Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-8961 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.322Z Vendors: IBM Corporation Products: BigFix Inventory Problem Types: Gain Access Description: IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. Additional Analyst Notes: - CVE Program Container: Re
nsitive information or conduct further attacks against the victim. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21995037 - http://www.securityfocus.com/bid/95128
CVE ID: CVE-2016-8962 State: PUBLISHED Published: 2017-04-26T17:00:00 Last Updated: 2024-08-06T02:35:02.355Z Vendors: IBM Corporation Products: BigFix Inventory Problem Types: Obtain Information Description: IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98030 - http://www.securitytracker.com/id/1038360 - http://www.ibm.com/support/docview.wss?uid=swg21995031
CVE ID: CVE-2016-8963 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T02:35:02.300Z Vendors: IBM Corporation Products: BigFix Inventory Problem Types: Obtain Information Description: IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95282 - http://www.ibm.com/support/docview.wss?uid=swg21995029
CVE ID: CVE-2016-8964 State: PUBLISHED Published: 2017-07-13T15:00:00Z Last Updated: 2024-09-16T16:17:51.455Z Vendors: IBM Products: BigFix Inventory Problem Types: Obtain Information Description: IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21995024 - http://www.securitytracker.com/id/1038919 - https://exchange.xforce.ibmcloud.com/vulnerabilities/118853 - http://www.securityfocus.com/bid/99548
CVE ID: CVE-2016-8966 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.678Z Vendors: IBM Corporation Products: BigFix Inventory Problem Types: Obtain Information Description: IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21995023 - http://www.securityfocus.com/bid/95138
CVE ID: CVE-2016-8967 State: PUBLISHED Published: 2017-02-01T21:00:00 Last Updated: 2024-08-06T02:35:02.278Z Vendors: IBM Corporation Products: BigFix Inventory Problem Types: Obtain Information Description: IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21995019 - http://www.securityfocus.com/bid/95902
CVE ID: CVE-2016-8968 State: PUBLISHED Published: 2017-02-15T19:00:00 Last Updated: 2024-08-06T02:35:02.327Z Vendors: IBM Corporation Products: Rational Collaborative Lifecycle Management Problem Types: Cross-Site Scripting Description: IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998515. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21998515 - http://www.securitytracker.com/id/1037821 - http://www.securit
http://www.ibm.com/support/docview.wss?uid=swg21998515 - http://www.securitytracker.com/id/1037821 - http://www.securitytracker.com/id/1037820 - http://www.securityfocus.com/bid/96282 - http://www.securitytracker.com/id/1037822 - http://www.securitytracker.com/id/1037823
CVE ID: CVE-2016-8971 State: PUBLISHED Published: 2017-03-07T17:00:00 Last Updated: 2024-08-06T02:35:02.823Z Vendors: IBM Corporation Products: WebSphere MQ Problem Types: Denial of Service Description: IBM WebSphere MQ 8.0 could allow an authenticated user with queue manager permissions to cause a segmentation fault which would result in the box having to be rebooted to resume normal operations. IBM Reference #: 1998663. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/docview.wss?uid=swg21998663
CVE ID: CVE-2016-8972 State: PUBLISHED Published: 2017-02-15T19:00:00 Last Updated: 2024-08-06T02:35:02.333Z Vendors: IBM Corporation Products: AIX Problem Types: Gain Privileges Description: IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the bellmail client. IBM APARs: IV91006, IV91007, IV91008, IV91010, IV91011. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037480 - http://aix.software.ibm.com/aix/efixes/security/bellmail_advisory.asc - http://www.securityfocus.com/bid/94979 - https://www.exploit-db.com/exploits/40950/
CVE ID: CVE-2016-8973 State: PUBLISHED Published: 2017-03-20T16:00:00 Last Updated: 2024-08-06T02:35:02.340Z Vendors: IBM Corporation Products: Rational Rhapsody Design Manager Problem Types: Other Description: IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. IBM Reference #: 1999960. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96826 - http://www.ibm.com/support/docview.wss?uid=swg21999960
CVE ID: CVE-2016-8974 State: PUBLISHED Published: 2017-02-23T16:00:00 Last Updated: 2024-08-06T02:35:02.320Z Vendors: IBM Corporation Products: Rational Rhapsody Design Manager Problem Types: Obtain Information Description: IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997798. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21997798
