Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-5165 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-05T14:55:34.843Z Vendors: n/a Products: BINOM3 Electric Power Quality Meter Problem Types: BINOM3 Electric Power Quality Meter csrf Description: An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. There is no CSRF Token generated per page and/or per (sensitive) function. Successful exploitation of this vulnerability can allow silent execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-1
uration. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A - http://www.securityfocus.com/bid/93028
CVE ID: CVE-2017-5166 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-05T14:55:34.965Z Vendors: n/a Products: BINOM3 Electric Power Quality Meter Problem Types: BINOM3 Electric Power Quality Meter INFORMATION EXPOSURE Description: An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. An INFORMATION EXPOSURE flaw can be used to gain privileged access to the device. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A - http://www.securityfocus.com/bid/93028
CVE ID: CVE-2017-5167 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-05T14:55:34.832Z Vendors: n/a Products: BINOM3 Electric Power Quality Meter Problem Types: BINOM3 Electric Power Quality Meter hardcoded passwords Description: An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users do not have any option to change their own passwords. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A - http://www.securityfocus.com/bid/93028
CVE ID: CVE-2017-5168 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-05T14:55:35.615Z Vendors: n/a Products: Hanwha Techwin Smart Security Manager Versions 1.5 and prior Problem Types: Hanwha Techwin Smart Security Manager Path Traversal Description: An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a malicious page, an attacker can gain access to arbitrary files on the server. Smart Security Manager Versions 1.4 and prior to 1
s page, an attacker can gain access to arbitrary files on the server. Smart Security Manager Versions 1.4 and prior to 1.31 are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96147 - https://ics-cert.us-cert.gov/advisories/ICSA-17-040-01
CVE ID: CVE-2017-5169 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-05T14:55:34.843Z Vendors: n/a Products: Hanwha Techwin Smart Security Manager 1.5 and prior Problem Types: Hanwha Techwin Smart Security Manager Cross Site Request Forgery Description: An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Post requests, an attacker can gain system level access to a remote shell session. Smart Security Manager Versions 1.5 and prior
uests, an attacker can gain system level access to a remote shell session. Smart Security Manager Versions 1.5 and prior are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96147 - https://ics-cert.us-cert.gov/advisories/ICSA-17-040-01
CVE ID: CVE-2017-5170 State: PUBLISHED Published: 2018-01-18T19:00:00 Last Updated: 2024-08-05T14:55:35.703Z Vendors: n/a Products: Moxa SoftNVR-IA Live Viewer Problem Types: CWE-427 Description: An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path element (DLL Hijacking) vulnerability has been identified. To exploit this vulnerability, an attacker could rename a malicious DLL to meet the criteria of the application, and the application would not verify that the DLL is correct. The attacker needs to have administrative access to the default install location in order to plant the insecure DLL
ect. The attacker needs to have administrative access to the default install location in order to plant the insecure DLL. Once loaded by the application, the DLL could run malicious code at the privilege level of the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100208 - https://ics-cert.us-cert.gov/advisories/ICSA-17-220-02
CVE ID: CVE-2017-5173 State: PUBLISHED Published: 2017-05-19T02:43:00 Last Updated: 2024-08-05T14:55:35.220Z Vendors: n/a Products: Geutebruck IP Cameras Problem Types: CWE-78 Description: An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An improper neutralization of special elements vulnerability has been identified. If special elements are not properly neutralized, an attacker can call multiple parameters that can allow access to the root level operating system which could allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/b
w remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96209 - https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02 - https://www.exploit-db.com/exploits/41360/
CVE ID: CVE-2017-5174 State: PUBLISHED Published: 2017-05-19T02:43:00 Last Updated: 2024-08-05T14:55:35.010Z Vendors: n/a Products: Geutebruck IP Cameras Problem Types: CWE-288 Description: An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96209 - https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02 - https://www.exploit-db.com/exploits/41360/
CVE ID: CVE-2017-5175 State: PUBLISHED Published: 2018-05-09T19:00:00Z Last Updated: 2024-09-17T02:01:34.846Z Vendors: ICS-CERT Products: Advantech WebAccess Versions 8.1 and prior. Problem Types: CWE-427 Description: Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96210 - https://ics-cert.us-cert.gov/advisories/ICSA-17-045-01
CVE ID: CVE-2017-5176 State: PUBLISHED Published: 2017-05-19T02:43:00 Last Updated: 2024-08-05T14:55:35.738Z Vendors: n/a Products: Rockwell Automation Connected Components Workbench Problem Types: CWE-427 Description: A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench (CCW). The following versions are affected: Connected Components Workbench - Developer Edition, v9.01.00 and earlier: 9328-CCWDEVENE, 9328-CCWDEVZHE, 9328-CCWDEVFRE, 9328-CCWDEVITE, 9328-CCWDEVDEE, 9328-CCWDEVESE, and 9328-CCWDEVPTE; and Connected Components Workbench - Free Standard Edition (All Supported Languages), v9.01.00 and earlier. Certain DLLs included with versions of CCW software
