Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-6048 State: PUBLISHED Published: 2017-05-19T02:43:00 Last Updated: 2024-08-05T15:18:49.740Z Vendors: n/a Products: Satel Iberia SenNet Data Logger and Electricity Meters Problem Types: CWE-77 Description: A Command Injection issue was discovered in Satel Iberia SenNet Data Logger and Electricity Meters: SenNet Optimal DataLogger V5.37c-1.43c and prior, SenNet Solar Datalogger V5.03-1.56a and prior, and SenNet Multitask Meter V5.21a-1.18b and prior. Successful exploitation of this vulnerability could result in the attacker breaking out of the jailed shell and gaining full access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.u
d gaining full access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-131-02
CVE ID: CVE-2017-6049 State: PUBLISHED Published: 2019-04-02T19:39:25 Last Updated: 2024-08-05T15:18:49.695Z Vendors: Detcon Products: Sitewatch Gateway Problem Types: CWE-256 Description: Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-136-01
CVE ID: CVE-2017-6050 State: PUBLISHED Published: 2017-06-21T19:00:00 Last Updated: 2024-08-05T15:18:49.693Z Vendors: n/a Products: Ecava IntegraXor Problem Types: CWE-89 Description: A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user input, which may allow for an unauthenticated attacker to remotely execute arbitrary code in the form of SQL queries. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99164 - https://www.tenable.com/security/research/tra-2017-24 - https://ics-cert.us-cert.gov/advisories/ICSA-17-171-01
CVE ID: CVE-2017-6051 State: PUBLISHED Published: 2017-05-08T17:00:00 Last Updated: 2024-08-05T15:18:49.652Z Vendors: n/a Products: BLF-Tech LLC VisualView HMI Problem Types: CWE-427 Description: An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-115-01 - http://www.securityfocus.com/bid/98031
CVE ID: CVE-2017-6052 State: PUBLISHED Published: 2017-04-26T14:00:00 Last Updated: 2024-08-05T15:18:49.753Z Vendors: n/a Products: Hyundai Motor America Blue Link Problem Types: CWE-300 Description: A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-115-03 - http://www.securityfocus.com/bid/98033 - https://community.rapid7.com/community/infosec/blog/2017/04/25/r7-2017-02-hyundai-blue-l
w.securityfocus.com/bid/98033 - https://community.rapid7.com/community/infosec/blog/2017/04/25/r7-2017-02-hyundai-blue-link-potential-info-disclosure-fixed
CVE ID: CVE-2017-6053 State: PUBLISHED Published: 2017-06-21T19:00:00 Last Updated: 2024-08-05T15:18:49.649Z Vendors: n/a Products: Trihedral VTScada Problem Types: CWE-79 Description: A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JavaScript code supplied by the attacker to execute within the user's browser. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-164-01 - http://www.securityfocus.com/bid/99066
CVE ID: CVE-2017-6054 State: PUBLISHED Published: 2017-04-26T14:00:00 Last Updated: 2024-08-05T15:18:49.799Z Vendors: n/a Products: Hyundai Motor America Blue Link Problem Types: CWE-321 Description: A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-coded decryption password to protect sensitive user information. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-115-03 - http://www.securityfocus.com/bid/98033 - https://community.rapid7.com/community/infosec/blog/2017/04/25/r7-2017-02-hyundai-blue-link-potential-info-disclosure-fixed
CVE ID: CVE-2017-6055 State: PUBLISHED Published: 2017-02-17T20:00:00 Last Updated: 2024-08-05T15:18:49.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file. Additional Analyst Notes: - CVE Program Container: References: - https://cert.lv/lv/2017/02/iznakusas-nedelas-zinas-par-drosibas-incidentiem-nr-4-2017 - https://www.eparaksts.lv/en/Assistance/downloads/eparakstitajs-3-0/previous-versions-of-eparakstitajs-3-0/
