Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-5200 State: PUBLISHED Published: 2017-09-26T14:00:00 Last Updated: 2024-08-05T14:55:35.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. Additional Analyst Notes: - CVE Program Container: References: - https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html - https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html - https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html
CVE ID: CVE-2017-5201 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T14:55:35.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allow remote authenticated users to obtain sensitive cluster and tenant information via unspecified vectors, a different vulnerability than CVE-2016-3064. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101776 - https://security.netapp.com/advisory/ntap-20170809-0001/
CVE ID: CVE-2017-5202 State: PUBLISHED Published: 2017-01-28T01:33:00 Last Updated: 2024-08-05T14:55:35.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print(). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037755 - http://www.debian.org/security/2017/dsa-3775 - https://access.redhat.com/errata/RHSA-2017:1871 - https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1494526.html - http://www.securityfocus.com/bid/95852 - https://security.gentoo.org/glsa/201702-30
CVE ID: CVE-2017-5203 State: PUBLISHED Published: 2017-01-28T01:33:00 Last Updated: 2024-08-05T14:55:35.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print(). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037755 - http://www.debian.org/security/2017/dsa-3775 - https://access.redhat.com/errata/RHSA-2017:1871 - https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1494526.html - http://www.securityfocus.com/bid/95852 - https://security.gentoo.org/glsa/201702-30
CVE ID: CVE-2017-5204 State: PUBLISHED Published: 2017-01-28T01:33:00 Last Updated: 2024-08-05T14:55:35.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print(). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037755 - http://www.debian.org/security/2017/dsa-3775 - https://access.redhat.com/errata/RHSA-2017:1871 - https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1494526.html - http://www.securityfocus.com/bid/95852 - https://security.gentoo.org/glsa/201702-30
CVE ID: CVE-2017-5205 State: PUBLISHED Published: 2017-01-28T01:33:00 Last Updated: 2024-08-05T14:55:35.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ISAKMP parser in tcpdump before 4.9.0 has a buffer overflow in print-isakmp.c:ikev2_e_print(). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037755 - http://www.debian.org/security/2017/dsa-3775 - https://access.redhat.com/errata/RHSA-2017:1871 - https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1494526.html - http://www.securityfocus.com/bid/95852 - https://security.gentoo.org/glsa/201702-30
CVE ID: CVE-2017-5206 State: PUBLISHED Published: 2017-03-23T16:00:00 Last Updated: 2024-08-05T14:55:35.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox protection mechanism via the --allow-debuggers argument. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/01/07/5 - https://blog.lizzie.io/linux-containers-in-500-loc.html#fn.51 - https://security.gentoo.org/glsa/201701-62 - https://github.com/netblue30/firejail/commit/6b8dba29d73257311564ee7f27b9b14758cc693e - http://www.securi
sa/201701-62 - https://github.com/netblue30/firejail/commit/6b8dba29d73257311564ee7f27b9b14758cc693e - http://www.securityfocus.com/bid/97120 - https://firejail.wordpress.com/download-2/release-notes/
CVE ID: CVE-2017-5207 State: PUBLISHED Published: 2017-03-23T16:00:00 Last Updated: 2024-08-05T14:55:35.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97385 - https://security.gentoo.org/glsa/201701-62 - https://github.com/netblue30/firejail/commit/5d43fdcd215203868d440ffc42036f5f5ffc89fc - https://github.com/netblue30/firejail/issues/1023 - https://firejail.wordpress.com/download-2/release-notes/ - http://www.openwall.com/lists/oss-security/2017/01/07
/1023 - https://firejail.wordpress.com/download-2/release-notes/ - http://www.openwall.com/lists/oss-security/2017/01/07/6
CVE ID: CVE-2017-5208 State: PUBLISHED Published: 2017-08-22T18:00:00 Last Updated: 2024-08-05T14:55:35.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which triggers a denial of service (application crash) or the possibility of execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201801-12 - http://www.openwall.com/lists/oss-security/2017/01/08/5 - http://www.debian.org/security/2017/dsa-3756 - http://rhn.redhat.com/errata/RHSA-2017-0837.h
oss-security/2017/01/08/5 - http://www.debian.org/security/2017/dsa-3756 - http://rhn.redhat.com/errata/RHSA-2017-0837.html - http://www.securityfocus.com/bid/95315 - https://bugzilla.redhat.com/show_bug.cgi?id=1411251
CVE ID: CVE-2017-5209 State: PUBLISHED Published: 2017-01-11T16:00:00 Last Updated: 2024-08-05T14:55:35.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95385 - https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957 - https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html