ee Standard Edition (All Supported Languages), v9.01.00 and earlier. Certain DLLs included with versions of CCW software can be potentially hijacked to allow an attacker to gain rights to a victim's affected personal computer. Such access rights can be at the same or potentially higher level of privileges as the compromised user account, including and up to computer administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97000 - https://ics-cert.us-cert.gov/advisories/ICSA-17-047-01
CVE ID: CVE-2017-5177 State: PUBLISHED Published: 2017-05-19T02:43:00 Last Updated: 2024-08-05T14:55:34.856Z Vendors: n/a Products: VIPA Controls WinPLC7 Problem Types: CWE-121 Description: A Stack Buffer Overflow issue was discovered in VIPA Controls WinPLC7 5.0.45.5921 and prior. A stack-based buffer overflow vulnerability has been identified, where an attacker with a specially crafted packet could overflow the fixed length buffer. This could allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42693/ - https://ics-cert.us-cert.gov/advisories/ICSA-17-054-01 - http://www.securityfocus.com/bid/96413
CVE ID: CVE-2017-5178 State: PUBLISHED Published: 2017-03-08T08:37:00 Last Updated: 2024-08-05T14:55:35.372Z Vendors: n/a Products: Schneider Electric Wonderware Intelligence 2014R3 and prior Problem Types: default system account Description: An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system account that is installed by default. The default system account is difficult to configure with non-default credentials after installation, and changing the default credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated se
fault credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated security (Active Directory), the software is not vulnerable. However, when Tableau Server is used with local authentication mode, the software is vulnerable. The default system account could be used to gain unauthorized access. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-066-01 - http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000119/ - http://www.securityfocus.com/bid/96721
CVE ID: CVE-2017-5179 State: PUBLISHED Published: 2017-01-05T22:00:00 Last Updated: 2024-08-05T14:55:35.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037558 - http://www.securityfocus.com/bid/95307 - https://www.tenable.com/security/tns-2017-01
CVE ID: CVE-2017-5180 State: PUBLISHED Published: 2017-02-09T18:00:00 Last Updated: 2024-08-05T14:55:35.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95298 - https://firejail.wordpress.com/download-2/release-notes/ - https://security.gentoo.org/glsa/201701-62 - http://openwall.com/lists/oss-s
l.wordpress.com/download-2/release-notes/ - https://security.gentoo.org/glsa/201701-62 - http://openwall.com/lists/oss-security/2017/01/04/2
CVE ID: CVE-2017-5181 State: REJECTED Published: 2017-04-20T14:00:00 Last Updated: 2017-04-20T13:57:01 Description: No description available.
CVE ID: CVE-2017-5182 State: PUBLISHED Published: 2017-01-23T15:00:00 Last Updated: 2024-08-05T14:55:35.431Z Vendors: Micro Focus International Products: Open Enterprise Server Problem Types: unauthenticated directory traversal Description: Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to OES2015 SP1 before Maintenance Update 11080, OES2015 before Maintenance Update 11079, OES11 SP3 before Maintenance Update 11078, OES11 SP2 before Maintenance Upda
0, OES2015 before Maintenance Update 11079, OES11 SP3 before Maintenance Update 11078, OES11 SP2 before Maintenance Update 11077). Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7018503 - http://www.securitytracker.com/id/1037689 - http://www.securityfocus.com/bid/95743
CVE ID: CVE-2017-5183 State: PUBLISHED Published: 2017-04-20T18:00:00 Last Updated: 2024-08-05T14:55:35.391Z Vendors: n/a Products: Identity Server Problem Types: SAML2 mishandling Description: NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7018509
CVE ID: CVE-2017-5184 State: PUBLISHED Published: 2017-03-30T17:00:00 Last Updated: 2024-08-05T14:55:35.416Z Vendors: n/a Products: NetIQ Sentinel Server Problem Types: leakage of information Description: A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow leakage of information (account enumeration). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2017-15 - http://www.securityfocus.com/bid/97262 - https://www.netiq.com/support/kb/doc.php?id=7018753
CVE ID: CVE-2017-5185 State: PUBLISHED Published: 2017-03-30T17:00:00 Last Updated: 2024-08-05T14:55:35.388Z Vendors: n/a Products: NetIQ Sentinel Server Problem Types: remote denial of service Description: A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow remote denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2017-15 - http://www.securityfocus.com/bid/97267 - https://www.netiq.com/support/kb/doc.php?id=7018753
CVE ID: CVE-2017-5186 State: PUBLISHED Published: 2017-04-27T14:00:00 Last Updated: 2024-08-05T14:55:35.486Z Vendors: n/a Products: NetIQ/Novell iManager and eDirectory Problem Types: deprecated hashing algorithm Description: Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x before 9.0.2 Hotfix 2 (9.0.2.2) use the deprecated MD5 hashing algorithm in a communications certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7016794 - https://www.novell.com/support/kb/doc.php?id=3426981 - https://www.novell.com/support/kb/do
