Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-16201 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T22:08:29.336Z Vendors: HackerOne Products: zjjserver node module Problem Types: CWE-22 Description: zjjserver is a static file server. zjjserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/zjjserver - https://nodesecurity.io/advisories/427
CVE ID: CVE-2017-16202 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T01:46:24.524Z Vendors: HackerOne Products: coffeescript node module Problem Types: CWE-506 Description: The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/541
CVE ID: CVE-2017-16203 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T19:00:54.469Z Vendors: HackerOne Products: coffeescript node module Problem Types: CWE-506 Description: The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/543
CVE ID: CVE-2017-16204 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T17:08:16.634Z Vendors: HackerOne Products: jquey node module Problem Types: CWE-506 Description: The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/544
CVE ID: CVE-2017-16205 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T19:52:26.083Z Vendors: HackerOne Products: coffeescript node module Problem Types: CWE-506 Description: The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/542
CVE ID: CVE-2017-16206 State: PUBLISHED Published: 2018-06-07T02:00:00 Last Updated: 2024-08-05T20:20:05.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/540
CVE ID: CVE-2017-16207 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T01:21:18.986Z Vendors: HackerOne Products: discordi.js node module Problem Types: CWE-506 Description: discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/545
CVE ID: CVE-2017-16208 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T23:42:26.974Z Vendors: HackerOne Products: dmmcquay.lab6 node module Problem Types: CWE-22 Description: dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/426 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/dmmcquay.lab6
CVE ID: CVE-2017-16209 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T23:11:06.684Z Vendors: HackerOne Products: enserver node module Problem Types: CWE-22 Description: enserver is a simple web server. enserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/425 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/enserver
CVE ID: CVE-2017-16210 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T22:46:18.513Z Vendors: HackerOne Products: jn_jj_server node module Problem Types: CWE-22 Description: jn_jj_server is a static file server. jn_jj_server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/424 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/jn_jj_server
CVE ID: CVE-2017-16211 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T02:11:33.978Z Vendors: HackerOne Products: lessindex node module Problem Types: CWE-22 Description: lessindex is a static file server. lessindex is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/423 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/lessindex
CVE ID: CVE-2017-16212 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T01:26:41.368Z Vendors: HackerOne Products: ltt node module Problem Types: CWE-22 Description: ltt is a static file server. ltt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/422 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/ltt
CVE ID: CVE-2017-16213 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T03:03:32.402Z Vendors: HackerOne Products: mfrserver node module Problem Types: CWE-22 Description: mfrserver is a simple file server. mfrserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/mfrserver - https://nodesecurity.io/advisories/421
CVE ID: CVE-2017-16214 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T20:52:21.790Z Vendors: HackerOne Products: peiserver node module Problem Types: CWE-22 Description: peiserver is a static file server. peiserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/peiserver - https://nodesecurity.io/advisories/420
CVE ID: CVE-2017-16215 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T23:56:40.152Z Vendors: HackerOne Products: sgqserve node module Problem Types: CWE-22 Description: sgqserve is a simple file server. sgqserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/419 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/sgqserve
CVE ID: CVE-2017-16216 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T17:03:58.203Z Vendors: HackerOne Products: tencent-server node module Problem Types: CWE-22 Description: tencent-server is a simple web server. tencent-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/418 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/tencent-server