CVE ID: CVE-2017-5210 State: PUBLISHED Published: 2019-05-23T14:34:45 Last Updated: 2024-08-05T14:55:35.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure. Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - http://open-xchange.com - https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE ID: CVE-2017-5211 State: PUBLISHED Published: 2019-05-23T14:30:35 Last Updated: 2024-08-05T14:55:35.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - http://open-xchange.com - https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE ID: CVE-2017-5212 State: PUBLISHED Published: 2019-05-23T14:26:06 Last Updated: 2024-08-05T14:55:35.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - http://open-xchange.com - https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE ID: CVE-2017-5213 State: PUBLISHED Published: 2019-05-23T14:21:22 Last Updated: 2024-08-05T14:55:35.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - http://open-xchange.com - https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE ID: CVE-2017-5214 State: PUBLISHED Published: 2017-05-17T14:00:00 Last Updated: 2024-08-05T14:55:35.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This makes it easier to read arbitrary uploaded files. Additional Analyst Notes: - CVE Program Container: References: - https://navixia.com/storage/app/media/uploaded-files/CVE/cve-2017-521415.txt
CVE ID: CVE-2017-5215 State: PUBLISHED Published: 2017-05-17T14:00:00 Last Updated: 2024-08-05T14:55:35.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a rename attack that bypasses a "safe file extension" protection mechanism, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://navixia.com/storage/app/media/uploaded-files/CVE/cve-2017-521415.txt
CVE ID: CVE-2017-5216 State: PUBLISHED Published: 2017-01-09T08:48:00 Last Updated: 2024-08-05T14:55:35.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow vulnerability in Netop Remote Control versions 11.53, 12.21 and prior. The affected module in the Guest client is the "Import to Phonebook" option. When a specially designed malicious file containing special characters is loaded, the overflow occurs. 12.51 is the fixed version. The Support case ref is 00109744. Additional Analyst Notes: - CVE Program Container: References: - http://www.netop.com/fileadmin/netop/resources/products/administration/remote_control/release_notes/NetopRemoteControl_12.51_M
/www.netop.com/fileadmin/netop/resources/products/administration/remote_control/release_notes/NetopRemoteControl_12.51_ModificationNotes_final.pdf - http://www.securityfocus.com/bid/95316
CVE ID: CVE-2017-5217 State: PUBLISHED Published: 2017-01-09T08:48:00 Last Updated: 2024-08-05T14:55:35.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: Installing a zero-permission Android application on certain Samsung Android devices with KK(4.4), L(5.0/5.1), and M(6.0) software can continually crash the system_server process in the Android OS. The zero-permission app will create an active install session for a separate app that it has embedded within it. The active install session of the embedded app is performed using the android.content.pm.PackageInstaller class and its nested classes in the Android API. The active install session will write the embedded APK file to the
ler class and its nested classes in the Android API. The active install session will write the embedded APK file to the /data/app directory, but the app will not be installed since third-party applications cannot programmatically install apps. Samsung has modified AOSP in order to accelerate the parsing of APKs by introducing the com.android.server.pm.PackagePrefetcher class and its nested classes. These classes will parse the APKs present in the /data/app directory and other directories, even if the app is not actually installed. The embedded APK that was written to the /data/app directory via the active install session has a very large but valid AndroidManifest.xml file. Specifically, the
ata/app directory via the active install session has a very large but valid AndroidManifest.xml file. Specifically, the AndroidManifest.xml file contains a very large string value for the name of a permission-tree that it declares. When system_server tries to parse the APK file of the embedded app from the active install session, it will crash due to an uncaught error (i.e., java.lang.OutOfMemoryError) or an uncaught exception (i.e., std::bad_alloc) because of memory constraints. The Samsung Android device will encounter a soft reboot due to a system_server crash, and this action will keep repeating since parsing the APKs in the /data/app directory as performed by the system_server process i
action will keep repeating since parsing the APKs in the /data/app directory as performed by the system_server process is part of the normal boot process. The Samsung ID is SVE-2016-6917. Additional Analyst Notes: - CVE Program Container: References: - http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2017 - http://www.securityfocus.com/bid/95319
CVE ID: CVE-2017-5218 State: PUBLISHED Published: 2017-02-02T06:54:00 Last Updated: 2024-08-05T14:55:35.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user's session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=<VALID-SID>&database=1';WAITFOR DELAY '0:0:5'--
e underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=<VALID-SID>&database=1';WAITFOR DELAY '0:0:5'-- URI is a Proof of Concept. Additional Analyst Notes: - CVE Program Container: References: - http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218/ - http://www.securityfocus.com/bid/95968
CVE ID: CVE-2017-5219 State: PUBLISHED Published: 2017-02-02T06:54:00 Last Updated: 2024-08-05T14:55:35.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SageCRM 7.x before 7.3 SP3. The Component Manager functionality, provided by SageCRM, permits additional components to be added to the application to enhance provided functionality. This functionality allows a zip file to be uploaded, containing a valid .ecf component file, which will be extracted to the inf directory outside of the webroot. By creating a zip file containing an empty .ecf file, to pass file-validation checks, any other file provided in zip file will be extracted onto the filesystem.