CVE ID: CVE-2016-8975 State: PUBLISHED Published: 2017-07-24T21:00:00Z Last Updated: 2024-09-16T16:54:11.518Z Vendors: IBM Products: Rational Rhapsody Design Manager Problem Types: Cross-Site Scripting Description: IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118912. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100124 - https://exchange.xforce.ibmcloud.com/vulnerabilities/118912 - http://www.ibm.com/support/docv
rityfocus.com/bid/100124 - https://exchange.xforce.ibmcloud.com/vulnerabilities/118912 - http://www.ibm.com/support/docview.wss?uid=swg22006052
CVE ID: CVE-2016-8977 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T02:35:02.890Z Vendors: IBM Corporation Products: BigFix Inventory Problem Types: Obtain Information Description: IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95308 - http://www.ibm.com/support/docview.wss?uid=swg21995014
CVE ID: CVE-2016-8980 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.296Z Vendors: IBM Corporation Products: BigFix Inventory Problem Types: Obtain Information Description: IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95141 - http://www.ibm.com/support/docview.wss?uid=swg21995013
CVE ID: CVE-2016-8981 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.349Z Vendors: IBM Corporation Products: BigFix Inventory Problem Types: Obtain Information Description: IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95137 - http://www.ibm.com/support/docview.wss?uid=swg21994932
CVE ID: CVE-2016-8982 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T02:35:02.563Z Vendors: IBM Corporation Products: InfoSphere DataStage Problem Types: Obtain Information Description: IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21995895 - http://www.securityfocus.com/bid/95651 - http://www.securitytracker.com/id/1037616
CVE ID: CVE-2016-8986 State: PUBLISHED Published: 2017-02-22T19:00:00 Last Updated: 2024-08-06T02:35:02.362Z Vendors: IBM Corporation Products: WebSphere MQ Problem Types: Denial of Service Description: IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager to bring down MQ channels using specially crafted HTTP requests. IBM Reference #: 1998648. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96412 - http://www.ibm.com/support/docview.wss?uid=swg21998648
CVE ID: CVE-2016-8987 State: PUBLISHED Published: 2017-06-08T21:00:00 Last Updated: 2024-08-06T02:35:02.333Z Vendors: IBM Products: Maximo Asset Management Problem Types: Obtain Information Description: IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21996255 - http://www.securityfocus.com/bid/97369 - https://exchange.xforce.ibmcloud.com/vulnerabilities/119039
CVE ID: CVE-2016-8998 State: PUBLISHED Published: 2017-02-24T18:00:00 Last Updated: 2024-08-06T02:35:02.321Z Vendors: IBM Corporation Products: Tivoli Storage Manager Problem Types: Gain Access Description: IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96443 - http://www.ibm.com/support/docview.wss?uid=swg21998747
CVE ID: CVE-2016-8999 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T02:35:02.323Z Vendors: IBM Corporation Products: InfoSphere Information Server Problem Types: Gain Access Description: IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037563 - http://www.securityfocus.com/bid/95325 - http://www.ibm.com/support/docview.wss?uid=swg21995155
CVE ID: CVE-2016-9000 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T02:35:02.577Z Vendors: IBM Corporation Products: InfoSphere Information Server Problem Types: Cross-Site Scripting Description: IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037564 - http://www.securityfocu
nalyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037564 - http://www.securityfocus.com/bid/95324 - http://www.ibm.com/support/docview.wss?uid=swg21995257
CVE ID: CVE-2016-9005 State: PUBLISHED Published: 2017-02-08T22:00:00 Last Updated: 2024-08-06T02:35:02.569Z Vendors: IBM Corporation Products: System Storage Problem Types: Gain Access Description: IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=ssg1S1009656 - http://www.securityfocus.com/bid/95436
CVE ID: CVE-2016-9006 State: PUBLISHED Published: 2017-03-08T19:00:00 Last Updated: 2024-08-06T02:35:02.554Z Vendors: IBM Corporation Products: UrbanCode Deploy Problem Types: Cross-Site Scripting Description: IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: C1000264. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg2C1000264 - http://www.securityfocus.com/bid/96757
CVE ID: CVE-2016-9008 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T02:35:02.658Z Vendors: IBM Corporation Products: UrbanCode Deploy Problem Types: Gain Access Description: IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95283 - http://www.ibm.com/support/docview.wss?uid=swg2C1000238
