Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-14166 State: PUBLISHED Published: 2017-09-06T18:00:00 Last Updated: 2024-08-05T19:20:40.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/09/06/libarchive-heap-based-buffer-overflow-in-xml_data-archive_read_support_format_xar-c/ - https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html - https://
_data-archive_read_support_format_xar-c/ - https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html - https://www.debian.org/security/2018/dsa-4360 - https://github.com/libarchive/libarchive/commit/fa7438a0ff4033e4741c807394a9af6207940d71 - https://usn.ubuntu.com/3736-1/ - https://security.gentoo.org/glsa/201908-11
CVE ID: CVE-2017-14167 State: PUBLISHED Published: 2017-09-08T18:00:00 Last Updated: 2024-08-05T19:20:41.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100694 - https://access.redhat.com/errata/RHSA-2017:3473 - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - http://www.debian.org/security/2017/dsa-3991 - https://a
://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - http://www.debian.org/security/2017/dsa-3991 - https://access.redhat.com/errata/RHSA-2017:3470 - https://access.redhat.com/errata/RHSA-2017:3472 - https://access.redhat.com/errata/RHSA-2017:3474 - https://usn.ubuntu.com/3575-1/ - http://www.openwall.com/lists/oss-security/2017/09/07/2 - https://access.redhat.com/errata/RHSA-2017:3471 - https://access.redhat.com/errata/RHSA-2017:3368 - https://access.redhat.com/errata/RHSA-2017:3466 - https://lists.nongnu.org/archive/html/qemu-devel/2017-09/msg01032.html - https://access.redhat.com/errata/RHSA-2017:3369
CVE ID: CVE-2017-14169 State: PUBLISHED Published: 2017-09-07T06:00:00 Last Updated: 2024-08-05T19:20:41.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/9d00fb9d70ee8c0cc7002b89318c5be00f1bbdad - http://www.securityfocus.com/bid/100692 - https://lists.debian.org/debian-
it/9d00fb9d70ee8c0cc7002b89318c5be00f1bbdad - http://www.securityfocus.com/bid/100692 - https://lists.debian.org/debian-lts-announce/2019/02/msg00005.html - http://www.debian.org/security/2017/dsa-3996 - https://github.com/FFmpeg/FFmpeg/commit/a4e85b2e1c8d5b4bf0091157bbdeb0e457fb7b8f
CVE ID: CVE-2017-14170 State: PUBLISHED Published: 2017-09-07T06:00:00 Last Updated: 2024-08-05T19:20:41.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file. Addition
g loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/900f39692ca0337a98a7cf047e4e2611071810c2 - http://www.securityfocus.com/bid/100700 - https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html - http://www.debian.org/security/2017/dsa-3996 - https://github.com/FFmpeg/FFmpeg/commit/f173cdfe669556aa92857adafe60cbe5f2aa1210
CVE ID: CVE-2017-14171 State: PUBLISHED Published: 2017-09-07T06:00:00 Last Updated: 2024-08-05T19:20:41.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/c24bcb55
loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/c24bcb553650b91e9eff15ef6e54ca73de2453b7 - http://www.securityfocus.com/bid/100706 - https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html - http://www.debian.org/security/2017/dsa-3996
CVE ID: CVE-2017-14172 State: PUBLISHED Published: 2017-09-07T06:00:00 Last Updated: 2024-08-05T19:20:41.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "extent" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 - https://gi
rogram Container: References: - https://usn.ubuntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 - https://github.com/ImageMagick/ImageMagick/issues/715 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html - https://github.com/ImageMagick/ImageMagick/commit/bdbbb13f1fe9b7e2465502c500561720f7456aac
CVE ID: CVE-2017-14173 State: PUBLISHED Published: 2017-09-07T06:00:00 Last Updated: 2024-08-05T19:20:41.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the addition operation "GetQuantumRange(depth)+1" when "depth" is large, producing a smaller value than expected. As a result, an infinite loop would occur for a crafted TXT file that claims a very large "max_value" value. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 - https://github.com/ImageMagick/ImageMagick/issues/713 - h
ntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 - https://github.com/ImageMagick/ImageMagick/issues/713 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html - https://github.com/ImageMagick/ImageMagick/commit/50f54462076648ac2e36c3f58f4dadd4babbf1c9
CVE ID: CVE-2017-14174 State: PUBLISHED Published: 2017-09-07T06:00:00 Last Updated: 2024-08-05T19:20:41.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but does not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 -
