Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-12739 State: PUBLISHED Published: 2017-11-15T08:00:00 Last Updated: 2024-08-05T18:43:56.534Z Vendors: n/a Products: Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00 Problem Types: RCE Description: An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow unauthenticated remote attackers to execute arbitrary code on the affected device. Additional Analyst Notes: - CVE Program Container: References: - https://www.siemens.com/cert/pool/cert/siemens_securi
. Additional Analyst Notes: - CVE Program Container: References: - https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf - http://www.securityfocus.com/bid/101884
CVE ID: CVE-2017-12740 State: PUBLISHED Published: 2017-12-26T04:00:00 Last Updated: 2024-08-05T18:43:56.668Z Vendors: n/a Products: Siemens LOGO! Soft Comfort (All versions before V8.2) Problem Types: CWE-494 Description: Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle (MitM) attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-888929.pdf
CVE ID: CVE-2017-12741 State: PUBLISHED Published: 2017-12-26T04:00:00 Last Updated: 2024-08-05T18:51:06.315Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, SIMATIC Compact Field Unit, SIMATIC ET 200AL IM 157-1 PN, SIMATIC ET 200M (incl. SIPLUS variants), SIMATIC ET 200MP IM 155-5 PN BA, SIMATIC ET 200MP IM 155-5 PN HF, SIMATIC ET 200MP IM 155-5 PN ST, SIMATIC ET 200pro IM 154-3 PN HF, SIMATIC ET 200pro IM 154-4 PN HF, SIMATIC ET 200SP IM 155-6 PN
200MP IM 155-5 PN ST, SIMATIC ET 200pro IM 154-3 PN HF, SIMATIC ET 200pro IM 154-4 PN HF, SIMATIC ET 200SP IM 155-6 PN BA, SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants), SIMATIC ET 200SP IM 155-6 PN HF, SIMATIC ET 200SP IM 155-6 PN HS, SIMATIC ET 200SP IM 155-6 PN ST, SIMATIC ET 200SP IM 155-6 PN ST BA, SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12, SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN, 4AO U/I 4xM12, SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12, SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12, SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12, SIMATIC ET20
, 8AI; 4 U/I; 4 RTD/TC 8xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12, SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12, SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12, SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN: IO-Link Master, SIMATIC ET200S (incl. SIPLUS variants), SIMATIC PN/PN Coupler (incl. SIPLUS NET variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-200 SMART, SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-400 H V6 and below CPU family (incl. SIPLUS variants), SIMATIC
incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-400 H V6 and below CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIMATIC TDC CP51M1, SIMATIC TDC CPU555, SIMATIC WinAC RTX 2010, SIMATIC WinAC RTX F 2010, SIMOCODE pro V PROFINET (incl. SIPLUS variants), SIMOTION C, SIMOTION D, SIMOTION D4xx V4.4 for SINAMICS SM150i-2 w. PROFINET (incl. SIPLUS variants), SIMOTION P V4.4 and V4.5, SIMOTION P V5, SINAMICS DCM w. PN, SINAMICS DCP w. PN, SINAMICS G110M w. PN, SINAMICS G120(C/P/D) w. PN (incl. SIPLUS variants), SINAMIC
INAMICS DCM w. PN, SINAMICS DCP w. PN, SINAMICS G110M w. PN, SINAMICS G120(C/P/D) w. PN (incl. SIPLUS variants), SINAMICS G130 V4.7 w. PN, SINAMICS G130 V4.8 w. PN, SINAMICS G150 V4.7 w. PN, SINAMICS G150 V4.8 w. PN, SINAMICS GH150 V4.7 w. PROFINET, SINAMICS GL150 V4.7 w. PROFINET, SINAMICS GM150 V4.7 w. PROFINET, SINAMICS S110 w. PN, SINAMICS S120 prior to V4.7 w. PN (incl. SIPLUS variants), SINAMICS S120 V4.7 SP1 w. PN (incl. SIPLUS variants), SINAMICS S120 V4.7 w. PN (incl. SIPLUS variants), SINAMICS S120 V4.8 w. PN (incl. SIPLUS variants), SINAMICS S150 V4.7 w. PN, SINAMICS S150 V4.8 w. PN, SINAMICS SL150 V4.7.0 w. PROFINET, SINAMICS SL150 V4.7.4 w. PROFINET, SINAMICS SL150 V4.7.5 w. PRO
MICS S150 V4.8 w. PN, SINAMICS SL150 V4.7.0 w. PROFINET, SINAMICS SL150 V4.7.4 w. PROFINET, SINAMICS SL150 V4.7.5 w. PROFINET, SINAMICS SM120 V4.7 w. PROFINET, SINAMICS V90 w. PN, SINUMERIK 840D sl, SIPLUS ET 200MP IM 155-5 PN HF, SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL, SIPLUS ET 200MP IM 155-5 PN ST, SIPLUS ET 200MP IM 155-5 PN ST TX RAIL, SIPLUS ET 200SP IM 155-6 PN HF, SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL, SIPLUS ET 200SP IM 155-6 PN ST, SIPLUS ET 200SP IM 155-6 PN ST BA, SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL, SIPLUS ET 200SP IM 155-6 PN ST TX RAIL, SIRIUS Soft Starter 3RW44 PN Problem Types: CWE-400 Description: Specially crafted packets sent to port 161/udp could cause a denial of
