Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-16844 State: PUBLISHED Published: 2017-11-16T15:00:00 Last Updated: 2024-08-05T20:35:21.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00019.html - https://access.redhat.com/errata/RHSA-2017:3269 - https://bugs.debian.org/cgi-bin/bug
s-announce/2017/11/msg00019.html - https://access.redhat.com/errata/RHSA-2017:3269 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511 - https://www.debian.org/security/2017/dsa-4041 - http://www.securitytracker.com/id/1039844
CVE ID: CVE-2017-16845 State: PUBLISHED Published: 2017-11-17T20:00:00 Last Updated: 2024-08-05T20:35:21.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3649-1/ - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://www.debian.org/security/2018/dsa-4213 - https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg02982.html - https://usn.ubuntu.com/3575-1/ - http://www.securityfocus.com/bid/101923
CVE ID: CVE-2017-16846 State: PUBLISHED Published: 2017-11-16T17:00:00 Last Updated: 2024-08-05T20:35:21.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16846.html - http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html
CVE ID: CVE-2017-16847 State: PUBLISHED Published: 2017-11-16T17:00:00 Last Updated: 2024-08-05T20:35:21.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16847.html
CVE ID: CVE-2017-16848 State: PUBLISHED Published: 2017-11-16T17:00:00 Last Updated: 2024-08-05T20:35:21.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html
CVE ID: CVE-2017-16849 State: PUBLISHED Published: 2017-11-16T17:00:00 Last Updated: 2024-08-05T20:35:21.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter. Additional Analyst Notes: - CVE Program Container: References: - http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16849.html
CVE ID: CVE-2017-16850 State: PUBLISHED Published: 2017-11-16T17:00:00 Last Updated: 2024-08-05T20:35:21.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16850.html - http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html
CVE ID: CVE-2017-16851 State: PUBLISHED Published: 2017-11-16T17:00:00 Last Updated: 2024-08-05T20:35:21.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16851.html - http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html
CVE ID: CVE-2017-16852 State: PUBLISHED Published: 2017-11-16T17:00:00 Last Updated: 2024-08-05T20:35:21.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/881857 - https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e
r: References: - https://bugs.debian.org/881857 - https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e992c351ad5e2c665229ede82f261b16 - https://shibboleth.net/community/advisories/secadv_20171115.txt - https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html - https://www.debian.org/security/2017/dsa-4038
CVE ID: CVE-2017-16853 State: PUBLISHED Published: 2017-11-16T17:00:00 Last Updated: 2024-08-05T20:35:21.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4039 - https://bugs.debian.org/881856 - http://www.securityf
ner: References: - https://www.debian.org/security/2017/dsa-4039 - https://bugs.debian.org/881856 - http://www.securityfocus.com/bid/101898 - https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d - https://shibboleth.net/community/advisories/secadv_20171115.txt - https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
CVE ID: CVE-2017-16854 State: PUBLISHED Published: 2017-12-08T17:00:00 Last Updated: 2024-08-05T20:35:21.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html - https://www.debian.org/security/2017/dsa-4066 - https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/
CVE ID: CVE-2017-16855 State: REJECTED Published: 2017-11-16T18:00:00 Last Updated: 2017-12-21T04:57:01 Description: No description available.
