append some arguments to make a backdoor or privilege escalation, by calling DoWriteGrubSettings() provided by dde-daemon. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kings-way/deepinhack/blob/master/dde_daemon_poc.py
CVE ID: CVE-2017-7623 State: PUBLISHED Published: 2017-04-10T17:00:00 Last Updated: 2024-08-05T16:12:27.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iwmiffr_convert_row32 function in imagew-miff.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsummers/imageworsener/issues/12 - http://www.securityfocus.com/bid/97577
CVE ID: CVE-2017-7624 State: PUBLISHED Published: 2017-04-10T17:00:00 Last Updated: 2024-08-05T16:12:26.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iw_read_bmp_file function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of available memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97575 - https://github.com/jsummers/imageworsener/issues/10
CVE ID: CVE-2017-7625 State: PUBLISHED Published: 2017-04-10T17:00:00 Last Updated: 2024-08-05T16:12:27.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and then execute code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Xyntax/POC-T/blob/2.0/script/fiyo2.0.7-getshell.py - http://www.securityfocus.com/bid/97571
CVE ID: CVE-2017-7626 State: PUBLISHED Published: 2017-04-13T03:20:00 Last Updated: 2024-08-05T16:12:27.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php (n_art,type in GET Method). Additional Analyst Notes: - CVE Program Container: References: - https://extensions.joomla.org/extension/smart-related-articles/ - https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection - https://gist.github.com/anonymous/14576258b0e66bb25ca4b7ca1638e51f
CVE ID: CVE-2017-7627 State: PUBLISHED Published: 2017-04-13T03:20:00 Last Updated: 2024-08-05T16:12:27.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php (there is a missing _JEXEC check). Additional Analyst Notes: - CVE Program Container: References: - https://extensions.joomla.org/extension/smart-related-articles/ - https://gist.github.com/anonymous/14576258b0e66bb25ca4b7ca1638e51f
CVE ID: CVE-2017-7628 State: PUBLISHED Published: 2017-04-13T03:20:00 Last Updated: 2024-08-05T16:12:27.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php (attacker must use search_cats variable in POST method to exploit this vulnerability). Additional Analyst Notes: - CVE Program Container: References: - https://extensions.joomla.org/extension/smart-related-articles/ - https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection - https://gist.github.com/anonymous/14576258b0e66bb25ca4b7ca1638e51f
CVE ID: CVE-2017-7629 State: PUBLISHED Published: 2017-06-15T20:00:00 Last Updated: 2024-08-05T16:12:26.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en-us/releasenotes/
CVE ID: CVE-2017-7630 State: PUBLISHED Published: 2018-03-27T21:00:00Z Last Updated: 2024-09-17T00:50:40.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (firmware version and running services) via a request to sysinfoReq.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201803-23