rter 3RW44 PN Problem Types: CWE-400 Description: Specially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually. Additional Analyst Notes: - CVE Program Container: References: - https://www.securityfocus.com/bid/101964 - https://cert-portal.siemens.com/productcert/pdf/ssa-546832.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-346262.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-141614.pdf - https://cert-portal.siemens.com/productcert/html/ssa-346262.html - https://cert-portal.siemens.com/productcert/html/ssa-546832.html - https://cert-portal.siemens.com/productcert/html/ssa-141614.html
CVE ID: CVE-2017-12754 State: PUBLISHED Published: 2017-08-09T15:00:00 Last Updated: 2024-08-05T18:51:06.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67_0RT-AC5300 and earlier for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by sending a crafted http GET re
16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by sending a crafted http GET request packet that includes a long delete_offline_client parameter in the url. Additional Analyst Notes: - CVE Program Container: References: - https://asuswrt.lostrealm.ca/changelog - https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/Asus_DeleteOfflineClientOverflow.txt
CVE ID: CVE-2017-12756 State: PUBLISHED Published: 2017-08-09T21:00:00 Last Updated: 2024-08-05T18:51:05.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile[0] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://extplorer.net/news/21
CVE ID: CVE-2017-12757 State: PUBLISHED Published: 2019-05-09T17:26:11 Last Updated: 2024-08-05T18:51:05.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business Networking Script 8.26i and Tech Caregiver Script 2.71i and Tech Classifieds Script 7.41i and Tech Dating Script 3.40i and Tech Freelancer Script 5.27i and Tech Image Sharing Script 4.13i and Tech Job Script 9.27i and Tech Movie Script 7.51i and Tech Multi Vendor Script 6.63i and Tech Social Networking Script 3.08i and Tech Travel Script 9.49. The impact is: Code execution (remote). Additional Ana
Tech Social Networking Script 3.08i and Tech Travel Script 9.49. The impact is: Code execution (remote). Additional Analyst Notes: - CVE Program Container: References: - http://ambit.com - http://itech.com - https://www.exploit-db.com/exploits/42507
CVE ID: CVE-2017-12758 State: PUBLISHED Published: 2019-05-09T17:20:47 Last Updated: 2024-08-05T18:51:05.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. The impact is: Code execution (remote). The component is: com_appointment component. Additional Analyst Notes: - CVE Program Container: References: - http://joomlaextension.biz/appointment/ - https://www.exploit-db.com/exploits/42492
CVE ID: CVE-2017-12759 State: PUBLISHED Published: 2019-05-09T17:16:59 Last Updated: 2024-08-05T18:51:05.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ynet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection. The impact is: Code execution (remote). Additional Analyst Notes: - CVE Program Container: References: - http://demo.ynetinteractive.com/soa/ - http://soa.com - https://www.exploit-db.com/exploits/42499
CVE ID: CVE-2017-12760 State: PUBLISHED Published: 2019-05-09T17:13:19 Last Updated: 2024-08-05T18:51:05.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ynet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection. The impact is: Code execution (remote). Additional Analyst Notes: - CVE Program Container: References: - http://demo.ynetinteractive.com/mobiketa/index.php?url=myCampaign&view=-9999%27+/%2A%2150000union%2A/+select=%5BSQL%5D - https://www.exploit-db.com/exploits/41283
CVE ID: CVE-2017-12761 State: PUBLISHED Published: 2019-05-09T17:06:48 Last Updated: 2024-08-05T18:51:06.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download (remote). The component is: $file = $_GET['id'] in download.php. The attack vector is: http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?id=WebExplorer/../config.php. Additional Analyst Notes: - CVE Program Container: References: - http://codecanyon.net/user/Endober - http://webfile.com - http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?i
