Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d314fdf791763c19b70b - https://weechat.org/news/95/20170422-Version-1.7.1/ - http://www.debian.org/security/2017/dsa-3836 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ASRTCQFFDAAK347URWNDH6NSED2BGNY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER23GT23US5JXDLUZAMGMWXKZ74MI4S2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3LAJTLI3LWZRNCFYJ7PCBBTHUMCCBHH/
CVE ID: CVE-2017-8074 State: PUBLISHED Published: 2017-04-23T16:00:00 Last Updated: 2024-08-05T16:27:22.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware. Additional Analyst Notes: - CVE Program Container: References: - https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link/ - http://www.securityfocus.com/bid/97981
CVE ID: CVE-2017-8075 State: PUBLISHED Published: 2017-04-23T16:00:00 Last Updated: 2024-08-05T16:27:22.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. This affects the 1.1.2 Build 20141017 Rel.50749 firmware. Additional Analyst Notes: - CVE Program Container: References: - https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link/ - http://www.securityfocus.com/bid/97983
CVE ID: CVE-2017-8076 State: PUBLISHED Published: 2017-04-23T16:00:00Z Last Updated: 2024-09-16T20:53:28.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firmware. Additional Analyst Notes: - CVE Program Container: References: - https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link/
CVE ID: CVE-2017-8077 State: PUBLISHED Published: 2017-04-23T16:00:00Z Last Updated: 2024-09-16T21:07:20.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firmware. Additional Analyst Notes: - CVE Program Container: References: - https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link/
CVE ID: CVE-2017-8078 State: PUBLISHED Published: 2017-04-23T16:00:00 Last Updated: 2024-08-05T16:27:22.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd). This affects the 1.1.2 Build 20141017 Rel.50749 firmware. Additional Analyst Notes: - CVE Program Container: References: - https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link/ - http://www.securityfocus.com/bid/97985
CVE ID: CVE-2017-8080 State: PUBLISHED Published: 2017-05-05T14:00:00 Last Updated: 2024-08-05T16:27:22.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98262 - https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-04-24-894234898.html - https://jira.atlassian.com/browse/HCPUB-2980
CVE ID: CVE-2017-8081 State: PUBLISHED Published: 2017-04-30T19:00:00 Last Updated: 2024-08-05T16:27:22.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1224
CVE ID: CVE-2017-8082 State: PUBLISHED Published: 2017-04-24T06:12:00 Last Updated: 2024-08-05T16:27:22.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/open?id=0B3vXUYdNMECWZTd3SFRnUjllWk0 - http://zeroday.insecuri
Program Container: References: - https://drive.google.com/open?id=0B3vXUYdNMECWZTd3SFRnUjllWk0 - http://zeroday.insecurity.zone/exploits/concrete5_csrf_dos.txt - https://twitter.com/insecurity/status/856066923146215425
CVE ID: CVE-2017-8083 State: PUBLISHED Published: 2017-06-06T14:00:00 Last Updated: 2024-08-05T16:27:22.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of flash memory regions, which allows local users to install a firmware rootkit by leveraging administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://watchmysys.com/blog/2017/06/cve-2017-8083-compulab-intensepc-lacks-bios-wp/ - http://seclists.org/fulldisclosure/2017/Jun/6
CVE ID: CVE-2017-8085 State: PUBLISHED Published: 2017-04-24T14:00:00 Last Updated: 2024-08-05T16:27:22.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.1patch5 - http://www.securityfocus.com/bid/98043 - http://www.exponentcms.org/news/patch-5-released-for-v2-4-1-to-fix-a-few-critical-issues - https://github.com/exponentcms/exponent-cms/commit/0b2241ff1c7d86376fa260c5d4c1714f6cef9c0f
CVE ID: CVE-2017-8086 State: PUBLISHED Published: 2017-05-02T14:00:00 Last Updated: 2024-08-05T16:27:21.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/04/25/5 - https://bugzilla.redhat.com/show_bug.cgi?id=1444781 - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://security.gentoo.org/glsa/201706-03 - https://li
s://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://security.gentoo.org/glsa/201706-03 - https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg01636.html - http://www.securityfocus.com/bid/98012 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ffcdef4277a91af15a3c09f7d16af072c29f3f2
