Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-16537 State: PUBLISHED Published: 2017-11-04T01:00:00 Last Updated: 2024-08-05T20:27:03.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://patchwork.kernel.org/patch/9994017/ - https://groups.google.com/d/msg/syzkaller/bBFN8imrjjo/-5jCl8EiCQAJ - https://usn.ubuntu.com/3617-3/ - https
h/9994017/ - https://groups.google.com/d/msg/syzkaller/bBFN8imrjjo/-5jCl8EiCQAJ - https://usn.ubuntu.com/3617-3/ - https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html - https://usn.ubuntu.com/3754-1/ - https://usn.ubuntu.com/3617-2/ - https://usn.ubuntu.com/3619-1/
CVE ID: CVE-2017-16538 State: PUBLISHED Published: 2017-11-04T01:00:00 Last Updated: 2024-08-05T20:27:03.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner). Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3631-2/ - https://patchwork.linuxtv.org/patch/44566/ - https://www.debian.org/securi
eferences: - https://usn.ubuntu.com/3631-2/ - https://patchwork.linuxtv.org/patch/44566/ - https://www.debian.org/security/2018/dsa-4082 - https://usn.ubuntu.com/3631-1/ - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html - https://usn.ubuntu.com/3754-1/ - https://groups.google.com/d/msg/syzkaller/XwNidsl4X04/ti6I2IaRBAAJ - https://patchwork.linuxtv.org/patch/44567/ - https://www.debian.org/security/2017/dsa-4073
CVE ID: CVE-2017-16539 State: PUBLISHED Published: 2017-11-04T17:00:00 Last Updated: 2024-08-05T20:27:03.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=linux-scsi&m=150985455801444&w=2 - https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87c
?l=linux-scsi&m=150985455801444&w=2 - https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1 - https://marc.info/?l=linux-scsi&m=150985062200941&w=2 - https://github.com/moby/moby/pull/35399 - https://twitter.com/ewindisch/status/926443521820774401
CVE ID: CVE-2017-16540 State: PUBLISHED Published: 2017-11-04T19:00:00 Last Updated: 2024-08-05T20:27:04.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101983 - http://www.open-emr.org/wiki/index.php/OpenEMR_Patches - https://isears.github.io/jekyll/update/2017/10/28/openemr-database-disclosure.html
CVE ID: CVE-2017-16541 State: PUBLISHED Published: 2017-11-04T18:00:00 Last Updated: 2024-08-05T20:27:04.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://trac.torproject.org/projects/tor/ticket/24052 - https://security.gentoo.org/glsa/201810-01 - https://access.redhat.com/errata/RHSA-2018:2693 - https://lists.debian.org/debian-lts-announce/
too.org/glsa/201810-01 - https://access.redhat.com/errata/RHSA-2018:2693 - https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html - https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/ - https://security.gentoo.org/glsa/201811-13 - https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/ - https://www.debian.org/security/2018/dsa-4327 - https://access.redhat.com/errata/RHSA-2018:3403 - https://blog.torproject.org/tor-browser-709-released - http://www.securitytracker.com/id/1041610 - http://www.securityfocus.com/bid/101665 - https://access.redhat.com/errata/RHSA-2018:2692 - h
tytracker.com/id/1041610 - http://www.securityfocus.com/bid/101665 - https://access.redhat.com/errata/RHSA-2018:2692 - https://access.redhat.com/errata/RHSA-2018:3458 - https://bugzilla.mozilla.org/show_bug.cgi?id=1412081
CVE ID: CVE-2017-16542 State: PUBLISHED Published: 2017-11-05T17:00:00 Last Updated: 2024-08-05T20:27:03.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43129/ - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16542.html - http://code610.blogspot.com/2017/11/sql-injection-in-manageengine.html
CVE ID: CVE-2017-16543 State: PUBLISHED Published: 2017-11-05T17:00:00 Last Updated: 2024-08-05T20:27:04.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43129/ - http://code610.blogspot.com/2017/11/sql-injection-in-manageengine.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16543.html
CVE ID: CVE-2017-16544 State: PUBLISHED Published: 2017-11-20T15:00:00.000Z Last Updated: 2025-06-09T15:35:03.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/ -
Vulnrichment: References: - https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html - https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8 - https://usn.ubuntu.com/3935-1/ - http://seclists.org/fulldisclosure/2019/Jun/18 - https://seclists.org/bugtraq/2019/Jun/14 - http://seclists.org/fulldisclosure/2019/Sep/7 - https://seclists.org/bugtraq/2019/Sep/7 - http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html - http://www.vmware.com/security/advisories/VMSA-2019-0013.html - http://packetstormsecurity.com/files/15453