CVE ID: CVE-2017-6056 State: PUBLISHED Published: 2017-02-17T07:45:00 Last Updated: 2024-08-05T15:18:49.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.red
d 8.0.14-1+deb8u7 in jessie) and Ubuntu. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0828.html - http://rhn.redhat.com/errata/RHSA-2017-0827.html - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578 - http://www.debian.org/security/2017/dsa-3787 - http://rhn.redhat.com/errata/RHSA-2017-0517.html - https://lists.debian.org/debian-security-announce/2017/msg00038.html - https://bugs.debian.org/851304 - http://www.debian.org/security/2017/dsa-3788 - https://security.netapp.com/advisory/ntap-20180731-0002/ - http://rhn.redhat.com/errata/RHSA-2017-0826.html - http://rhn.redhat.com/errata/RHSA-2017-0829.html - http://www.securityfocus.co
n.redhat.com/errata/RHSA-2017-0826.html - http://rhn.redhat.com/errata/RHSA-2017-0829.html - http://www.securityfocus.com/bid/96293 - http://www.securitytracker.com/id/1037860 - https://lists.debian.org/debian-security-announce/2017/msg00039.html - https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
CVE ID: CVE-2017-6058 State: PUBLISHED Published: 2017-03-20T16:00:00 Last Updated: 2024-08-05T15:18:49.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2017-02/msg03527.html - https://bugzilla.redhat.com/show_bug.cgi?id=1423358 - http://www.openwall.com/lists/oss-security/2017/02
msg03527.html - https://bugzilla.redhat.com/show_bug.cgi?id=1423358 - http://www.openwall.com/lists/oss-security/2017/02/17/2 - https://security.gentoo.org/glsa/201704-01 - http://www.securitytracker.com/id/1037856 - http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=df8bf7a7fe75eb5d5caffa55f5cd4292b757aea6 - http://www.securityfocus.com/bid/96277
CVE ID: CVE-2017-6059 State: PUBLISHED Published: 2017-04-12T20:00:00 Last Updated: 2024-08-05T15:18:49.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pingidentity/mod_auth_openidc/issues/212 - http://www.securityfocus.com/bid/96299 - https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.4 - http://www.openwall.com/lists/oss-security/2017
- https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.4 - http://www.openwall.com/lists/oss-security/2017/02/17/6 - https://github.com/pingidentity/mod_auth_openidc/commit/612e309bfffd6f9b8ad7cdccda3019fc0865f3b4 - https://access.redhat.com/errata/RHSA-2019:2112 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V3HIGXMUKJGOBMAQAQPGC7G5YYWSUVA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTWUMQ46GZY3O4WU4JCF333LN53R2XQH/
CVE ID: CVE-2017-6060 State: PUBLISHED Published: 2017-03-15T14:00:00 Last Updated: 2024-09-13T16:16:00.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/96266 - http://www.openwall.com/lists/oss-security/2017/02/18/1 - https://security.gentoo.org/glsa/201706-08 - https://blogs.gentoo.org/ago/2017/02/17/mupdf-mujstest-stack-based-buffer-overflow-in-main-jstest_main-c/ - https://bugs.ghostscrip
gs.gentoo.org/ago/2017/02/17/mupdf-mujstest-stack-based-buffer-overflow-in-main-jstest_main-c/ - https://bugs.ghostscript.com/show_bug.cgi?id=697551 - https://lists.debian.org/debian-lts-announce/2021/09/msg00013.html - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=06a012a42c9884e3cd653e7826cff1ddec04eb6e - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=e089b2e2c1d38c5696c7dfd741e21f8f3ef22b14
CVE ID: CVE-2017-6061 State: PUBLISHED Published: 2017-03-16T03:49:00 Last Updated: 2024-08-05T15:18:49.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote attackers to inject arbitrary web script or HTML via a GET request. /finance/help/en/frameset.htm is the URI for this component. The vendor response is SAP Security Note 2368106. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96461 - http://www.securitytracker.com/id/1037910 - http://packetstormsecurity.com/files/141349/SAP-BusinessObjects-Fin
