Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
usn.ubuntu.com/3736-1/ - https://github.com/libarchive/libarchive/issues/948 - https://access.redhat.com/errata/RHSA-2019:2298 - https://security.gentoo.org/glsa/201908-11 - https://access.redhat.com/errata/RHSA-2019:3698
CVE ID: CVE-2017-14504 State: PUBLISHED Published: 2017-09-17T19:00:00 Last Updated: 2024-08-05T19:27:40.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does not ensure the correct number of colors for the XV 332 format, leading to a NULL Pointer Dereference. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100877 - https://sourceforge.net/p/graphicsmagick/bugs/465/ - https://www.debian.org/security/2018/dsa-4321 - http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=fb09ca6dd22c - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://so
gick?cmd=changeset%3Bnode=fb09ca6dd22c - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://sourceforge.net/p/graphicsmagick/bugs/466/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4232-1/
CVE ID: CVE-2017-14505 State: PUBLISHED Published: 2017-09-17T19:00:00 Last Updated: 2024-08-05T19:27:40.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick 7.0.7-1 mishandles certain NULL arrays, which allows attackers to perform Denial of Service (NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c) by providing a crafted Image File as input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/716 - https://usn.ubuntu.com/3681-1/ - http://www.securityfocus.com/bid/100882 - https://lists.debian.org/debian-lts-an
/716 - https://usn.ubuntu.com/3681-1/ - http://www.securityfocus.com/bid/100882 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-14506 State: PUBLISHED Published: 2017-09-25T08:00:00 Last Updated: 2024-08-05T19:27:40.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file. Additional Analyst Notes: - CVE Program Container: References: - http://baraktawily.blogspot.co.il/2017/09/gem-in-box-xss-vulenrability-cve-2017.html - https://github.com/geminabox/geminabox/blob/master/CHANGELOG.md
CVE ID: CVE-2017-14507 State: PUBLISHED Published: 2017-09-28T19:00:00 Last Updated: 2024-08-05T19:27:40.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42794/ - https://wpvulndb.com/vulnerabilities/8921
CVE ID: CVE-2017-14508 State: PUBLISHED Published: 2017-09-17T21:00:00 Last Updated: 2024-08-05T19:27:40.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL da
ilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM - https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/
CVE ID: CVE-2017-14509 State: PUBLISHED Published: 2017-09-17T21:00:00 Last Updated: 2024-08-05T19:27:40.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue. Additional Analyst Notes: - CVE Program Container: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/ - https://www
CVE Program Container: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/ - https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM - https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
CVE ID: CVE-2017-14510 State: PUBLISHED Published: 2017-09-17T21:00:00 Last Updated: 2024-08-05T19:27:40.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along. Additional Analyst Notes: - CVE Program Container: References: - https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/ - https://www.synology.com/support/security/Synology
tps://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/ - https://www.synology.com/support/security/Synology_SA_17_53_SugarCRM - https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/
CVE ID: CVE-2017-14511 State: PUBLISHED Published: 2017-09-17T21:00:00 Last Updated: 2024-08-05T19:27:40.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and confirm email addresses that they do not have access to (candidate_hrobject is predictable and corr_act_guid is improperly validated). Furthermore, since an email address can be registered only once, an attacker could prevent other leg
roperly validated). Furthermore, since an email address can be registered only once, an attacker could prevent other legitimate users from registering. This is SAP Security Note 2507798. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/en/blog/advisories/email-verification-bypass-in-sap-e-recruiting/index.html - https://blogs.sap.com/2017/09/12/sap-security-patch-day-september-2017/ - https://launchpad.support.sap.com/#/notes/2507798
CVE ID: CVE-2017-14512 State: PUBLISHED Published: 2017-09-17T21:00:00 Last Updated: 2024-08-05T19:27:40.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability than CVE-2017-12981. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rezhish/NexusPHP/blob/master/nexusphp.md