y .ecf file, to pass file-validation checks, any other file provided in zip file will be extracted onto the filesystem. In this case, a web shell with the filename '..\WWWRoot\CustomPages\aspshell.asp' was included within the zip file that, when extracted, traversed back out of the inf directory and into the SageCRM webroot. This permitted remote interaction with the underlying filesystem with the highest privilege level, SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218/ - http://www.securityfocus.com/bid/95968
CVE ID: CVE-2017-5223 State: PUBLISHED Published: 2017-01-16T06:00:00 Last Updated: 2024-08-05T14:55:35.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-s
nd added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95328 - http://kalilinux.co/2017/01/12/phpmailer-cve-2017-5223-local-information-disclosure-vulnerability-analysis/ - https://www.exploit-db.com/exploits/43056/ - https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md
CVE ID: CVE-2017-5225 State: PUBLISHED Published: 2017-01-12T11:00:00 Last Updated: 2024-08-05T14:55:35.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution via a crafted BitsPerSample value. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3844 - https://security.gentoo.org/glsa/201709-27 - http://bugzilla.maptools.org/show_bug.cgi?id=2656 - http://bugzilla.maptools.org/show_bug.cgi?id=2657 - http://www.securitytracker.com/id/1037911 - http://www.securityfocus.com/bid/95413 - https://github.com/vadz/libtiff/co
http://www.securitytracker.com/id/1037911 - http://www.securityfocus.com/bid/95413 - https://github.com/vadz/libtiff/commit/5c080298d59efa53264d7248bbe3a04660db6ef7
CVE ID: CVE-2017-5226 State: PUBLISHED Published: 2017-03-29T00:00:00 Last Updated: 2024-08-05T14:55:35.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectatomic/bubblewrap/issues/142 - http://www.securityfocus.com/bid/97260 - https://bugzilla.redhat.com/show_bug.cgi?id=1411811 - https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b
dhat.com/show_bug.cgi?id=1411811 - https://github.com/projectatomic/bubblewrap/commit/d7fc532c42f0e9bf427923bab85433282b3e5117 - http://www.openwall.com/lists/oss-security/2020/07/10/1 - https://www.openwall.com/lists/oss-security/2023/03/14/2 - http://www.openwall.com/lists/oss-security/2023/03/17/1
CVE ID: CVE-2017-5227 State: PUBLISHED Published: 2017-03-23T16:00:00 Last Updated: 2024-08-05T14:55:35.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97056 - http://www.securityfocus.com/bid/97072 - https://www.qnap.com/en/support/con_show.php?cid=113 - http://www.securitytracker.com/id/1038091 - https://www.qnap.com/en-us/releasenotes/ - https://www.exploit-db.com/exploits/4
://www.securitytracker.com/id/1038091 - https://www.qnap.com/en-us/releasenotes/ - https://www.exploit-db.com/exploits/41745/ - http://www.ush.it/team/ush/hack-qnap/qnap.txt
CVE ID: CVE-2017-5228 State: PUBLISHED Published: 2017-03-02T20:00:00 Last Updated: 2024-08-05T14:55:35.676Z Vendors: Rapid7 Products: Metasploit Problem Types: Directory Traversal Description: All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96954 - https://community.rapid7.com/community/infosec/blog/
m Container: References: - http://www.securityfocus.com/bid/96954 - https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products
CVE ID: CVE-2017-5229 State: PUBLISHED Published: 2017-03-02T20:00:00 Last Updated: 2024-08-05T14:55:35.561Z Vendors: Rapid7 Products: Metasploit Problem Types: Directory Traversal Description: All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96954 - https://community.rapid7.com/community/infos
E Program Container: References: - http://www.securityfocus.com/bid/96954 - https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products
CVE ID: CVE-2017-5230 State: PUBLISHED Published: 2017-03-02T20:00:00 Last Updated: 2024-08-05T14:55:35.711Z Vendors: Rapid7 Products: Nexpose Problem Types: Hard-Coded Password Description: The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiable by the user. The keystore provides storage for saved scan credentials in an otherwise secure location on disk. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.50 - http://www.securityfocus.com/bid/96956 - https://community.rapid7.com/community/infosec/blog/2017/03/01/multip
#6.4.50 - http://www.securityfocus.com/bid/96956 - https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products
CVE ID: CVE-2017-5231 State: PUBLISHED Published: 2017-03-02T20:00:00 Last Updated: 2024-08-05T14:55:35.636Z Vendors: Rapid7 Products: Metasploit Problem Types: Directory Traversal Description: All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96954 - https://community.rapid7.com/commu
otes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96954 - https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products
CVE ID: CVE-2017-5232 State: PUBLISHED Published: 2017-03-02T20:00:00 Last Updated: 2024-08-05T14:55:35.528Z Vendors: Rapid7 Products: Nexpose Problem Types: DLL Preloading Description: All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96956 - https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products
CVE ID: CVE-2017-5233 State: PUBLISHED Published: 2017-03-02T20:00:00 Last Updated: 2024-08-05T14:55:35.652Z Vendors: Rapid7 Products: AppSpider Pro Problem Types: DLL Preloading Description: Rapid7 AppSpider Pro installers prior to version 6.14.053 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2017/03/01/multiple-vulnerabilities-affecting-four-rapid7-products - http://www.securityfocus.com/bid/96957