port/kb/doc.php?id=7016794 - https://www.novell.com/support/kb/doc.php?id=3426981 - https://www.novell.com/support/kb/doc.php?id=7016795 - https://bugzilla.novell.com/show_bug.cgi?id=1019789 - https://bugzilla.novell.com/show_bug.cgi?id=988749 - https://www.novell.com/support/kb/doc.php?id=7010166 - https://bugzilla.novell.com/show_bug.cgi?id=1019041
CVE ID: CVE-2017-5187 State: PUBLISHED Published: 2017-08-21T15:00:00Z Last Updated: 2024-09-16T22:41:17.504Z Vendors: Micro Focus Products: Micro Focus Enterprise Developer, Micro Focus Enterprise Server Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests. Additional Analyst Notes: - CVE Program Container: Refe
information and inject OS commands (CWE-78) via forged requests. Additional Analyst Notes: - CVE Program Container: References: - https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017
CVE ID: CVE-2017-5188 State: PUBLISHED Published: 2018-03-01T19:00:00Z Last Updated: 2024-09-16T22:26:02.018Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: openSUSE Products: open build service Problem Types: Missing checking for symlinks could use as a path traversal to read files outside of a specific directory. Description: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/open-build-service/commit/ba27c9135187
Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/open-build-service/commit/ba27c91351878bc297ec4baba0bd488a2f3b568d - https://bugzilla.suse.com/show_bug.cgi?id=1029824 - https://www.suse.com/de-de/security/cve/CVE-2017-5188/
CVE ID: CVE-2017-5189 State: PUBLISHED Published: 2018-03-02T20:00:00Z Last Updated: 2024-09-17T03:59:02.559Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: NetIQ Products: iManager Problem Types: Exposure of secret credentials in user exposed data, CWE-522 Description: NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1021637 - https://www.netiq.com/support/kb/doc.php?id=7016795
CVE ID: CVE-2017-5190 State: PUBLISHED Published: 2017-04-20T15:00:00 Last Updated: 2024-08-05T14:55:35.383Z Vendors: n/a Products: NAM Identity Server and SAML2 Service Provider Problem Types: Information leakage Description: NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7018792 - http://www.securityfocus.com/bid/97965 - http://www.securitytracker.com/id/1038338
CVE ID: CVE-2017-5191 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-05T14:55:35.459Z Vendors: n/a Products: NetIQ Access Manager 4.2 and NetIQ Access Manager 4.3 Problem Types: XSS Description: An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7018793 - http://www.securityfocus.com/bid/98093
CVE ID: CVE-2017-5192 State: PUBLISHED Published: 2017-09-26T14:00:00 Last Updated: 2024-08-05T14:55:35.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html - https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html - https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html
CVE ID: CVE-2017-5193 State: PUBLISHED Published: 2017-03-03T15:00:00 Last Updated: 2024-08-05T14:55:35.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a message without a nick. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/01/06/1 - https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html - https://irssi.org/security/irssi_sa_2017_01.txt - http://www.securityfocus.com/bid/95310 - https://security.gentoo.org/glsa/201701-45
CVE ID: CVE-2017-5194 State: PUBLISHED Published: 2017-03-03T15:00:00 Last Updated: 2024-08-05T14:55:35.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick message. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/01/06/1 - https://lists.debian.org/debian-lts-announce/2017/12/msg00022.html - https://irssi.org/security/irssi_sa_2017_01.txt - http://www.securityfocus.com/bid/95310 - https://security.gentoo.org/glsa/201701-45
CVE ID: CVE-2017-5195 State: PUBLISHED Published: 2017-03-03T15:00:00 Last Updated: 2024-08-05T14:55:35.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/01/06/1 - https://irssi.org/security/irssi_sa_2017_01.txt - http://www.securityfocus.com/bid/95310 - https://security.gentoo.org/glsa/201701-45
CVE ID: CVE-2017-5196 State: PUBLISHED Published: 2017-03-03T15:00:00 Last Updated: 2024-08-05T14:55:35.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/01/06/1 - https://irssi.org/security/irssi_sa_2017_01.txt - http://www.securityfocus.com/bid/95310 - https://security.gentoo.org/glsa/201701-45
CVE ID: CVE-2017-5197 State: PUBLISHED Published: 2017-03-06T06:11:00 Last Updated: 2024-08-05T14:55:35.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96572 - https://www.silverstripe.org/download/security-releases/
CVE ID: CVE-2017-5198 State: PUBLISHED Published: 2017-03-24T06:56:00 Last Updated: 2024-08-05T14:55:35.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds LEM (aka SIEM) before 6.3.1 has an incorrect sudo configuration, which allows local users to obtain root access by editing /usr/local/contego/scripts/hostname.sh. Additional Analyst Notes: - CVE Program Container: References: - http://blog.0xlabs.com/2017/03/solarwinds-lem-ssh-jailbreak-and.html - http://www.securityfocus.com/bid/97094
CVE ID: CVE-2017-5199 State: PUBLISHED Published: 2017-03-24T06:56:00 Last Updated: 2024-08-05T14:55:35.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: The editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated users to execute arbitrary code by editing /usr/local/contego/scripts/mgrconfig.pl. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97090 - http://blog.0xlabs.com/2017/03/solarwinds-lem-ssh-jailbreak-and.html