Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-17915 State: PUBLISHED Published: 2017-12-26T20:00:00 Last Updated: 2024-08-05T21:06:49.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one byte before testing whether a limit has been reached. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/535/ - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/1721f1b7e67a - https://lists.debian.org/debian-lts
06/msg00009.html - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/1721f1b7e67a - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - https://usn.ubuntu.com/4266-1/
CVE ID: CVE-2017-17916 State: PUBLISHED Published: 2017-12-29T16:00:00 Last Updated: 2024-08-05T21:06:49.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input Additional Analyst Notes: - CVE Program Container: References: - https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/
CVE ID: CVE-2017-17917 State: PUBLISHED Published: 2017-12-29T16:00:00 Last Updated: 2024-08-05T21:06:49.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/
CVE ID: CVE-2017-17919 State: PUBLISHED Published: 2017-12-29T16:00:00 Last Updated: 2024-08-05T21:06:49.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/
CVE ID: CVE-2017-17920 State: PUBLISHED Published: 2017-12-29T16:00:00 Last Updated: 2024-08-05T21:06:49.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input Additional Analyst Notes: - CVE Program Container: References: - https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/
CVE ID: CVE-2017-17924 State: PUBLISHED Published: 2017-12-26T22:00:00 Last Updated: 2024-08-05T21:06:49.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Professional-Service-Script.md
CVE ID: CVE-2017-17925 State: PUBLISHED Published: 2017-12-26T22:00:00 Last Updated: 2024-08-05T21:06:49.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Professional-Service-Script.md
CVE ID: CVE-2017-17926 State: PUBLISHED Published: 2017-12-26T22:00:00 Last Updated: 2024-08-05T21:06:49.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Professional-Service-Script.md
CVE ID: CVE-2017-17927 State: PUBLISHED Published: 2017-12-26T22:00:00 Last Updated: 2024-08-05T21:06:49.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Professional-Service-Script.md
CVE ID: CVE-2017-17928 State: PUBLISHED Published: 2017-12-26T22:00:00 Last Updated: 2024-08-05T21:06:49.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Professional-Service-Script.md
CVE ID: CVE-2017-17929 State: PUBLISHED Published: 2017-12-26T22:00:00 Last Updated: 2024-08-05T21:06:49.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Professional-Service-Script.md
CVE ID: CVE-2017-17930 State: PUBLISHED Published: 2017-12-26T22:00:00 Last Updated: 2024-08-05T21:06:49.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Professional-Service-Script.md
CVE ID: CVE-2017-17931 State: PUBLISHED Published: 2017-12-26T22:00:00 Last Updated: 2024-08-05T21:06:49.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Resume%20Clone%20Script.md
CVE ID: CVE-2017-17932 State: PUBLISHED Published: 2017-12-28T06:00:00 Last Updated: 2024-08-05T21:06:49.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 888. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43523/ - https://www.exploit-db.com/exploits/43407/ - https://www.exploit-db.com/exploits/43406/
CVE ID: CVE-2017-17933 State: PUBLISHED Published: 2017-12-29T18:00:00 Last Updated: 2024-08-05T21:06:49.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/145572/NetWin-SurgeFTP-23f2-Cross-Site-Scripting.html
CVE ID: CVE-2017-17934 State: PUBLISHED Published: 2017-12-27T07:00:00 Last Updated: 2024-08-05T21:06:49.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and associated with mishandling of MSLPushImage calls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/920 - https://usn.ubuntu.com/3681-1/ - http://www.securityfocus.com/bid/102314
CVE ID: CVE-2017-17935 State: PUBLISHED Published: 2017-12-27T07:00:00 Last Updated: 2024-08-05T21:06:49.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet that triggers the attempted processing of an empty line. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14295 - https://code.wireshark.org/review/#/c/24997/ - https://lists.debian.org/debian-lts-announce/2019/01/msg0
.cgi?id=14295 - https://code.wireshark.org/review/#/c/24997/ - https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html - http://www.securityfocus.com/bid/102311 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=137ab7d5681486c6d6cc8faac4300b7cd4ec0cf1
CVE ID: CVE-2017-17936 State: PUBLISHED Published: 2017-12-28T06:00:00Z Last Updated: 2024-09-17T03:13:37.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vanguard Marketplace Digital Products PHP has CSRF via /search. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Vanguard.md
CVE ID: CVE-2017-17937 State: PUBLISHED Published: 2017-12-28T06:00:00Z Last Updated: 2024-09-16T23:52:03.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Vanguard.md
CVE ID: CVE-2017-17938 State: PUBLISHED Published: 2017-12-28T06:00:00Z Last Updated: 2024-09-16T20:01:46.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Single-Theater-Booking.md
CVE ID: CVE-2017-17939 State: PUBLISHED Published: 2017-12-28T06:00:00Z Last Updated: 2024-09-17T00:00:40.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Single-Theater-Booking.md
CVE ID: CVE-2017-17940 State: PUBLISHED Published: 2017-12-28T06:00:00Z Last Updated: 2024-09-17T00:06:37.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Single-Theater-Booking.md
CVE ID: CVE-2017-17941 State: PUBLISHED Published: 2017-12-28T06:00:00Z Last Updated: 2024-09-16T22:14:03.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Single-Theater-Booking.md