CVE ID: CVE-2016-9009 State: PUBLISHED Published: 2017-02-24T18:00:00 Last Updated: 2024-08-06T02:35:02.449Z Vendors: IBM Corporation Products: WebSphere MQ Problem Types: Denial of Service Description: IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #: 1998647. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96441 - http://www.ibm.com/support/docview.wss?uid=swg21998647
CVE ID: CVE-2016-9010 State: PUBLISHED Published: 2017-02-15T19:00:00 Last Updated: 2024-08-06T02:35:02.326Z Vendors: IBM Corporation Products: Integration Bus Problem Types: Gain Access Description: IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM Reference #: 1997906. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96279 - http://www.ibm.com/support/docview.wss?uid=swg2199790
Container: References: - http://www.securityfocus.com/bid/96279 - http://www.ibm.com/support/docview.wss?uid=swg21997906
CVE ID: CVE-2016-9011 State: PUBLISHED Published: 2017-03-23T18:00:00 Last Updated: 2024-08-06T02:35:02.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wmf_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1388450 - http://www.openwall.com/lists/oss-security/2016/10/25/1 - https://blogs.gentoo.org/ago/2016/10/18/libwmf-memory-allocation-failure-in-wmf_malloc-api-c - http://www.securityfocus.com/bid/93860
CVE ID: CVE-2016-9012 State: PUBLISHED Published: 2017-01-23T21:00:00 Last Updated: 2024-08-06T02:35:02.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane, related to a request to /web/system/console/bundle. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/2116-security-advisory-27 - http://www.securityfocus.com/bid/94635
CVE ID: CVE-2016-9013 State: PUBLISHED Published: 2016-12-09T20:00:00 Last Updated: 2024-08-06T02:35:02.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary. Additional Analyst Notes: - CVE Program Container: References: - https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ - https://lists.fedoraproject.org/archiv
ferences: - https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/ - http://www.debian.org/security/2017/dsa-3835 - http://www.ubuntu.com/usn/USN-3115-1 - http://www.securityfocus.com/bid/94069 - http://www.securitytracker.com/id/1037159 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
CVE ID: CVE-2016-9014 State: PUBLISHED Published: 2016-12-09T20:00:00 Last Updated: 2024-08-06T02:35:02.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. Additional Analyst Notes: - CVE Program Container: References: - https://www.djangoproject.com/weblog/2016/nov/01/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/ - http://www
ject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/ - http://www.securityfocus.com/bid/94068 - http://www.debian.org/security/2017/dsa-3835 - http://www.ubuntu.com/usn/USN-3115-1 - http://www.securitytracker.com/id/1037159 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
CVE ID: CVE-2016-9015 State: PUBLISHED Published: 2017-01-11T16:00:00 Last Updated: 2024-08-06T02:35:02.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL.
nSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93941 - http://www.openwall.com/lists/oss-security/2016/10/27/6
CVE ID: CVE-2016-9016 State: PUBLISHED Published: 2017-01-19T20:00:00 Last Updated: 2024-08-06T02:35:02.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/10/25/3 - http://www.openwall.com/lists/oss-security/2016/10/25/9 - http://www.securityfocus.com/bid/93899
CVE ID: CVE-2016-9017 State: PUBLISHED Published: 2016-10-28T15:00:00 Last Updated: 2024-08-06T02:35:02.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive information by using the "opname in crafted JavaScript file" approach, related to an "Out-of-Bounds read" issue affecting the jsC_dumpfunction function in the jsdump.c component. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94241 - http://bugs.ghostscript.com/show_bug.cgi?id=697171
CVE ID: CVE-2016-9018 State: PUBLISHED Published: 2016-10-28T15:00:00 Last Updated: 2024-08-06T02:35:02.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks RealPlayer 18.1.5.705 through a crafted .QCP media file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/40617/ - http://www.securityfocus.com/bid/94239
CVE ID: CVE-2016-9019 State: PUBLISHED Published: 2017-03-07T16:00:00 Last Updated: 2024-08-06T02:35:02.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the is_what parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html - http://seclists.org/fulldisclosure/2016/Nov/12 - http://www.securityfocus.com/bid/97240 - http://forums.exponentcms.org/index.php?p=/dis
org/fulldisclosure/2016/Nov/12 - http://www.securityfocus.com/bid/97240 - http://forums.exponentcms.org/index.php?p=/discussion/comment/1591#Comment_1591