usyBox.html - http://www.vmware.com/security/advisories/VMSA-2019-0013.html - http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html - http://seclists.org/fulldisclosure/2020/Mar/15 - http://seclists.org/fulldisclosure/2020/Aug/20 - https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01 - http://seclists.org/fulldisclosure/2020/Sep/6 - http://seclists.org/fulldisclosure/2021/Jan/39 - https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html - http://seclists.org/fulldisclosure/2021/Aug/21 - http://seclists.org/fulldisclosure/2022/Jun/36 - http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html
CVE ID: CVE-2017-16545 State: PUBLISHED Published: 2017-11-05T22:00:00 Last Updated: 2024-08-05T20:27:04.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadWPGImage function in coders/wpg.c in GraphicsMagick 1.3.26 does not properly validate colormapped images, which allows remote attackers to cause a denial of service (ImportIndexQuantumType invalid write and application crash) or possibly have unspecified other impact via a malformed WPG image. Additional Analyst Notes: - CVE Program Container: References: - http://hg.code.sf.net/p/graphicsmagick/code/rev/e8086faa52d0 - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/08
/rev/e8086faa52d0 - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://sourceforge.net/p/graphicsmagick/bugs/519/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4248-1/
CVE ID: CVE-2017-16546 State: PUBLISHED Published: 2017-11-05T22:00:00 Last Updated: 2024-08-05T20:27:03.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4040 - https://usn.ubuntu.com/3681-1/ - https://www.debian.org/security/2017/dsa-4074 - https://github.com/Image
017/dsa-4040 - https://usn.ubuntu.com/3681-1/ - https://www.debian.org/security/2017/dsa-4074 - https://github.com/ImageMagick/ImageMagick/issues/851 - https://github.com/ImageMagick/ImageMagick/commit/e04cf3e9524f50ca336253513d977224e083b816 - https://github.com/ImageMagick/ImageMagick/commit/2130bf6f89ded32ef0c88a11694f107c52566c53
CVE ID: CVE-2017-16547 State: PUBLISHED Published: 2017-11-06T05:00:00 Last Updated: 2024-08-05T20:27:04.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords, which allows remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00016.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/785758bbbfcc - https://www.debian.org/se
nnounce/2017/11/msg00016.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/785758bbbfcc - https://www.debian.org/security/2018/dsa-4321 - https://sourceforge.net/p/graphicsmagick/bugs/517/ - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4248-1/
CVE ID: CVE-2017-16548 State: PUBLISHED Published: 2017-11-06T05:00:00 Last Updated: 2024-08-05T20:27:03.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon. Additional Analyst Notes: - CVE Program Container: References: - https://git.samba.org/rsync.git/?p=rsync.git%3Ba=commit%3Bh=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1 - https://bugzilla.samba.org/show_
ba.org/rsync.git/?p=rsync.git%3Ba=commit%3Bh=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1 - https://bugzilla.samba.org/show_bug.cgi?id=13112 - https://usn.ubuntu.com/3543-1/ - https://www.debian.org/security/2017/dsa-4068 - https://usn.ubuntu.com/3543-2/ - https://lists.debian.org/debian-lts-announce/2017/12/msg00020.html
CVE ID: CVE-2017-16549 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:04.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/Knowledgebase/Article/View/173/41/advisory-issued-on-6th-november-2017
CVE ID: CVE-2017-16550 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:04.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017
CVE ID: CVE-2017-16551 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:03.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017
CVE ID: CVE-2017-16552 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:04.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017
CVE ID: CVE-2017-16553 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:03.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017
CVE ID: CVE-2017-16554 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:04.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-November-2017
CVE ID: CVE-2017-16555 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:03.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017
