Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-12629 State: PUBLISHED Published: 2017-10-14T21:00:00 Last Updated: 2024-08-05T18:43:56.440Z Vendors: n/a Products: Apache Solr before 7.1 with Apache Lucene before 7.1 Problem Types: Remote code execution Description: Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exp
XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3451 - https://s.apache.org/FJDl - https://access.redhat.com/errata/RHSA-2018:0002 - http://www.securityfocus.com/bid/101261 - https://access.redhat.com/errata/RHSA-
cess.redhat.com/errata/RHSA-2018:0002 - http://www.securityfocus.com/bid/101261 - https://access.redhat.com/errata/RHSA-2018:0004 - https://access.redhat.com/errata/RHSA-2017:3452 - https://lists.debian.org/debian-lts-announce/2018/01/msg00028.html - https://www.exploit-db.com/exploits/43009/ - https://access.redhat.com/errata/RHSA-2018:0003 - https://access.redhat.com/errata/RHSA-2017:3123 - https://access.redhat.com/errata/RHSA-2018:0005 - https://access.redhat.com/errata/RHSA-2017:3244 - https://access.redhat.com/errata/RHSA-2017:3124 - http://mail-archives.us.apache.org/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E - http
/mod_mbox/www-announce/201710.mbox/%3CCAOOKt51UO_6Vy%3Dj8W%3Dx1pMbLW9VJfZyFWz7pAnXJC_OAdSZubA%40mail.gmail.com%3E - https://www.debian.org/security/2018/dsa-4124 - https://usn.ubuntu.com/4259-1/ - https://twitter.com/ApacheSolr/status/918731485611401216 - https://twitter.com/searchtools_avi/status/918904813613543424 - http://openwall.com/lists/oss-security/2017/10/13/1 - https://twitter.com/joshbressers/status/919258716297420802 - https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E - https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E - https://lis
he.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E - https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E - https://lists.apache.org/thread.html/r26c996b068ef6c5e89aa59acb769025cfd343a08e63fbe9e7f3f720f%40%3Coak-issues.jackrabbit.apache.org%3E
CVE ID: CVE-2017-12630 State: PUBLISHED Published: 2017-12-18T14:00:00Z Last Updated: 2024-09-16T20:16:31.531Z Vendors: Apache Software Foundation Products: Apache Drill Problem Types: XSS Vulnerability Description: In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/608658a55d09e16542db41121a0a972c97448214cdc04071
E Program Container: References: - https://lists.apache.org/thread.html/608658a55d09e16542db41121a0a972c97448214cdc04071fd4db923%40%3Cdev.drill.apache.org%3E
CVE ID: CVE-2017-12631 State: PUBLISHED Published: 2017-11-30T14:00:00Z Last Updated: 2024-09-16T21:58:27.297Z Vendors: Apache Software Foundation Products: Apache CXF Fediz Problem Types: Cross Site Request Forgery Description: Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a security context that is set up using a malicious client's roles for the given enduser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityt
ent's roles for the given enduser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040487 - http://www.securityfocus.com/bid/102127 - http://cxf.547215.n5.nabble.com/Apache-CXF-Fediz-1-4-3-and-1-3-3-released-with-a-new-security-advisory-CVE-2017-12631-td5785868.html - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%
ps://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2017-12632 State: PUBLISHED Published: 2018-01-23T22:00:00Z Last Updated: 2024-09-16T20:01:20.753Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Remote Code Execution Description: A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2017-12632
CVE ID: CVE-2017-12633 State: PUBLISHED Published: 2017-11-15T15:00:00Z Last Updated: 2024-09-16T22:25:45.252Z Vendors: Apache Software Foundation Products: Apache Camel Problem Types: Apache Camel's Hessian unmarshalling operation is vulnerable to Remote Code Execution attacks Description: The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101874 - https://access.redhat.com/errata/RHSA-2018:0319 - https://issues.apache.org/jira/browse/CAMEL-1
tyfocus.com/bid/101874 - https://access.redhat.com/errata/RHSA-2018:0319 - https://issues.apache.org/jira/browse/CAMEL-11923 - http://camel.apache.org/security-advisories.data/CVE-2017-12633.txt.asc - https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