es: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 - https://github.com/ImageMagick/ImageMagick/commit/f68a98a9d385838a1c73ec960a14102949940a64 - https://github.com/ImageMagick/ImageMagick/commit/04a567494786d5bb50894fc8bb8fea0cf496bea8 - https://github.com/ImageMagick/ImageMagick/issues/714 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-14175 State: PUBLISHED Published: 2017-09-07T06:00:00 Last Updated: 2024-08-05T19:20:40.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted XBM file, which claims large rows and columns fields in the header but does not contain sufficient backing data, is provided, the loop over the rows would consume huge CPU resources, since there is no EOF check inside the loop. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/712 - https://usn.ubuntu.com/
: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/712 - https://usn.ubuntu.com/3681-1/ - https://security.gentoo.org/glsa/201711-07 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html - https://github.com/ImageMagick/ImageMagick/commit/d9a8234d211da30baf9526fbebe9a8438ea7e11c
CVE ID: CVE-2017-14176 State: PUBLISHED Published: 2017-11-27T10:00:00 Last Updated: 2024-08-05T19:20:41.042Z Vendors: n/a Products: Bazaar through 2.7.0 Problem Types: command injection Description: Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4052 - https://bugzilla.suse.com/show_bug.cgi?id=1058214 - http://www.ubuntu.com/usn/usn-3411-1 - htt
/security/2017/dsa-4052 - https://bugzilla.suse.com/show_bug.cgi?id=1058214 - http://www.ubuntu.com/usn/usn-3411-1 - https://bugs.debian.org/874429 - http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.html - https://bugs.launchpad.net/bzr/+bug/1710979 - https://bugzilla.redhat.com/show_bug.cgi?id=1486685
CVE ID: CVE-2017-14177 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-17T00:15:35.899Z Vendors: n/a Products: Apport Problem Types: Denial of service via resource exhaustion and privilege escalation Description: Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1324. Additional Analyst Notes: - CVE Program Container: References: - https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-1
Analyst Notes: - CVE Program Container: References: - https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14177 - https://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3171 - https://usn.ubuntu.com/usn/usn-3480-1 - https://launchpad.net/bugs/1726372
CVE ID: CVE-2017-14178 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-16T19:21:04.406Z Vendors: n/a Products: snapd Problem Types: Information leak Description: In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14178.html - https://launchpad.net/bugs/1730255 - https://github.com/snapcore/snapd/pull/4194
CVE ID: CVE-2017-14179 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-16T20:42:06.537Z Vendors: n/a Products: Apport Problem Types: Denial of service via resource exhaustion, privilege escalation, and escape from containers Description: Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers. Additional Analyst Notes: - CVE Program Container: References: - https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179 - https://launchpad
ogram Container: References: - https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179 - https://launchpad.net/bugs/1726372
CVE ID: CVE-2017-14180 State: PUBLISHED Published: 2018-02-02T14:00:00.000Z Last Updated: 2025-11-03T19:25:18.350Z Vendors: na/ Products: Apport Problem Types: Denial of service via resource exhaustion and privilege escalation Description: Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, a different vulnerability than CVE-2017-14179. Additional Analyst Notes: - CVE Program Container: References: - https://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3171 - https:
- CVE Program Container: References: - https://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3171 - https://usn.ubuntu.com/usn/usn-3480-1 - https://launchpad.net/bugs/1726372 - https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14180
CVE ID: CVE-2017-14181 State: PUBLISHED Published: 2017-09-07T16:00:00Z Last Updated: 2024-09-17T03:03:05.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/ - https://github.com/teknoraver/aacplusenc/issue
/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/ - https://github.com/teknoraver/aacplusenc/issues/1
CVE ID: CVE-2017-14182 State: PUBLISHED Published: 2017-10-27T13:00:00 Last Updated: 2024-10-25T14:11:08.541Z Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Denial of Service (DoS) Description: A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' parameter of the JSON web API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://code610.blogspot.com/2017/10/patch-your-fortinet-cve-2017-14182.html - http://www.securitytracker.com/id/1039678 - https://fortiguard.com/psirt/FG-IR-17
ch-your-fortinet-cve-2017-14182.html - http://www.securitytracker.com/id/1039678 - https://fortiguard.com/psirt/FG-IR-17-206 - http://www.securityfocus.com/bid/101559
CVE ID: CVE-2017-14184 State: PUBLISHED Published: 2017-12-15T21:00:00Z Last Updated: 2024-10-25T14:32:46.074Z Vendors: Fortinet, Inc. Products: FortiClient for Windows, FortiClient for Mac OSX, FortiClient SSLVPN Client for Linux Problem Types: Information Disclosure Description: An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2334 and below versions allows regular users to see each other's VPN authentication credentials due to improperly secured storage locations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