CVE ID: CVE-2017-16217 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T02:27:24.116Z Vendors: HackerOne Products: fbr-client node module Problem Types: CWE-22 Description: fbr-client sends files through sockets via socket.io and webRTC. fbr-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/fbr-client - https://nodesecurity.io/advisories/449
CVE ID: CVE-2017-16218 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T19:15:24.231Z Vendors: HackerOne Products: dgard8.lab6 node module Problem Types: CWE-22 Description: dgard8.lab6 is a static file server. dgard8.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/dgard8.lab6 - https://nodesecurity.io/advisories/444
CVE ID: CVE-2017-16219 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T18:07:55.684Z Vendors: HackerOne Products: yttivy node module Problem Types: CWE-22 Description: yttivy is a static file server. yttivy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/441 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/yttivy
CVE ID: CVE-2017-16220 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T22:25:37.389Z Vendors: HackerOne Products: wind-mvc node module Problem Types: CWE-22 Description: wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/wind-mvc - https://nodesecurity.io/advisories/417
CVE ID: CVE-2017-16221 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T01:36:50.872Z Vendors: HackerOne Products: yzt node module Problem Types: CWE-22 Description: yzt is a simple file server. yzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/yzt - https://nodesecurity.io/advisories/416
CVE ID: CVE-2017-16222 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T03:44:17.687Z Vendors: HackerOne Products: elding node module Problem Types: CWE-22 Description: elding is a simple web server. elding is vulnerable to a directory traversal issue, allowing an attacker to access the filesystem by placing "../" in the url. The files accessible, however, are limited to files with a file extension. Sending a GET request to /../../../etc/passwd, for example, will return a 404 on etc/passwd/index.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/elding - https://nodesecurity.i
References: - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/elding - https://nodesecurity.io/advisories/415
CVE ID: CVE-2017-16223 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T02:20:48.902Z Vendors: HackerOne Products: nodeaaaaa node module Problem Types: CWE-22 Description: nodeaaaaa is a static file server. nodeaaaaa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/446 - https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/nodeaaaaa
CVE ID: CVE-2017-16224 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T20:47:48.660Z Vendors: HackerOne Products: st node module Problem Types: CWE-601 Description: st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/stati
n order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. ("%2e%2e", "%2e.", ".%2e"). Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/547
CVE ID: CVE-2017-16225 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T16:52:51.508Z Vendors: HackerOne Products: aegir node module Problem Types: CWE-200 Description: aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/546
CVE ID: CVE-2017-16226 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T16:38:08.513Z Vendors: HackerOne Products: static-eval node module node module Problem Types: CWE-20 Description: The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/548 - https://maustin.net/articles/2017-10/static_eval - https://github.com/substack/static-eval/pull/18
CVE ID: CVE-2017-16227 State: PUBLISHED Published: 2017-10-29T20:00:00 Last Updated: 2024-08-05T20:20:04.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/879474 - http://download.savannah.gnu.org/releases/quagga/quagga-1.2.2.changelog.txt - http://www.debian.org/security/2017/dsa-4011 - https://git.savannah.gnu
org/releases/quagga/quagga-1.2.2.changelog.txt - http://www.debian.org/security/2017/dsa-4011 - https://git.savannah.gnu.org/cgit/quagga.git/commit/?id=7a42b78be9a4108d98833069a88e6fddb9285008 - https://lists.quagga.net/pipermail/quagga-dev/2017-September/033284.html
CVE ID: CVE-2017-16228 State: PUBLISHED Published: 2017-10-29T20:00:00 Last Updated: 2024-08-05T20:20:05.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117. Additional Analyst Notes: - CVE Program Container: References: - https://tracker.debian.org/news/882440 - https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/ - https://www.dulwich.io/code/dulwich/
CVE ID: CVE-2017-16229 State: PUBLISHED Published: 2018-02-26T22:00:00 Last Updated: 2024-08-05T20:20:05.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is supplied to sax_parse. Additional Analyst Notes: - CVE Program Container: References: - https://rubygems.org/gems/ox/versions/2.8.1 - https://github.com/ohler55/ox/issues/195