CVE ID: CVE-2017-14513 State: PUBLISHED Published: 2017-09-17T21:00:00 Last Updated: 2024-08-05T19:27:40.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phantom0301/vulns/blob/master/Metinfo2.md
CVE ID: CVE-2017-14514 State: PUBLISHED Published: 2017-09-17T22:00:00Z Last Updated: 2024-09-17T03:48:27.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal on Tenda W15E devices before 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.tendacn.com/en/2018.html
CVE ID: CVE-2017-14515 State: PUBLISHED Published: 2017-09-17T22:00:00Z Last Updated: 2024-09-17T03:38:39.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based Buffer Overflow on Tenda W15E devices before 15.11.0.14 allows remote attackers to cause a denial of service (temporary HTTP outage and forced logout) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.tendacn.com/en/2018.html
CVE ID: CVE-2017-14516 State: PUBLISHED Published: 2017-12-03T07:00:00 Last Updated: 2024-08-05T19:27:40.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation before 2017-06-13, aka SAP Security Note 2422292. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2017/06/13/sap-security-patch-day-june2017/
CVE ID: CVE-2017-14517 State: PUBLISHED Published: 2017-09-17T23:00:00 Last Updated: 2024-08-05T19:27:40.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=102687 - https://www.debian.org/security/2018/dsa-4079 - http://www.securityfocus.com/bid/105050
CVE ID: CVE-2017-14518 State: PUBLISHED Published: 2017-09-17T23:00:00 Last Updated: 2024-08-05T19:27:40.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4079 - https://bugs.freedesktop.org/show_bug.cgi?id=102688
CVE ID: CVE-2017-14519 State: PUBLISHED Published: 2017-09-17T23:00:00 Last Updated: 2024-08-05T19:27:40.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=102701 - https://www.debian.org/security/2018/dsa-4079
CVE ID: CVE-2017-14520 State: PUBLISHED Published: 2017-09-17T23:00:00 Last Updated: 2024-08-05T19:27:40.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF files. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4079 - https://bugs.freedesktop.org/show_bug.cgi?id=102719
CVE ID: CVE-2017-14521 State: PUBLISHED Published: 2018-01-26T20:00:00 Last Updated: 2024-08-05T19:27:40.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload. Additional Analyst Notes: - CVE Program Container: References: - https://securitywarrior9.blogspot.in/2018/01/vulnerability-in-wonder-cms-leading-to.html - https://www.exploit-db.com/exploits/43963/
CVE ID: CVE-2017-14522 State: PUBLISHED Published: 2018-01-26T20:00:00 Last Updated: 2024-08-05T19:27:40.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitywarrior9.blogspot.in/2018/01/stored-xss-in-wonder-cms.html
CVE ID: CVE-2017-14523 State: PUBLISHED Published: 2018-01-26T20:00:00 Last Updated: 2024-08-05T19:27:40.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack Additional Analyst Notes: - CVE Program Container: References: - https://securitywarrior9.blogspot.in/2018/01/host-header-injection-in-wonder-cms.html - https://www.exploit-db.com/exploits/43964/
CVE ID: CVE-2017-14524 State: PUBLISHED Published: 2017-09-27T17:00:00 Last Updated: 2024-08-05T19:27:40.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in the startat parameter to xda/help/en/default.htm or (2) /%09/ (slash encoded horizontal tab slash) followed by a domain in the redirectUrl parameter to xda/component/virtuallinkconnect. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/57 - https://knowledge.opentext.com/
- CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/57 - https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
CVE ID: CVE-2017-14525 State: PUBLISHED Published: 2017-09-27T17:00:00 Last Updated: 2024-08-05T19:27:40.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in the startat parameter to xda/help/en/default.htm or (2) /%09/ (slash encoded horizontal tab slash) followed by a domain in the redirectUrl parameter to xda/component/virtuallinkconnect. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/57 - https://knowledge.opentext.com/knowled
Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/57 - https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
CVE ID: CVE-2017-14526 State: PUBLISHED Published: 2017-09-27T17:00:00 Last Updated: 2024-08-05T19:27:40.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in. Additional Analyst Notes: - CVE Program Cont