improperly secured storage locations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-17-214 - http://www.securityfocus.com/bid/102123
CVE ID: CVE-2017-14185 State: PUBLISHED Published: 2018-05-25T16:00:00Z Last Updated: 2024-10-25T14:31:46.387Z Vendors: Fortinet, Inc. Products: FortiOS Problem Types: Information disclosure Description: An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access internal FortiOS configuration information (eg:addresses) via specifically crafted URLs inside the SSL-VPN web portal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-17-231 - http://www.securityfocus.com/bid/104288
CVE ID: CVE-2017-14186 State: PUBLISHED Published: 2017-11-29T19:00:00Z Last Updated: 2024-10-25T14:10:19.555Z Vendors: Fortinet, Inc. Products: FortiOS Problem Types: Cross-site Scripting (XSS), URL Redirection Attack Description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
via the affected parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1039891 - http://www.securityfocus.com/bid/101955 - https://fortiguard.com/advisory/FG-IR-17-242
CVE ID: CVE-2017-14187 State: PUBLISHED Published: 2018-05-24T20:00:00Z Last Updated: 2024-10-25T14:31:57.582Z Vendors: Fortinet, Inc. Products: FortiOS Problem Types: Execute unauthorized code or commands Description: A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attacker to execute unauthorized binary program contained on an USB drive plugged into a FortiGate via linking the aforementioned binary program to a command that is allowed to be run by the fnsysctl CLI command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytrack
mand. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1040983 - http://www.securityfocus.com/bid/104312 - https://fortiguard.com/advisory/FG-IR-17-245
CVE ID: CVE-2017-14189 State: PUBLISHED Published: 2017-11-29T19:00:00Z Last Updated: 2024-10-25T14:33:19.496Z Vendors: Fortinet, Inc. Products: FortiWebManager Problem Types: Improper Access Control Description: An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/101953 - https://fortiguard.com/advisory/FG-IR-17-248 - http://www.securitytracker.com/id/1039892
CVE ID: CVE-2017-14190 State: PUBLISHED Published: 2018-01-29T16:00:00Z Last Updated: 2024-10-25T14:10:07.889Z Vendors: Fortinet, Inc. Products: FortiOS Problem Types: Execute unauthorized code or commands Description: A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1040284 - http://www.securityfocus.com/bid/102779 - https://fortiguard.com/advisory/FG-IR-17-262
CVE ID: CVE-2017-14191 State: PUBLISHED Published: 2018-03-20T13:00:00Z Last Updated: 2024-10-25T14:09:53.139Z Vendors: Fortinet, Inc. Products: FortiWeb Problem Types: Improper Access Control Description: An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/103430 - https://fortiguard.com/advisory/FG-IR-17-279
CVE ID: CVE-2017-14192 State: PUBLISHED Published: 2017-09-07T17:00:00Z Last Updated: 2024-09-17T01:55:39.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field. Additional Analyst Notes: - CVE Program Container: References: - http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity
CVE ID: CVE-2017-14193 State: PUBLISHED Published: 2017-09-07T17:00:00Z Last Updated: 2024-09-16T22:01:47.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer. Additional Analyst Notes: - CVE Program Container: References: - http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity
CVE ID: CVE-2017-14194 State: PUBLISHED Published: 2017-09-07T17:00:00Z Last Updated: 2024-09-17T01:15:42.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer. Additional Analyst Notes: - CVE Program Container: References: - http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity
CVE ID: CVE-2017-14195 State: PUBLISHED Published: 2017-09-07T17:00:00Z Last Updated: 2024-09-16T20:41:36.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer. Additional Analyst Notes: - CVE Program Container: References: - http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity
CVE ID: CVE-2017-14196 State: PUBLISHED Published: 2017-11-30T02:00:00 Last Updated: 2024-08-05T19:20:41.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and 5.4.1.3. An information disclosure caused by a Path Traversal issue in the 'File Bridge' plugin allowed the existence of files outside of the bridged path to be confirmed. Additional Analyst Notes: - CVE Program Container: References: - http://devalias.net/devalias/2017/09/07/squiz-matrix-multiple-vulnerabilities/
CVE ID: CVE-2017-14197 State: PUBLISHED Published: 2017-11-30T02:00:00 Last Updated: 2024-08-05T19:20:41.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting (XSS) issues in Matrix WYSIWYG plugins. Additional Analyst Notes: - CVE Program Container: References: - http://devalias.net/devalias/2017/09/07/squiz-matrix-multiple-vulnerabilities/