CVE ID: CVE-2017-12634 State: PUBLISHED Published: 2017-11-15T15:00:00Z Last Updated: 2024-09-16T18:43:28.109Z Vendors: Apache Software Foundation Products: Apache Camel Problem Types: Apache Camel's Castor unmarshalling operation is vulnerable to Remote Code Execution attacks Description: The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0319 - http://www.securityfocus.com/bid/101876 - https://issues.apache.org/jira/browse/CAMEL-119
at.com/errata/RHSA-2018:0319 - http://www.securityfocus.com/bid/101876 - https://issues.apache.org/jira/browse/CAMEL-11929 - http://camel.apache.org/security-advisories.data/CVE-2017-12634.txt.asc - https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
CVE ID: CVE-2017-12635 State: PUBLISHED Published: 2017-11-14T20:00:00Z Last Updated: 2024-09-17T01:31:53.828Z Vendors: Apache Software Foundation Products: Apache CouchDB Problem Types: Information Disclosure Description: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the s
2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44498/ - https://www.exploit-db.com/exploits/45019/ - https:/
ntainer: References: - https://www.exploit-db.com/exploits/44498/ - https://www.exploit-db.com/exploits/45019/ - https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E - https://security.gentoo.org/glsa/201711-16 - https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html - http://www.securityfocus.com/bid/101868 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
CVE ID: CVE-2017-12636 State: PUBLISHED Published: 2017-11-14T20:00:00Z Last Updated: 2024-09-16T18:48:31.205Z Vendors: Apache Software Foundation Products: Apache CouchDB Problem Types: Information Disclosure Description: CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet. Additional Analyst Notes: - CVE Program Container: References: - http
ng and executing scripts from the public internet. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45019/ - https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E - https://www.exploit-db.com/exploits/44913/ - https://security.gentoo.org/glsa/201711-16 - https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us
CVE ID: CVE-2017-12637 State: PUBLISHED Published: 2017-08-07T20:00:00.000Z Last Updated: 2025-10-21T23:55:35.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/
CVE ID: CVE-2017-12638 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T18:43:56.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETBL or ETCETERABLUE. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/_Messaging/IMailServer/v12.5.6/ReleaseNotes/index.htm#link8
CVE ID: CVE-2017-12639 State: PUBLISHED Published: 2017-10-02T21:00:00 Last Updated: 2024-08-05T18:43:56.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETRE or ETCTERARED. Additional Analyst Notes: - CVE Program Container: References: - https://docs.ipswitch.com/_Messaging/IMailServer/v12.5.6/ReleaseNotes/index.htm#link8
CVE ID: CVE-2017-12640 State: PUBLISHED Published: 2017-08-07T15:00:00 Last Updated: 2024-08-05T18:43:56.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4040 - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/542 - http://www.securityfocus.com/bid/100155 - https://www.debian.org/security/2017/dsa-4019 - https://github.com/ImageMagick/ImageMagick/commit/307fa45d512641fcd105f0d57ca50c1437cd1b81
CVE ID: CVE-2017-12641 State: PUBLISHED Published: 2017-08-07T15:00:00 Last Updated: 2024-08-05T18:43:56.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/550 - https://github.com/ImageMagick/ImageMagick/commit/c9aa9f80828594eacbe3affe16c43d623562e5d8
CVE ID: CVE-2017-12642 State: PUBLISHED Published: 2017-08-07T15:00:00 Last Updated: 2024-08-05T18:43:56.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/552 - http://www.securityfocus.com/bid/100159
CVE ID: CVE-2017-12643 State: PUBLISHED Published: 2017-08-07T15:00:00 Last Updated: 2024-08-05T18:43:56.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/549 - https://usn.ubuntu.com/3681-1/ - http://www.securityfocus.com/bid/100218 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html - https://github.com/ImageMagick/ImageMagick/commit/d9ccd8227c4c88a907cda5278408b73552cb0c07
CVE ID: CVE-2017-12644 State: PUBLISHED Published: 2017-08-07T15:00:00 Last Updated: 2024-08-05T18:43:56.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100162 - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/551 - https://github.com/ImageMagick/ImageMagick/commit/a33f7498f9052b50e8fe8c8422a11ba84474cb42
