Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-9791 State: PUBLISHED Published: 2017-07-10T16:00:00.000Z Last Updated: 2025-10-21T23:55:38.964Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: Remote Code Execution Description: The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - http://www.securityfocus.com/bid/99484 - https://www.exploit-db.com/exploits/42324/ - http://struts.apache.org/docs/s2-048.html - http://w
yfocus.com/bid/99484 - https://www.exploit-db.com/exploits/42324/ - http://struts.apache.org/docs/s2-048.html - http://www.securitytracker.com/id/1038838 - https://www.exploit-db.com/exploits/44643/ - https://security.netapp.com/advisory/ntap-20180706-0002/
CVE ID: CVE-2017-9792 State: PUBLISHED Published: 2017-10-03T01:00:00Z Last Updated: 2024-09-17T04:24:31.508Z Vendors: Apache Software Foundation Products: Apache Impala Problem Types: Information Disclosure Description: In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external" and then changing the underlying table mapping to point to other Kudu tables. This violates and works around the authorization requirement that creating a Kudu external table via Impala requires an "ALL" privilege at the server scope. This privilege requirement for "CREATE" comman
xternal table via Impala requires an "ALL" privilege at the server scope. This privilege requirement for "CREATE" commands is enforced to precisely avoid this scenario where a malicious user can change the underlying Kudu table mapping. The fix is to enforce the same privilege requirement for "ALTER" commands that would make existing non-external Kudu tables external. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/IMPALA-5638 - http://www.securityfocus.com/bid/101173 - https://lists.apache.org/thread.html/74a163df0cdefcd738c8d18821e69aa69eed2ba5384c0cc255d15c4b%40%3Cannounce.apache.org%3E
CVE ID: CVE-2017-9793 State: PUBLISHED Published: 2017-09-20T17:00:00Z Last Updated: 2024-09-16T20:12:54.032Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: A remote attacker may create a DoS attack by sending crafted xml request when using the Struts REST plugin Description: The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - http://www.
tainer: References: - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - http://www.securitytracker.com/id/1039262 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 - http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2017-429.htm - https://security.netapp.com/advisory/ntap-20180629-0001/ - https://struts.apache.org/docs/s2-051.html - http://www.securityfocus.com/bid/100611
CVE ID: CVE-2017-9794 State: PUBLISHED Published: 2017-09-29T21:00:00Z Last Updated: 2024-09-17T03:02:45.659Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: Concurrent Execution using Shared Resource with Improper Synchronization error Description: When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view. Additional Analyst Notes: - CVE Program Container: References: - http://mail-arc
hat the user is not authorized to view. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/geode-user/201709.mbox/%3cCAEwge-FqzrT+deCkNkM-EQZuKfg-XuqY4cGjFiqxoKBVduY1Zw%40mail.gmail.com%3e
CVE ID: CVE-2017-9795 State: PUBLISHED Published: 2018-01-10T03:00:00Z Last Updated: 2024-09-16T22:30:33.662Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: Improper Access Control Description: When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/0fc5ea3c1ea06fe7058a0ab56d593914b05f728a6c93c5a6755956c7%40%3Cuser.