CVE ID: CVE-2017-16556 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:04.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: In K7 Antivirus Premium before 15.1.0.53, user-controlled input can be used to allow local users to write to arbitrary memory locations. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/2nd-Advisory-issued-on-6th-November-2017
CVE ID: CVE-2017-16557 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T20:27:04.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. Additional Analyst Notes: - CVE Program Container: References: - https://support.k7computing.com/index.php?/selfhelp/view-article/3rd-Advisory-issued-on-6th-November-2017
CVE ID: CVE-2017-16558 State: PUBLISHED Published: 2019-04-25T16:36:49 Last Updated: 2024-08-05T20:27:03.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/de/changelog/versions/4.4.html - https://contao.org/en/news/contao-4_4_8.html
CVE ID: CVE-2017-16560 State: PUBLISHED Published: 2017-11-16T15:00:00 Last Updated: 2024-08-05T20:27:04.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as if the file is being edited when the user exits the application or if the application crashes. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40esterling_/cve-2017-16560-sandisk-secure-access-leaves-plain-text-copies-of-files-on-disk-4eabeca6bdbc
CVE ID: CVE-2017-16561 State: PUBLISHED Published: 2017-11-07T22:00:00 Last Updated: 2024-08-05T20:27:04.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: /view/friend_profile.php in Ingenious School Management System 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'friend_index' parameter of a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43108/
CVE ID: CVE-2017-16562 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T20:27:04.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8950 - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9 - https://www.exploit-db.com/exploits/43117/
CVE ID: CVE-2017-16563 State: PUBLISHED Published: 2017-11-06T08:00:00 Last Updated: 2024-08-05T20:27:04.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/update. Additional Analyst Notes: - CVE Program Container: References: - https://distributedcompute.com/2017/11/04/vonage-ht802-multiple-vulnerabilities/
CVE ID: CVE-2017-16564 State: PUBLISHED Published: 2017-11-06T08:00:00 Last Updated: 2024-08-05T20:27:04.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field (P148). Additional Analyst Notes: - CVE Program Container: References: - https://distributedcompute.com/2017/11/04/vonage-ht802-multiple-vulnerabilities/
CVE ID: CVE-2017-16565 State: PUBLISHED Published: 2017-11-06T08:00:00 Last Updated: 2024-08-05T20:27:04.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests. Additional Analyst Notes: - CVE Program Container: References: - https://distributedcompute.com/2017/11/04/vonage-ht802-multiple-vulnerabilities/
CVE ID: CVE-2017-16566 State: PUBLISHED Published: 2017-11-17T23:00:00 Last Updated: 2024-08-05T20:27:04.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system files including those used for authentication (such as passwd and shadow). This can be abused to take full root level control of the device. Additional Analyst Notes: - CVE Program Container: References: - https://siggyd.github.io/Advisories/CVE-2017-16566
CVE ID: CVE-2017-16567 State: PUBLISHED Published: 2017-11-09T19:00:00.000Z Last Updated: 2025-02-04T21:09:31.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality. Exploitation of this vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthorized actions on behalf of users, and Exfiltration of sensitive data. This vulnerability presents a potential risk for widespread
ions on behalf of users, and Exfiltration of sensitive data. This vulnerability presents a potential risk for widespread exploitation in connected IoT environments. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43122/
CVE ID: CVE-2017-16568 State: PUBLISHED Published: 2017-11-09T19:00:00.000Z Last Updated: 2025-02-04T21:10:57.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the compromised radio stream. Exploitation of this vulnerability can lead to Session hijacking and unauthorized access, Persistent manipulation of web content within the application, and Phishing or malicious redirects to external domains. This vulnera
anipulation of web content within the application, and Phishing or malicious redirects to external domains. This vulnerability can be exploited to manipulate media server behavior in enterprise and home network environments. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43123/