CVE ID: CVE-2017-16230 State: PUBLISHED Published: 2017-10-30T19:00:00 Last Updated: 2024-08-05T20:20:04.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SQYY/CVE/blob/master/Typecho.txt
CVE ID: CVE-2017-16231 State: PUBLISHED Published: 2019-03-17T16:24:52 Last Updated: 2024-08-05T20:20:05.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://packetstormsecurity.com/files/150897/PCRE-8.41-Buffer-Overflow.html - http://seclists.org/fulldisclosure/2018/Dec/33 - http://www.op
ecurity.com/files/150897/PCRE-8.41-Buffer-Overflow.html - http://seclists.org/fulldisclosure/2018/Dec/33 - http://www.openwall.com/lists/oss-security/2017/11/01/11 - http://www.openwall.com/lists/oss-security/2017/11/01/3 - http://www.openwall.com/lists/oss-security/2017/11/01/7 - http://www.openwall.com/lists/oss-security/2017/11/01/8 - http://www.securityfocus.com/bid/101688 - https://bugs.exim.org/show_bug.cgi?id=2047
CVE ID: CVE-2017-16232 State: PUBLISHED Published: 2019-03-17T16:44:47 Last Updated: 2024-08-05T20:20:05.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html - http://www.openwall.com/lists/oss-security/2017/11/01/11 - http://www.openwall.com/lists/oss-security/2017/11/01/3 - http://www.openwall.com/lists/o
s/oss-security/2017/11/01/11 - http://www.openwall.com/lists/oss-security/2017/11/01/3 - http://www.openwall.com/lists/oss-security/2017/11/01/7 - http://www.openwall.com/lists/oss-security/2017/11/01/8 - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html - http://seclists.org/fulldisclosure/2018/Dec/32 - http://seclists.org/fulldisclosure/2018/Dec/47 - http://www.securityfocus.com/bid/101696
CVE ID: CVE-2017-16237 State: PUBLISHED Published: 2017-11-03T05:00:00 Last Updated: 2024-08-05T20:20:05.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file (VIAGLT64.SYS) contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x8273007C. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101851 - https://www.exploit-db.com/exploits/43109/
CVE ID: CVE-2017-16239 State: PUBLISHED Published: 2017-11-14T17:00:00 Last Updated: 2024-08-05T20:20:05.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3. Additional Analyst Notes: - CVE
4.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101950 - https://access.redhat.com/errata/RHSA-2018:0369 - https://access.redhat.com/errata/RHSA-2018:0241 - https://www.debian.org/security/2017/dsa-4056 - https://launchpad.net/bugs/1664931 - https://security.openstack.org/ossa/OSSA-2017-005.html - https://access.redhat.com/errata/RHSA-2018:0314
CVE ID: CVE-2017-16241 State: PUBLISHED Published: 2017-12-10T01:00:00 Last Updated: 2024-08-05T20:20:04.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in AMAG Symmetry Door Edge Network Controllers (EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00) enables remote attackers to execute door controller commands (e.g., lock, unlock, add ID card value) by sending unauthenticated requests to the affected devices via Serial over TCP/IP, as demonstrated by a Ud command. Additional Analyst Notes: - CVE Program Container: References: - https://hushcon.com/schedule.html - https://www.secureworks.com/rese
alyst Notes: - CVE Program Container: References: - https://hushcon.com/schedule.html - https://www.secureworks.com/research/advisory-2017-001 - https://github.com/lixmk/Concierge
CVE ID: CVE-2017-16242 State: PUBLISHED Published: 2018-03-22T15:00:00 Last Updated: 2024-08-05T20:20:05.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 devices. The fingerprint authentication requirement for data access can be bypassed. An attacker with physical access can send a static packet to a serial port exposed on the PCB to unlock the key and get access to the data without possessing the required fingerprint. Additional Analyst Notes: - CVE Program Container: References: - https://www.blackhat.com/us-17/briefings/schedule/index.html#attacking-encrypted-usb-keys-the-hardware-way-7443 -
es: - https://www.blackhat.com/us-17/briefings/schedule/index.html#attacking-encrypted-usb-keys-the-hardware-way-7443 - https://www.blackhat.com/docs/us-17/thursday/us-17-Picod-Attacking-Encrypted-USB-Keys-The-Hard%28ware%29-Way.pdf - https://gist.github.com/audebert/ef6e206a27ededd1386cff48604e9335 - https://www.elie.net/talk/attacking-encrypted-usb-keys-the-hardware-way
CVE ID: CVE-2017-16244 State: PUBLISHED Published: 2017-11-01T01:00:00 Last Updated: 2024-08-05T20:20:05.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0 - https://www.exploit-db.com/exploits/43106/
CVE ID: CVE-2017-16248 State: PUBLISHED Published: 2017-11-01T01:00:00 Last Updated: 2024-08-05T20:20:05.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/880458 - https://metacpan.org/changes/distribution/Catalyst-Plugin-Static-Simple - https://rt.cpan.org/Public/Bug/Display.html?id=120558