Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7374 State: PUBLISHED Published: 2017-03-31T20:00:00 Last Updated: 2024-08-05T15:56:36.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service (NULL pointer dereference) or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be freed prematurely. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-10-01 - http://www.securityfocus.com/bid/97308 - https://github.com/torvalds/linux/commit/1b53cf981
curity/bulletin/2017-10-01 - http://www.securityfocus.com/bid/97308 - https://github.com/torvalds/linux/commit/1b53cf9815bb4744958d41f3795d5d5a1d365e2d - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.7 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1b53cf9815bb4744958d41f3795d5d5a1d365e2d
CVE ID: CVE-2017-7375 State: PUBLISHED Published: 2018-02-19T19:00:00 Last Updated: 2024-08-05T15:56:36.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable). Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesour
t be otherwise unreachable). Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa - https://source.android.com/security/bulletin/2017-06-01 - https://www.debian.org/security/2017/dsa-3952 - http://www.securityfocus.com/bid/98877 - https://security.gentoo.org/glsa/201711-01 - https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e - https://bugzilla.redhat.com/show_bug.cgi?id=1462203 - http://www.securitytracker.com/id/1038623
CVE ID: CVE-2017-7376 State: PUBLISHED Published: 2018-02-19T19:00:00 Last Updated: 2024-08-05T15:56:36.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-06-01 - https://www.debian.org/security/2017/dsa-3952 - https://git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1cd730f7e - https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4 - http://www.secu
https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4 - http://www.securityfocus.com/bid/98877 - https://bugzilla.redhat.com/show_bug.cgi?id=1462216 - http://www.securitytracker.com/id/1038623
CVE ID: CVE-2017-7377 State: PUBLISHED Published: 2017-04-10T15:00:00 Last Updated: 2024-08-05T15:56:36.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - http://www.openwall.com/lists/oss-security/2017/04/03/2 - https://security.gentoo.org/glsa/201706-03 - https://bugzilla.redhat.com/show_bug.cgi?id=14
/oss-security/2017/04/03/2 - https://security.gentoo.org/glsa/201706-03 - https://bugzilla.redhat.com/show_bug.cgi?id=1437871 - http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=d63fb193e71644a073b77ff5ac6f1216f2f6cf6e - https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg05449.html - http://www.securityfocus.com/bid/97319
CVE ID: CVE-2017-7378 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-05T15:56:36.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/03/31/podofo-heap-based-buffer-overflow-in-podofopdfpainterexpandtabs-pdfpainter-cpp - http://www.securityfocus.com/bid/97296
CVE ID: CVE-2017-7379 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-05T15:56:36.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97296 - https://blogs.gentoo.org/ago/2017/03/31/podofo-heap-based-buffer-overflow-in-podofopdfsimpleencodingconverttoencoding-pdfencoding-cpp
CVE ID: CVE-2017-7380 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-05T15:56:36.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/03/31/podofo-four-null-pointer-dereference - http://www.securityfocus.com/bid/97296
CVE ID: CVE-2017-7381 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-05T15:56:36.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/03/31/podofo-four-null-pointer-dereference - http://www.securityfocus.com/bid/97296
CVE ID: CVE-2017-7382 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-05T15:56:36.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/03/31/podofo-four-null-pointer-dereference - http://www.securityfocus.com/bid/97296
CVE ID: CVE-2017-7383 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-05T15:56:36.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/03/31/podofo-four-null-pointer-dereference - http://www.securityfocus.com/bid/97296
CVE ID: CVE-2017-7384 State: PUBLISHED Published: 2017-06-01T16:00:00 Last Updated: 2024-08-05T15:56:36.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://bits3c.blogspot.dk/2017/05/cve-2017-7384-reflected-xss-in-flippdf.html
CVE ID: CVE-2017-7386 State: PUBLISHED Published: 2017-03-31T23:58:00 Last Updated: 2024-08-05T15:56:36.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98082 - https://github.com/citymont/symetrie/issues/3
CVE ID: CVE-2017-7387 State: PUBLISHED Published: 2017-03-31T23:58:00 Last Updated: 2024-08-05T15:56:36.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TheFirstQuestion/HelpMeWatchWho/issues/1 - http://www.securityfocus.com/bid/97309