CVE ID: CVE-2017-17942 State: PUBLISHED Published: 2017-12-28T06:00:00 Last Updated: 2024-08-05T21:06:49.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.maptools.org/show_bug.cgi?id=2767 - http://www.securityfocus.com/bid/102312
CVE ID: CVE-2017-17944 State: PUBLISHED Published: 2019-06-20T15:00:14 Last Updated: 2024-08-05T21:06:49.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation. Additional Analyst Notes: - CVE Program Container: References: - http://firstsight.me/2017/12/lack-of-binary-protection-at-asus-vivo-baby-and-hivivo-for-android-that-could-result-of-several-security-issues
CVE ID: CVE-2017-17945 State: PUBLISHED Published: 2019-06-24T18:22:42 Last Updated: 2024-08-05T21:06:49.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation. Additional Analyst Notes: - CVE Program Container: References: - http://firstsight.me/2017/12/lack-of-binary-protection-at-asus-vivo-baby-and-hivivo-for-android-that-could-result-of-several-security-issues
CVE ID: CVE-2017-17946 State: PUBLISHED Published: 2018-01-10T20:00:00 Last Updated: 2024-08-05T21:06:49.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action. Additional Analyst Notes: - CVE Program Container: References: - https://sidechannel.tempestsi.com/password-manager-flaw-allows-for-arbitrary-command-execution-b6bb273206b1 - http://seclists.org/fulldisclosure/2018/Jan/22
CVE ID: CVE-2017-17947 State: PUBLISHED Published: 2018-01-16T21:00:00 Last Updated: 2024-08-05T21:06:49.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL parameters not being sanitized. Exploitation does require the user to be logged in as administrator; the issue is not applicable to the end user portal. Additional Analyst Notes: - CVE Program Container: References: - http://kb.pulsese
ot applicable to the end user portal. Additional Analyst Notes: - CVE Program Container: References: - http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43018
CVE ID: CVE-2017-17948 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-16T19:10:05.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md
CVE ID: CVE-2017-17949 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-16T16:37:51.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md
CVE ID: CVE-2017-17950 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-16T23:10:59.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md
CVE ID: CVE-2017-17951 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-17T00:31:43.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17952 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-16T21:04:31.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17953 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-17T01:06:05.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17954 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-17T02:16:17.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17955 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-17T01:06:10.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17956 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-17T02:36:03.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17957 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-16T19:36:57.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17958 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-16T19:52:06.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17959 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-16T17:02:46.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17960 State: PUBLISHED Published: 2017-12-28T18:00:00Z Last Updated: 2024-09-17T01:36:08.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE ID: CVE-2017-17967 State: PUBLISHED Published: 2017-12-28T19:00:00Z Last Updated: 2024-09-17T01:40:59.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT file, aka CNVD-2017-35482. Additional Analyst Notes: - CVE Program Container: References: - http://www.cnvd.org.cn/flaw/show/1169328
CVE ID: CVE-2017-17968 State: PUBLISHED Published: 2017-12-29T15:00:00 Last Updated: 2024-08-05T21:06:49.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43408/
CVE ID: CVE-2017-17969 State: PUBLISHED Published: 2018-01-30T16:00:00 Last Updated: 2025-01-10T18:53:24.022953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4104 - https://lists.debian.org/debian-lts-announce/2018/02/msg00003.html - https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ - http://www.sec
e/2018/02/msg00003.html - https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ - http://www.securitytracker.com/id/1040831 - https://0patch.blogspot.si/2018/02/two-interesting-micropatches-for-7-zip.html - https://usn.ubuntu.com/3913-1/ - https://github.com/p7zip-project/p7zip/issues/7
CVE ID: CVE-2017-17970 State: PUBLISHED Published: 2018-01-12T17:00:00 Last Updated: 2024-08-05T21:06:50.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to login.php; the (2) season_id parameter to themes/flixer/ajax/load_season.php; the (3) movie_id parameter to themes/flixer/ajax/get_rating.php; the (4) rating or (5) movie_id parameter to themes/flixer/ajax/update_rating.php; or the (6) id parameter to themes/flixer/ajax/set_player_source.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/
/set_player_source.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145834/Muviko-1.1-SQL-Injection.html - https://www.exploit-db.com/exploits/43477/
CVE ID: CVE-2017-17971 State: PUBLISHED Published: 2017-12-29T18:00:00Z Last Updated: 2024-09-17T00:35:56.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dolibarr/dolibarr/issues/8000
CVE ID: CVE-2017-17972 State: PUBLISHED Published: 2019-07-03T16:35:58 Last Updated: 2024-08-05T21:06:49.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362. Additional Analyst Notes: - CVE Program Container: References: - https://www.openbugbounty.org/reports/466362/