CVE ID: CVE-2017-8087 State: PUBLISHED Published: 2019-10-22T15:52:22 Last Updated: 2024-08-05T16:27:21.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information Leakage in PPPoE Packet Padding in AVM Fritz!Box 7490 with Firmware versions Fritz!OS 6.80 and 6.83 allows physically proximate attackers to view slices of previously transmitted packets or portions of memory via via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://avm.com - http://fritzbox.com - http://seclists.org/fulldisclosure/2019/Oct/36
CVE ID: CVE-2017-8098 State: PUBLISHED Published: 2017-04-24T18:00:00Z Last Updated: 2024-09-16T18:09:07.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/e107inc/e107/commit/7a3e3d9fc7e05ce6941b9af1c14010bf2141f1a5 - http://seclists.org/fulldisclosure/2017/Apr/40
CVE ID: CVE-2017-8099 State: PUBLISHED Published: 2017-04-24T18:00:00Z Last Updated: 2024-09-17T00:35:48.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/41 - https://plugins.trac.wordpress.org/browser/whizz/trunk/change_log.txt
CVE ID: CVE-2017-8100 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-05T16:27:21.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-copysafe-web/#developers - http://seclists.org/fulldisclosure/2017/Apr/42 - http://www.securityfocus.com/bid/98091
CVE ID: CVE-2017-8101 State: PUBLISHED Published: 2017-04-24T18:00:00Z Last Updated: 2024-09-17T02:06:11.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/52 - https://github.com/s9y/Serendipity/issues/452
CVE ID: CVE-2017-8102 State: PUBLISHED Published: 2017-04-24T18:00:00Z Last Updated: 2024-09-16T16:57:58.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/44 - https://github.com/s9y/Serendipity/issues/456
CVE ID: CVE-2017-8103 State: PUBLISHED Published: 2017-04-24T18:00:00Z Last Updated: 2024-09-16T18:29:44.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/53 - https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/
CVE ID: CVE-2017-8104 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-05T16:27:22.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Apr/55 - http://www.securityfocus.com/bid/98045 - https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/
CVE ID: CVE-2017-8105 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-05T16:27:22.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c. Additional Analyst Notes: - CVE Program Container: References: - http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48ee431bef8d4d466b40c9cb2d4dbcb7791 - https://security.gentoo.org/glsa/201706-14 - http://www.securityfocus.com/bid/99093 - http://www.debian.org/security/2017/dsa-3839 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9
s.com/bid/99093 - http://www.debian.org/security/2017/dsa-3839 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2017-8106 State: PUBLISHED Published: 2017-04-24T23:00:00Z Last Updated: 2024-09-16T23:41:42.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.kernel.org/show_bug.cgi?id=195167 - https://launchpad.net/bugs/1678676
CVE ID: CVE-2017-8108 State: PUBLISHED Published: 2017-06-08T16:00:00 Last Updated: 2024-08-05T16:27:22.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99288 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJHLLWNW7NASVXCK24YBSIUQQPWGCMB5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJXMPYANXHI25NQZ36QMXNXANDRAA5YG/ - http
oraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJXMPYANXHI25NQZ36QMXNXANDRAA5YG/ - https://github.com/CISOfy/lynis/releases/tag/2.5.0 - https://cisofy.com/security/cve/cve-2017-8108/
CVE ID: CVE-2017-8109 State: PUBLISHED Published: 2017-04-25T17:00:00 Last Updated: 2024-08-05T16:27:22.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658 - https://github.com/saltstack/salt/issues/40075 - https://github.com/saltstack/salt/pull/40609 - https://bugzilla.suse.com/show_bug.cgi?id=103591
tack/salt/issues/40075 - https://github.com/saltstack/salt/pull/40609 - https://bugzilla.suse.com/show_bug.cgi?id=1035912 - http://www.securityfocus.com/bid/98095 - https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html
CVE ID: CVE-2017-8110 State: PUBLISHED Published: 2017-04-25T17:00:00Z Last Updated: 2024-09-16T20:52:39.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php. Additional Analyst Notes: - CVE Program Container: References: - http://jgj212.blogspot.hk/2017/04/modified-ecommerce-shopsoftware-2022.html