CVE ID: CVE-2017-16856 State: PUBLISHED Published: 2017-12-05T16:00:00Z Last Updated: 2024-09-16T23:10:55.644Z Vendors: Atlassian Products: Confluence Problem Types: Cross Site Scripting (XSS) Description: The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-54395 - http://www.securityfocus.com/bid/102094
CVE ID: CVE-2017-16857 State: PUBLISHED Published: 2017-12-05T16:00:00Z Last Updated: 2024-09-17T02:01:17.347Z Vendors: Atlassian Products: Auto-Unapprove Plugin (for Bitbucket Server) Problem Types: Brute Force Attack Description: It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket. Additional Analyst Notes: - CVE Program Container: Referen
erver it does not affect any particular version of Bitbucket. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BSERV-10439
CVE ID: CVE-2017-16858 State: PUBLISHED Published: 2018-01-31T14:00:00Z Last Updated: 2024-09-17T00:40:54.506Z Vendors: Atlassian Products: Crowd Problem Types: CWE-863 Description: The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given the following situation: the Crowd application is bound to directory 1 and has a user called admin and the Google Apps application is bound to directory 2, which also has a user called admin, it was possible to authentica
d the Google Apps application is bound to directory 2, which also has a user called admin, it was possible to authenticate REST requests using the credentials of the user coming from directory 2 and impersonate the user from directory 1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5009
CVE ID: CVE-2017-16859 State: PUBLISHED Published: 2018-06-28T14:00:00Z Last Updated: 2024-09-16T17:15:00.298Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Path Traversal Description: The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8212 - http://www.securityfocus.com/bid/104578 - https://jira.atlassian.com/browse/FE-70
/jira.atlassian.com/browse/CRUC-8212 - http://www.securityfocus.com/bid/104578 - https://jira.atlassian.com/browse/FE-7061
CVE ID: CVE-2017-16860 State: PUBLISHED Published: 2018-05-14T13:00:00Z Last Updated: 2024-09-17T00:10:37.417Z Vendors: Atlassian Products: Application Links Problem Types: Cross Site Scripting (XSS) Description: The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the redirectUrl parameter link in the redirect warning message. Additional Analyst Notes: - CVE Program Container: References: - https://ecosystem.atlassian.net/browse/APL-1363 - http://www.securityfocus.c
tes: - CVE Program Container: References: - https://ecosystem.atlassian.net/browse/APL-1363 - http://www.securityfocus.com/bid/104188
CVE ID: CVE-2017-16861 State: PUBLISHED Published: 2018-02-01T04:00:00Z Last Updated: 2024-09-16T22:56:24.722Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Remote Code Execution Description: It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the
on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8156 - https://confluence.atlassian.com/x/h-QyO - http://www.securityfocus.com/bid/102971 - https://confluence.atlassian.com/x/iPQyO - https://jira.atlassian.com/browse/FE-6991
CVE ID: CVE-2017-16862 State: PUBLISHED Published: 2018-01-12T14:00:00Z Last Updated: 2024-09-16T18:48:43.537Z Vendors: Atlassian Products: Jira Problem Types: Cross-Site Request Forgery (CSRF) Description: The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102506 - https://jira.atlassian.com/browse/JRASERVER-66622
CVE ID: CVE-2017-16863 State: PUBLISHED Published: 2018-01-18T18:00:00Z Last Updated: 2024-09-17T02:58:19.608Z Vendors: Atlassian Products: Atlassian Jira Problem Types: Cross Site Scripting (XSS) Description: The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a project or filter. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-66623 - http://www.securityfocus.com/bid/102732
CVE ID: CVE-2017-16864 State: PUBLISHED Published: 2018-01-12T14:00:00Z Last Updated: 2024-09-16T23:31:30.686Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102505 - https://jira.atlassian.com/browse/JRASERVER-66624
CVE ID: CVE-2017-16865 State: PUBLISHED Published: 2018-01-17T14:00:00Z Last Updated: 2024-09-17T01:30:44.872Z Vendors: Atlassian Products: Jira Problem Types: Server-Side Request Forgery (SSRF) Description: The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF). When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access credentials and other potentially confidential information. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-66642
CVE ID: CVE-2017-16866 State: PUBLISHED Published: 2017-11-16T21:00:00 Last Updated: 2024-08-05T20:35:21.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/dayrui/finecms/commit/09d4f3c1a1b8598ce8967e158b16b9fe44936c50