CVE ID: CVE-2017-7388 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T15:56:36.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) was discovered in 'wallacepos v1.4.1'. The vulnerability exists due to insufficient filtration of user-supplied data (token) passed to the 'wallacepos-master/myaccount/resetpassword.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97316 - https://github.com/micwallace/wallacepos/issues/84
CVE ID: CVE-2017-7389 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T15:56:36.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97310 - https://github.com/gunet/openeclass/issues/11
CVE ID: CVE-2017-7390 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T16:04:10.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data (mail) passed to the 'SocialNetwork-andrea/app/template/pw_forgot.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/andreas83/SocialNetwork/issues/84 - http://www.securityfocus.com/bid/97312
CVE ID: CVE-2017-7391 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T16:04:10.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dweeves/magmi-git/issues/522 - https://github.com/dweeves/magmi-git/pull/525 - http://www.securityfocus.com/bid/97311
CVE ID: CVE-2017-7392 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T16:04:10.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TigerVNC 1.7.1 (SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt), an unauthenticated client can cause a small memory leak in the server. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2000 - https://github.com/TigerVNC/tigervnc/pull/441 - http://www.securityfocus.com/bid/97305 - https://security.gentoo.org/glsa/201801-13
CVE ID: CVE-2017-7393 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T16:04:10.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2000 - http://www.securityfocus.com/bid/97305 - https://github.com/TigerVNC/tigervnc/pull/438 - https://security.gentoo.org/glsa/201801-13
CVE ID: CVE-2017-7394 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T16:04:10.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2000 - https://github.com/TigerVNC/tigervnc/pull/440 - http://www.securityfocus.com/bid/97305 - https://security.gentoo.org/glsa/201801-13
CVE ID: CVE-2017-7395 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T16:04:10.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TigerVNC/tigervnc/pull/436 - https://access.redhat.com/errata/RHSA-2017:2000 - http://www.securityfocus.com/bid/97305 - https://github.com/TigerVNC/tigervnc/pull/436/commits/bf3bdac082978ca32895a4b6a123016094905689 - https://security.gentoo.org/glsa/201801-13
CVE ID: CVE-2017-7396 State: PUBLISHED Published: 2017-04-01T01:07:00 Last Updated: 2024-08-05T16:04:10.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TigerVNC/tigervnc/pull/436 - https://github.com/TigerVNC/tigervnc/pull/436/commits/dccb5f7d776e93863ae10bbff56a45c523c6eeb0 - https://access.redhat.com/errata/RHSA-2017:2000 - http://www.securityfocus.com/bid/97305 - https://security.gentoo.org/glsa/201801-13
CVE ID: CVE-2017-7397 State: PUBLISHED Published: 2017-04-03T20:00:00 Last Updated: 2024-08-05T16:04:10.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as defined in RFC 1812 section 5.3.7). This product enables net.ipv4.conf.all.log_martians by default. NOTE: the vendor reports "It has been proved that this vulnerability has no foundation and it is totally fake and based on false assumptions. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploitalert.com/view-details.html?id=26361 - https://b
Analyst Notes: - CVE Program Container: References: - http://www.exploitalert.com/view-details.html?id=26361 - https://backbox.org/portal/blog/false-cve-backbox-46-unmasked - https://cxsecurity.com/issue/WLB-2017040001 - https://forum.backbox.org/security-advisories/waiting-verification-backbox-os-denial-of-service/msg10218 - https://www.exploit-db.com/exploits/41781/
CVE ID: CVE-2017-7398 State: PUBLISHED Published: 2017-04-04T14:00:00 Last Updated: 2024-08-05T16:04:11.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated, as demonstrated by changing the Security option from WPA2 to None, or changing the hiddenSSID parameter, SSID parameter, or a security-option password. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41821/ - http://seclists.org/fulldisclosure/2017/Apr/
ogram Container: References: - https://www.exploit-db.com/exploits/41821/ - http://seclists.org/fulldisclosure/2017/Apr/4
CVE ID: CVE-2017-7399 State: PUBLISHED Published: 2019-11-26T15:28:08 Last Updated: 2024-08-05T16:04:10.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users. Additional Analyst Notes: - CVE Program Container: References: - https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_tvf_34r_1cb