CVE ID: CVE-2017-8112 State: PUBLISHED Published: 2017-05-02T14:00:00 Last Updated: 2024-08-05T16:27:22.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://bugzilla.redhat.com/show_bug.cgi?id=1445621 - https://security.gentoo.org/glsa/201706-03 - http://www.openwall.com/lists/oss-security/2017/04/26/5 - http://www.securityfocus.com/bid/98015 - https://lists
06-03 - http://www.openwall.com/lists/oss-security/2017/04/26/5 - http://www.securityfocus.com/bid/98015 - https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg04578.html
CVE ID: CVE-2017-8114 State: PUBLISHED Published: 2017-04-29T19:00:00 Last Updated: 2024-08-05T16:27:22.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. Additional Analyst Notes: - CVE Program Container: References: - https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 - https://security.gentoo.org/glsa/201707-11 - http://www.securityfocus.com/bid/98445 - https://github.com/ilsani/
.0.11 - https://security.gentoo.org/glsa/201707-11 - http://www.securityfocus.com/bid/98445 - https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114
CVE ID: CVE-2017-8115 State: PUBLISHED Published: 2017-04-25T19:00:00Z Last Updated: 2024-09-16T17:19:06.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/modxcms/revolution/pull/13433 - https://github.com/modxcms/revolution/issues/13432
CVE ID: CVE-2017-8116 State: PUBLISHED Published: 2017-07-03T16:00:00 Last Updated: 2024-08-05T16:27:22.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nettitude/metasploit-modules/blob/master/teltonika_add_user.rb - https://github.com/nettitude/metasploit-modules/blob/master/teltonika_cmd_exec.rb - https://labs.nettitude.com/blog/cve-2017-8116-te
ub.com/nettitude/metasploit-modules/blob/master/teltonika_cmd_exec.rb - https://labs.nettitude.com/blog/cve-2017-8116-teltonika-router-unauthenticated-remote-code-execution/
CVE ID: CVE-2017-8117 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-17T00:06:02.713Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: privilege elevation Description: The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en
CVE ID: CVE-2017-8118 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-16T23:10:49.836Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: leak vulnerabilities Description: The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en
CVE ID: CVE-2017-8119 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-17T02:26:42.084Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: privilege elevation Description: The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en
CVE ID: CVE-2017-8120 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-16T17:19:03.398Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: privilege elevation Description: The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en
CVE ID: CVE-2017-8121 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-17T00:51:56.733Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: leak vulnerabilities Description: The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en
CVE ID: CVE-2017-8122 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-16T20:32:07.760Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: privilege elevation Description: The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en - http://www.securityfocus.com/bid/101961
CVE ID: CVE-2017-8123 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-17T02:51:47.251Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: privilege elevation Description: The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en
CVE ID: CVE-2017-8124 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-16T19:05:42.567Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: privilege elevation Description: The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en
CVE ID: CVE-2017-8125 State: PUBLISHED Published: 2017-11-22T19:00:00Z Last Updated: 2024-09-17T02:11:20.755Z Vendors: Huawei Technologies Co., Ltd. Products: UMA Problem Types: XSS Description: The UMA product with software V200R001 and V300R001 has a cross-site scripting (XSS) vulnerability due to insufficient input validation. An attacker could craft malicious links or scripts to launch XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170612-01-uma-en