CVE ID: CVE-2017-16867 State: PUBLISHED Published: 2017-11-16T21:00:00 Last Updated: 2024-08-05T20:35:21.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 deauthentication frames during the delivery process, which makes it easier for (1) delivery drivers to freeze a camera and re-enter a house for unfilmed activities or (2) attackers to freeze a camera and enter a house if a delivery driver failed to ensure a locked door before leaving. Additional Analyst Notes: - CVE Program Container: References: - https://www.engadget.com/2017/11/16/amazon-key-hack-cloud-cam/ - https://www.wired.com/story/amazon-key-flaw-let-deliverym
tps://www.engadget.com/2017/11/16/amazon-key-hack-cloud-cam/ - https://www.wired.com/story/amazon-key-flaw-let-deliverymen-disable-your-camera/ - http://www.securityfocus.com/bid/101899 - https://www.theverge.com/2017/11/16/16665064/amazon-key-camera-disable
CVE ID: CVE-2017-16868 State: PUBLISHED Published: 2017-11-17T09:00:00 Last Updated: 2024-08-05T20:35:21.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools 0.9.2, the wav_convert2mono function in lib/wav.c does not properly restrict a multiplication within a malloc call, which allows remote attackers to cause a denial of service (integer overflow and NULL pointer dereference) via a crafted WAV file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/52
CVE ID: CVE-2017-16869 State: PUBLISHED Published: 2017-11-17T09:00:00 Last Updated: 2024-08-05T20:35:21.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/upx/upx/issues/146
CVE ID: CVE-2017-16870 State: PUBLISHED Published: 2017-11-17T09:00:00 Last Updated: 2024-08-05T20:35:21.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LoRexxar/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity#authenticated-ssrf
CVE ID: CVE-2017-16871 State: PUBLISHED Published: 2017-11-17T09:00:00 Last Updated: 2024-08-05T20:35:21.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LoRexxar/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity#authenticated--upload-file-and-php-code-executi
/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity#authenticated--upload-file-and-php-code-execution
CVE ID: CVE-2017-16872 State: PUBLISHED Published: 2017-11-17T09:00:00 Last Updated: 2024-08-05T20:35:21.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values. Additional Analyst Notes: - CVE Program Container: References: - https://trac.pjsip.org/repos/milestone/release-2.7.1 -
Additional Analyst Notes: - CVE Program Container: References: - https://trac.pjsip.org/repos/milestone/release-2.7.1 - https://www.debian.org/security/2018/dsa-4170 - https://trac.pjsip.org/repos/ticket/2056
CVE ID: CVE-2017-16873 State: PUBLISHED Published: 2018-03-29T22:00:00 Last Updated: 2024-08-05T20:35:21.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://m4.rkw.io/blog/cve201716873-hashicorp-vagrantvmwarefusion-v4025504-local-root.html
CVE ID: CVE-2017-16875 State: PUBLISHED Published: 2017-11-17T16:00:00 Last Updated: 2024-08-05T20:35:21.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations. Additional Analyst Notes: - CVE Program Container: References: - https://trac.pjsip.org/repos/milestone/release-2.7.1 - https://trac.pjsip.org/repos/ticket/2055 -
ntainer: References: - https://trac.pjsip.org/repos/milestone/release-2.7.1 - https://trac.pjsip.org/repos/ticket/2055 - https://www.debian.org/security/2018/dsa-4170
CVE ID: CVE-2017-16876 State: PUBLISHED Published: 2017-12-29T15:00:00 Last Updated: 2024-08-05T20:35:21.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lepture/mistune/blob/master/CHANGES.rst - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUR3GMHQBMA3UC4PFMCK6GCLOQC4LQQC/ - https://github.com/lepture/mistune/commit/5f06d724bc05
sts.fedoraproject.org/message/NUR3GMHQBMA3UC4PFMCK6GCLOQC4LQQC/ - https://github.com/lepture/mistune/commit/5f06d724bc05580e7f203db2d4a4905fc1127f98 - https://bugzilla.redhat.com/show_bug.cgi?id=1524596
CVE ID: CVE-2017-16877 State: PUBLISHED Published: 2017-11-17T17:00:00Z Last Updated: 2024-09-17T02:31:11.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zeit/next.js/releases/tag/2.4.1 - https://github.com/vercel/next.js/commit/02fe7cf63f6265d73bdaf8bc50a4f2fb539dcd00
CVE ID: CVE-2017-16878 State: PUBLISHED Published: 2018-01-10T18:00:00 Last Updated: 2024-08-05T20:35:21.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to inject arbitrary web script or HTML by leveraging an unspecified configuration. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040148 - https://security.paloaltonetworks.com/CVE-2017-16878