/user/Endober - http://webfile.com - http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?id=WebExplorer/../config.php - https://www.exploit-db.com/exploits/42440
CVE ID: CVE-2017-12762 State: PUBLISHED Published: 2017-08-09T21:00:00 Last Updated: 2024-08-05T18:51:05.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3620-2/ - https://patchwork.kernel.org/patch/9880041/ - http://www.securityfocus.com/bid/100251 - https://usn.ubuntu.com/3620-1/ - http://www.openwall.com/lists/os
h/9880041/ - http://www.securityfocus.com/bid/100251 - https://usn.ubuntu.com/3620-1/ - http://www.openwall.com/lists/oss-security/2020/02/11/1 - http://www.openwall.com/lists/oss-security/2020/02/11/2 - http://www.openwall.com/lists/oss-security/2020/02/14/4
CVE ID: CVE-2017-12763 State: PUBLISHED Published: 2017-08-29T15:00:00 Last Updated: 2024-08-05T18:51:06.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files. Additional Analyst Notes: - CVE Program Container: References: - https://www.nomachine.com/SU08O00185 - https://www.nomachine.com/forums/topic/security-advisory-nomachine-privileges-escalation-vulnerability
CVE ID: CVE-2017-12774 State: PUBLISHED Published: 2017-08-09T21:00:00Z Last Updated: 2024-09-16T17:14:22.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzcrnx/finecms/issues/1
CVE ID: CVE-2017-12775 State: PUBLISHED Published: 2017-08-29T15:00:00 Last Updated: 2024-08-05T18:51:06.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/q2a/question2answer/commit/6013ca1c83bf232008f7be815c0e4821fb6b120a - http://www.question2answer.org/versions.php
CVE ID: CVE-2017-12776 State: PUBLISHED Published: 2017-08-18T17:00:00 Last Updated: 2024-08-05T18:51:06.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xxfocus/cve/blob/master/takeupdate.md - http://sh1yan.top/shiyan/cve.txt
CVE ID: CVE-2017-12777 State: PUBLISHED Published: 2017-08-09T21:00:00 Last Updated: 2024-08-05T18:51:06.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via some parameter to usersearch.php. Additional Analyst Notes: - CVE Program Container: References: - http://lu4n.com/cve/4.txt - http://www.d4rksec.org/cve/CVE-2017-12777.txt
CVE ID: CVE-2017-12778 State: PUBLISHED Published: 2019-05-09T16:38:46 Last Updated: 2024-08-05T18:51:06.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to qBittorrent functions by tampering the affected flag value of the config file at the C:\Users\<username>\Roaming\qBittorrent pathname. The attacker must change the value of the "locked" attribute to "false" within the "Locking" stanza. NOTE: This is an intended behavior. See https://github.com/qbittorrent/qBittorrent/wiki/I-forgot-my-UI-lock-password Additional Analyst Notes: - CVE Progr
. See https://github.com/qbittorrent/qBittorrent/wiki/I-forgot-my-UI-lock-password Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40BaYinMin/cve-2017-12778-qbittorrent-ui-lock-authentication-bypass-30959ff55ada - http://archive.is/eF2GR - https://github.com/qbittorrent/qBittorrent/wiki/I-forgot-my-UI-lock-password
CVE ID: CVE-2017-12779 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T18:51:06.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Node_GetData function in corec/corec/node/node.c in mkvalidator 0.5.1 allows remote attackers to cause a denial of service (Null pointer dereference and application crash) via a crafted mkv file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/144902/mkvalidator-0.5.1-Denial-Of-Service.html - http://seclists.org/fulldisclosure/2017/Nov/19 - https://github.com/Matroska-Org/foundation-source/issues/24
CVE ID: CVE-2017-12780 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T18:51:06.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadData function in ebmlstring.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted mkv file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/144902/mkvalidator-0.5.1-Denial-Of-Service.html - http://seclists.org/fulldisclosure/2017/Nov/19 - https://github.com/Matroska-Org/foundation-source/issues/24