: References: - https://lists.apache.org/thread.html/0fc5ea3c1ea06fe7058a0ab56d593914b05f728a6c93c5a6755956c7%40%3Cuser.geode.apache.org%3E - http://www.securityfocus.com/bid/102488 - https://lists.apache.org/thread.html/3a48163ca1fff757aefa4d9df24a251bb11ddd599a78cd85585abd00%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/232d75150991820d2fe6ba6bd4265fb58b4fe4d9d8d62eb2fd97256c%40%3Cdev.geode.apache.org%3E
CVE ID: CVE-2017-9796 State: PUBLISHED Published: 2018-01-10T03:00:00Z Last Updated: 2024-09-17T00:16:51.123Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: Improper Access Control Description: When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/e580d22195b6b61ff9cf866ac6dd6fe16e790ff0e14a3b1a22cd20b1%40%3Cuser.geode.apache.org%3E
CVE ID: CVE-2017-9797 State: PUBLISHED Published: 2017-10-02T13:00:00Z Last Updated: 2024-09-16T20:41:55.665Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: Improper Access Control error Description: When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/geode-user/201709.mbox/%3cCAEwge-Hrbb7J
- CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/geode-user/201709.mbox/%3cCAEwge-Hrbb7JS8Nygrh7geyFvW4bMZ3AdCmPOzMfvbniipz0bA%40mail.gmail.com%3e
CVE ID: CVE-2017-9798 State: PUBLISHED Published: 2017-09-18T15:00:00.000Z Last Updated: 2025-11-04T16:09:11.219Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: use-after-free Description: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depend
o read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3113 - http://www.securityfocus.com/bid/100872 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://access.redhat.com/errata/RHSA-
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://access.redhat.com/errata/RHSA-2017:2882 - https://access.redhat.com/errata/RHSA-2017:2972 - https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch - https://support.apple.com/HT208331 - http://www.securitytracker.com/id/1039387 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2017:3475 - https://github.com/hannob/optionsbleed - https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch - https://access.redhat.com/errata/RHSA-2017:32
hes/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch - https://access.redhat.com/errata/RHSA-2017:3240 - https://access.redhat.com/errata/RHSA-2017:3195 - https://access.redhat.com/errata/RHSA-2017:3018 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - https://access.redhat.com/errata/RHSA-2017:3239 - https://access.redhat.com/errata/RHSA-2017:3476 - http://www.securityfocus.com/bid/105598 - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://access.redhat.com/errata/RHSA-2017:3114 - https://access.redhat.com/errata/RHSA-2017:3477 - htt
8-4428296.html - https://access.redhat.com/errata/RHSA-2017:3114 - https://access.redhat.com/errata/RHSA-2017:3477 - http://openwall.com/lists/oss-security/2017/09/18/2 - https://security.netapp.com/advisory/ntap-20180601-0003/ - https://access.redhat.com/errata/RHSA-2017:3194 - https://security-tracker.debian.org/tracker/CVE-2017-9798 - https://access.redhat.com/errata/RHSA-2017:3193 - http://www.debian.org/security/2017/dsa-3980 - https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html - https://www.exploit-db.com/exploits/42745/ - https://security.gentoo.org/glsa/201710-32 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-50
42745/ - https://security.gentoo.org/glsa/201710-32 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache
df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E - https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a - https://lists.
s.httpd.apache.org%3E - https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c6
0%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r75
4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2017-9799 State: PUBLISHED Published: 2017-08-09T21:00:00Z Last Updated: 2024-09-17T02:06:16.001Z Vendors: Apache Software Foundation Products: Apache Storm Problem Types: code execution as a different user. Description: It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/b9125bf507ed6f2ca6e85ba1
onal Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/b9125bf507ed6f2ca6e85ba1a4b44e232aa70eeddfba2a9d8a954127%40%3Cdev.storm.apache.org%3E - http://www.securityfocus.com/bid/100235 - http://www.securitytracker.com/id/1039116
CVE ID: CVE-2017-9800 State: PUBLISHED Published: 2017-08-11T21:00:00Z Last Updated: 2024-09-16T23:36:59.228Z Vendors: Apache Software Foundation Products: Apache Subversion Problem Types: Remote Code Execution Description: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://. Addit
. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/cb607dc2f13bab9769147759ddccb14a4f9d8e5cdcad5e99c0d03b63%40%3Cannounce.apache.org%3E - http://www.securityfocus.com/bid/100259 - http://www.securityfocus.com/archive/1/540999/100/0/threaded - https://access.redhat.com/errata/RHSA-2017:2480 - http://www.securitytracker.com/id/1039127 - https://security.gentoo.org/glsa/201709-09 - http://www.debian.org/security/2017/dsa-3932 - https://lists.apache.org/thread.html/d8cf53affd700dfce90bad4968fb8b1dfb69cf7c443052c70398ff76%40%3Ccommit
017/dsa-3932 - https://lists.apache.org/thread.html/d8cf53affd700dfce90bad4968fb8b1dfb69cf7c443052c70398ff76%40%3Ccommits.subversion.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2017-08-11-933099891.html - https://support.apple.com/HT208103 - https://subversion.apache.org/security/CVE-2017-9800-advisory.txt - http://packetstormsecurity.com/files/143722/Apache-Subversion-Arbitrary-Code-Execution.html
CVE ID: CVE-2017-9801 State: PUBLISHED Published: 2017-08-07T15:00:00Z Last Updated: 2024-09-16T19:05:37.866Z Vendors: Apache Software Foundation Products: Apache Commons Email Problem Types: SMTP header injection Description: When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/7ef903a772a2ff08605df1be819044fb15df2815eb3d63878b3fbbb5%40%3Cannounce.apache.org%3E - http://www.securitytracker.com/id/1039043 - http://www.securityfocus.com/bid/100082
CVE ID: CVE-2017-9802 State: PUBLISHED Published: 2017-08-14T13:00:00 Last Updated: 2024-08-05T17:18:01.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100284 - http://www.securityfocus.com/archive/1/541024/100/0/threaded - http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html - https://lists.apache.org/thread.html/2
ty.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html - https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91%40%3Cdev.sling.apache.org%3E - https://issues.apache.org/jira/browse/SLING-7041
CVE ID: CVE-2017-9803 State: PUBLISHED Published: 2017-09-18T21:00:00Z Last Updated: 2024-09-17T02:01:07.460Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: Information Disclosure Description: Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege esc
users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100870 - http://mail-archives.us.apache.org/mod_mbox/www-announce/201709.mbox/%3CCAOOKt53AOScg04zUh0%2BR_fcXD0C9s5mQ-OzdgYdnHz49u1KmXw%40mail.gmail.com%3E
CVE ID: CVE-2017-9804 State: PUBLISHED Published: 2017-09-20T17:00:00Z Last Updated: 2024-09-17T03:37:30.803Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: A regular expression Denial of Service when using URLValidator (similar to S2-044 & S2-047) Description: In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672. Additional Analyst Notes: - CVE Program Con
ulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 - http://www.securityfocus.com/bid/100612 - https://security.netapp.com/advisory/ntap-20180629-0001/ - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt - http://www.securitytracker.com/id/1039261 - https://struts.apache.org/docs/s2-050.html
CVE ID: CVE-2017-9805 State: PUBLISHED Published: 2017-09-15T19:00:00.000Z Last Updated: 2025-10-21T23:55:34.589Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: RCE Description: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - https://struts.apache.org/docs/s2-052.html - http://ww
/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - https://struts.apache.org/docs/s2-052.html - http://www.securitytracker.com/id/1039263 - http://www.securityfocus.com/bid/100609 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 - https://bugzilla.redhat.com/show_bug.cgi?id=1488482 - https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax - https://www.exploit-db.com/exploits/42627/ - https://lgtm.com/blog/apache_struts_CVE-2017-9805 - https://cwiki.apache.org/confluence/display/WW/S2-052 - https://security.netapp.com/advisory/ntap-20170907-0001/ - https://www.kb.cert.org/vuls/id/112992
CVE ID: CVE-2017-9806 State: PUBLISHED Published: 2017-11-20T17:00:00Z Last Updated: 2024-09-16T22:45:39.564Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: Potential Arbitrary Code Execution Description: A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.openoffice.org/security/cves/CVE-2017-9806.html - http://www.securityfocus.com/bid/101585
CVE ID: CVE-2017-9807 State: PUBLISHED Published: 2017-06-22T03:00:00 Last Updated: 2024-08-05T17:18:01.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands via api/saveconfig. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/issues/620 - http://www.securityfocus.com/bid/99232 - http://www.openwall.c
hub.com/E2OpenPlugins/e2openplugin-OpenWebif/issues/620 - http://www.securityfocus.com/bid/99232 - http://www.openwall.com/lists/oss-security/2017/10/02/4 - https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/
CVE ID: CVE-2017-9808 State: PUBLISHED Published: 2019-05-22T19:01:49 Last Updated: 2024-08-05T17:18:02.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html