CVE ID: CVE-2017-7400 State: PUBLISHED Published: 2017-04-03T14:00:00 Last Updated: 2024-08-05T16:04:10.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97324 - https://launchpad.net/bugs/1667086 - https://access.redhat.com/errata/RHSA-2017:1598 - https://access.redhat.com/errata/RHSA-2017:1739
CVE ID: CVE-2017-7401 State: PUBLISHED Published: 2017-04-03T14:00:00 Last Updated: 2024-08-05T16:04:10.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97321 - https://access.redhat.com/errata/RHSA-2017:1285 - https://github.com/collectd/collectd/issues/2174 - https://
id/97321 - https://access.redhat.com/errata/RHSA-2017:1285 - https://github.com/collectd/collectd/issues/2174 - https://access.redhat.com/errata/RHSA-2018:2615 - https://access.redhat.com/errata/RHSA-2017:1787
CVE ID: CVE-2017-7402 State: PUBLISHED Published: 2017-04-03T17:00:00 Last Updated: 2024-08-05T16:04:10.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41784/ - http://rungga.blogspot.co.id/2017/04/remote-file-upload-vulnerability-in.html
CVE ID: CVE-2017-7404 State: PUBLISHED Published: 2017-07-07T12:00:00 Last Updated: 2024-08-05T16:04:10.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the D-Link DIR-615 before v20.12PTb04, if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab, the malicious site then can send requests to the victim's Router without knowing the credentials (CSRF). An attacker can host a page that sends a POST request to Form2File.htm that tries to upload Firmware to victim's Router. This causes the router to reboot/crash resulting in Denial of Service. An attacker may succeed in uploading malicious Firmware. Additional Analyst Notes: - CVE Pr
ulting in Denial of Service. An attacker may succeed in uploading malicious Firmware. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-615/REVT/DIR-615_REVT_FIRMWARE_PATCH_v20.12PTb04.zip - https://www.qualys.com/2017/03/12/qsa-2017-03-12/qsa-2017-03-12.pdf
CVE ID: CVE-2017-7405 State: PUBLISHED Published: 2017-07-07T12:00:00 Last Updated: 2024-08-05T16:04:10.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim's host, an attacker might be able to take over the administrative session without being prompted for authentication credentials. An attacker can get the victim's and router's IP addresses by simply sniffing the network traffic. Moreover, if the victim has web access enabled on his router and is accessing the web interface from a different networ
Moreover, if the victim has web access enabled on his router and is accessing the web interface from a different network that is behind the NAT/Proxy, an attacker can sniff the network traffic to know the public IP address of the victim's router and take over his session as he won't be prompted for credentials. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-615/REVT/DIR-615_REVT_FIRMWARE_PATCH_v20.12PTb04.zip - https://www.qualys.com/2017/03/12/qsa-2017-03-12/qsa-2017-03-12.pdf
CVE ID: CVE-2017-7406 State: PUBLISHED Published: 2017-07-07T12:00:00 Last Updated: 2024-08-05T16:04:11.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certificate. An attacker can simply monitor network traffic to steal a user's credentials and/or credentials of users being added while sniffing the traffic. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-615/REVT/DIR-615_REVT_FIRMWARE_PATCH_v20.12PTb04.zip - https://www.qualys.com/2017/03/12/qsa-2017-03-12/qsa-20
MENTS/DIR-615/REVT/DIR-615_REVT_FIRMWARE_PATCH_v20.12PTb04.zip - https://www.qualys.com/2017/03/12/qsa-2017-03-12/qsa-2017-03-12.pdf
CVE ID: CVE-2017-7407 State: PUBLISHED Published: 2017-04-03T20:00:00 Last Updated: 2024-08-05T16:04:11.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13 - https://access.redhat.com/errata/RHSA-2018:3558 - https://sec
url/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13 - https://access.redhat.com/errata/RHSA-2018:3558 - https://security.gentoo.org/glsa/201709-14 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
CVE ID: CVE-2017-7408 State: PUBLISHED Published: 2017-04-14T14:00:00 Last Updated: 2024-08-05T16:04:11.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: Palo Alto Networks Traps ESM Console before 3.4.4 allows attackers to cause a denial of service by leveraging improper validation of requests to revoke a Traps agent license. Additional Analyst Notes: - CVE Program Container: References: - https://www.paloaltonetworks.com/documentation/34/endpoint/traps-release-notes/traps-3-4-4-addressed-issues.html - http://www.securityfocus.com/bid/97533 - https://security.paloaltonetworks.com/CVE-2017-7408