CVE ID: CVE-2017-12781 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T18:51:06.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EBML_BufferToID function in ebmlelement.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (Null pointer dereference and application crash) via a crafted mkv file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/144902/mkvalidator-0.5.1-Denial-Of-Service.html - http://seclists.org/fulldisclosure/2017/Nov/19 - https://github.com/Matroska-Org/foundation-source/issues/24
CVE ID: CVE-2017-12782 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T18:51:06.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/144902/mkvalidator-0.5.1-Denial-Of-Service.html - http://seclists.org/fulldisclosure/2017/Nov/19 - https://github.com/Matroska-Org/foundation-source/issues/24
CVE ID: CVE-2017-12783 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T18:51:06.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/144902/mkvalidator-0.5.1-Denial-Of-Service.html - http://seclists.org/fulldisclosure/2017/Nov/19 - https://github.com/Matroska-Org/foundation-source/issues/24
CVE ID: CVE-2017-12784 State: PUBLISHED Published: 2017-08-21T07:00:00 Last Updated: 2024-08-05T18:51:07.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Youngzsoft CCFile (aka CC File Transfer) 3.6, by sending a crafted HTTP request, it is possible for a malicious user to remotely crash the affected software. No authentication is required. An example payload is a malformed request header with many '|' characters. NOTE: some sources use this ID for a NoviWare issue, but the correct ID for that issue is CVE-2017-12787. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/0B9DojFnTUSNGcG1WN2Q1eVZMQTg/view
CVE ID: CVE-2017-12785 State: PUBLISHED Published: 2017-08-22T17:00:00 Last Updated: 2024-08-05T18:51:06.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is prone to a buffer overflow in the "show log cli" command. This could be used by a read-only user (monitor role) to gain privileged (root) code execution on the switch via command injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42518/
CVE ID: CVE-2017-12786 State: PUBLISHED Published: 2017-08-22T17:00:00 Last Updated: 2024-08-05T18:51:06.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be leveraged by remote, unauthenticated attackers to gain resultant privileged (root) code execution on the switch, because there is a stack-based buffer overflow during unserialization of packet data. Additional Analyst Notes: - CVE Pr
because there is a stack-based buffer overflow during unserialization of packet data. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42518/
CVE ID: CVE-2017-12787 State: PUBLISHED Published: 2017-08-22T17:00:00 Last Updated: 2024-08-05T18:51:07.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: A network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be leveraged by remote, unauthenticated attackers to gain resultant privileged (root) code execution on the switch, because incoming packet data can contain embedded OS commands, and can also trigger a stack-based buffer overflow. Ad
h, because incoming packet data can contain embedded OS commands, and can also trigger a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42518/
CVE ID: CVE-2017-12788 State: PUBLISHED Published: 2019-05-09T14:54:38 Last Updated: 2024-08-05T18:51:07.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1 parameter or the (2) anyid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lemon666/vuln/blob/master/MetInfo5.3.md
CVE ID: CVE-2017-12789 State: PUBLISHED Published: 2019-05-10T14:02:37 Last Updated: 2024-08-05T18:51:06.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lemon666/vuln/blob/master/MetInfo5.3.md
CVE ID: CVE-2017-12790 State: PUBLISHED Published: 2019-05-09T16:21:58 Last Updated: 2024-08-05T18:51:07.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lemon666/vuln/blob/master/MetInfo5.3.md
CVE ID: CVE-2017-12791 State: PUBLISHED Published: 2017-08-23T14:00:00 Last Updated: 2024-08-05T18:51:07.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saltstack/salt/pull/42944 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399 - http://www.securityfocus.com/bid/100384 - https://bugzilla.redhat.com/show_bug.cgi?id=1482006 - https://docs.saltstack.com/en/latest/top
ityfocus.com/bid/100384 - https://bugzilla.redhat.com/show_bug.cgi?id=1482006 - https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html - https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html