CVE ID: CVE-2017-12645 State: PUBLISHED Published: 2017-08-07T16:00:00Z Last Updated: 2024-09-16T17:33:38.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId. Additional Analyst Notes: - CVE Program Container: References: - https://issues.liferay.com/browse/LPS-72307 - https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE ID: CVE-2017-12646 State: PUBLISHED Published: 2017-08-07T16:00:00Z Last Updated: 2024-09-16T16:34:07.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brianchandotcom/liferay-portal/pull/49833 - https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE ID: CVE-2017-12647 State: PUBLISHED Published: 2017-08-07T16:00:00Z Last Updated: 2024-09-16T16:24:16.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brianchandotcom/liferay-portal/pull/48901 - https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE ID: CVE-2017-12648 State: PUBLISHED Published: 2017-08-07T16:00:00Z Last Updated: 2024-09-16T23:45:33.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brianchandotcom/liferay-portal/pull/47888 - https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE ID: CVE-2017-12649 State: PUBLISHED Published: 2017-08-07T16:00:00Z Last Updated: 2024-09-17T02:17:07.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/brianchandotcom/liferay-portal/pull/47579 - https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE ID: CVE-2017-12650 State: PUBLISHED Published: 2017-08-07T17:00:00 Last Updated: 2024-08-05T18:43:56.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://blog.wpscans.com/sql-injection-and-csrf-security-vulnerability-in-loginizer/ - https://wpvulndb.com/vulnerabilities/8883 - https://sv.wordpress.org/plugins/loginizer/#developers
CVE ID: CVE-2017-12651 State: PUBLISHED Published: 2017-08-07T17:00:00 Last Updated: 2024-08-05T18:43:56.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked. Additional Analyst Notes: - CVE Program Container: References: - https://blog.wpscans.com/sql-injection-and-csrf-security-vulnerability-in-loginizer/ - https://sv.wordpress.org/plugins/loginizer/#developers - https://wpvulndb.com/vulnerabilities/8884
CVE ID: CVE-2017-12652 State: PUBLISHED Published: 2019-07-10T14:10:07.000Z Last Updated: 2025-06-09T15:23:00.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: libpng before 1.6.32 does not properly check the length of chunks against the user limit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE - http://www.securityfocus.com/bid/109269 - https://support.f5.com/csp/article/K88124225 - https://support.f5.com/csp/article/K88124225?utm_source=f5support&amp;utm_medium=RSS - https://security.netapp.com/advisory/ntap-20220506-0003/ - https://github.com/p
tm_source=f5support&amp;utm_medium=RSS - https://security.netapp.com/advisory/ntap-20220506-0003/ - https://github.com/pnggroup/libpng/commit/347538efbdc21b8df684ebd92d37400b3ce85d55
CVE ID: CVE-2017-12653 State: PUBLISHED Published: 2017-08-07T18:00:00Z Last Updated: 2024-09-16T16:53:47.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: 360 Total Security 9.0.0.1202 before 2017-07-07 allows Privilege Escalation via a Trojan horse Shcore.dll file in any directory in the PATH, as demonstrated by the C:\Python27 directory. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3314#more-3314
CVE ID: CVE-2017-12654 State: PUBLISHED Published: 2017-08-07T18:00:00 Last Updated: 2024-08-05T18:43:56.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/620 - http://www.securityfocus.com/bid/100230
CVE ID: CVE-2017-12655 State: PUBLISHED Published: 2017-08-07T20:00:00Z Last Updated: 2024-09-17T04:04:43.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action. Additional Analyst Notes: - CVE Program Container: References: - http://lu4n.com/cve/1.txt
CVE ID: CVE-2017-12662 State: PUBLISHED Published: 2017-08-07T21:00:00 Last Updated: 2024-08-05T18:43:56.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/576 - http://www.securityfocus.com/bid/100232 - https://github.com/ImageMagick/ImageMagick/commit/bd40cc5f53067322861b881485cbd70f509f3829
CVE ID: CVE-2017-12663 State: PUBLISHED Published: 2017-08-07T21:00:00 Last Updated: 2024-08-05T18:43:56.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/573 - https://github.com/ImageMagick/ImageMagick/commit/1dc0ac5016f1c4d50b100a086526d6a2453a5444
CVE ID: CVE-2017-12664 State: PUBLISHED Published: 2017-08-07T21:00:00 Last Updated: 2024-08-05T18:43:56.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePALMImage in coders/palm.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/574 - https://github.com/ImageMagick/ImageMagick/commit/0417cea1b6d72f90bd4f1f573f91e42a8ba66a89