ctor or crafted XML file in a MediaProfile file (2) import or (3) check in. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/58 - https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
CVE ID: CVE-2017-14527 State: PUBLISHED Published: 2017-09-27T17:00:00 Last Updated: 2024-08-05T19:27:40.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in. Additional Analyst Notes: - CVE Program Container:
crafted XML file in a MediaProfile file (2) import or (3) check in. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/58 - https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
CVE ID: CVE-2017-14528 State: PUBLISHED Published: 2017-09-18T00:00:00 Last Updated: 2024-08-05T19:27:40.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data validation has occurred, which allows remote attackers to cause a denial of service (use-after-free after an invalid call to TIFFSetField, and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2730 - http://www.securityfocus.com/bid/100875 - https://www.imagemagick.org/dis
//bugzilla.maptools.org/show_bug.cgi?id=2730 - http://www.securityfocus.com/bid/100875 - https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32560 - https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html
CVE ID: CVE-2017-14529 State: PUBLISHED Published: 2017-09-18T00:00:00Z Last Updated: 2024-09-16T21:02:41.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22113 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=dcaac
tps://sourceware.org/bugzilla/show_bug.cgi?id=22113 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=dcaaca89e8618eba35193c27afcb1cfa54f74582 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=4d465c689a8fb27212ef358d0aee89d60dee69a6
CVE ID: CVE-2017-14530 State: PUBLISHED Published: 2017-09-18T01:00:00 Last Updated: 2024-08-05T19:27:40.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/crony/#developers - https://github.com/cybersecurityworks/Disclosed/issues/9 - https://cybersecurityworks.com/zerodays/cve-2017-14530-crony.html
CVE ID: CVE-2017-14531 State: PUBLISHED Published: 2017-09-18T01:00:00 Last Updated: 2024-08-05T19:27:40.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100888 - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/718
CVE ID: CVE-2017-14532 State: PUBLISHED Published: 2017-09-18T01:00:00 Last Updated: 2024-08-05T19:27:40.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/719 - https://usn.ubuntu.com/3681-1/ - http://www.securityfocus.com/bid/100883 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-14533 State: PUBLISHED Published: 2017-09-18T01:00:00 Last Updated: 2024-08-05T19:27:40.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.6-6 has a memory leak in ReadMATImage in coders/mat.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/648 - https://usn.ubuntu.com/3681-1/ - http://www.securityfocus.com/bid/100885
CVE ID: CVE-2017-14534 State: PUBLISHED Published: 2017-09-18T04:00:00Z Last Updated: 2024-09-17T03:23:06.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related to PHP_SELF. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/yangchonghui2017/cve/master/2.txt
CVE ID: CVE-2017-14535 State: PUBLISHED Published: 2018-02-16T04:00:00 Last Updated: 2024-08-05T19:27:40.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/tiger_tigerboy/status/962689803270500352 - http://www.securityfocus.com/bid/103004 - https://www.linkedin.com/pulse/trixbox-os-command-injection-vulnerability-sachin-wagh-ceh-ecsa-/?published=t - https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/ - http://packetstor
secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/ - http://packetstormsecurity.com/files/162854/Trixbox-2.8.0.4-Remote-Code-Execution.html - https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-14535-Exploit
CVE ID: CVE-2017-14536 State: PUBLISHED Published: 2018-02-16T04:00:00 Last Updated: 2024-08-05T19:27:40.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php. Additional Analyst Notes: - CVE Program Container: References: - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-cross-site-scripting-vulnerabilities/ - http://www.securityfocus.com/bid/103009
CVE ID: CVE-2017-14537 State: PUBLISHED Published: 2018-02-16T04:00:00 Last Updated: 2024-08-05T19:27:40.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103007 - https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/ - http://packetstormsecurity.com/files/162853/Trixbox-2.8.0.4-Path-Traversal.html - https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-14537-Exploi
es/162853/Trixbox-2.8.0.4-Path-Traversal.html - https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-14537-Exploit