/96461 - http://www.securitytracker.com/id/1037910 - http://packetstormsecurity.com/files/141349/SAP-BusinessObjects-Financial-Consolidation-10.0.0.1933-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2017/Feb/69
CVE ID: CVE-2017-6062 State: PUBLISHED Published: 2017-03-02T06:00:00 Last Updated: 2024-08-05T15:18:49.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.5 - https://github.com/pingidentity/mod_auth_openidc/blob/master/ChangeLog - https://
mod_auth_openidc/releases/tag/v2.1.5 - https://github.com/pingidentity/mod_auth_openidc/blob/master/ChangeLog - https://github.com/pingidentity/mod_auth_openidc/issues/222 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V3HIGXMUKJGOBMAQAQPGC7G5YYWSUVA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTWUMQ46GZY3O4WU4JCF333LN53R2XQH/
CVE ID: CVE-2017-6065 State: PUBLISHED Published: 2017-02-17T20:00:00 Last Updated: 2024-08-05T15:18:49.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/semplon/GeniXCMS/issues/71
CVE ID: CVE-2017-6066 State: PUBLISHED Published: 2017-03-27T01:55:00 Last Updated: 2024-08-05T15:18:49.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97087 - http://www.yiwang6.cn/Subrion-CSRF.docx
CVE ID: CVE-2017-6067 State: PUBLISHED Published: 2017-03-27T01:55:00 Last Updated: 2024-08-05T15:18:49.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field. Additional Analyst Notes: - CVE Program Container: References: - https://www.yiwang6.cn/Symphony-XSS1.docx - http://www.securityfocus.com/bid/97101
CVE ID: CVE-2017-6068 State: PUBLISHED Published: 2017-03-27T01:55:00 Last Updated: 2024-08-05T15:18:49.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.yiwang6.cn/Subrion-CSRF1.docx - http://www.securityfocus.com/bid/97091
CVE ID: CVE-2017-6069 State: PUBLISHED Published: 2017-03-27T01:55:00 Last Updated: 2024-08-05T15:18:49.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.yiwang6.cn/Subrion-CSRF2.docx - http://www.securityfocus.com/bid/97196
CVE ID: CVE-2017-6070 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:18:49.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form. Additional Analyst Notes: - CVE Program Container: References: - https://daylight-it.com/security-advisory-dlcs0001.html - http://dev.cmsmadesimple.org/project/files/69
CVE ID: CVE-2017-6071 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:18:49.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml. Additional Analyst Notes: - CVE Program Container: References: - https://daylight-it.com/security-advisory-dlcs0001.html - http://dev.cmsmadesimple.org/project/files/69
CVE ID: CVE-2017-6072 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:18:49.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin. Additional Analyst Notes: - CVE Program Container: References: - https://daylight-it.com/security-advisory-dlcs0001.html - http://dev.cmsmadesimple.org/project/files/69
CVE ID: CVE-2017-6074 State: PUBLISHED Published: 2017-02-18T21:40:00 Last Updated: 2024-08-05T15:18:49.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0323.html - http://rhn.redhat.com/errata/RHSA-2017-0324.html - http://rhn.redhat.com/errata/RHSA-
t.com/errata/RHSA-2017-0323.html - http://rhn.redhat.com/errata/RHSA-2017-0324.html - http://rhn.redhat.com/errata/RHSA-2017-0365.html - http://rhn.redhat.com/errata/RHSA-2017-0347.html - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://access.redhat.com/errata/RHSA-2017:1209 - http://www.openwall.com/lists/oss-security/2017/02/22/3 - http://rhn.redhat.com/errata/RHSA-2017-0501.html - https://source.android.com/security/bulletin/2017-07-01 - https://access.redhat.com/errata/RHSA-2017:0932 - http://www.securitytracker.com/id/1037876 - http://rhn.redhat.com/errata/RHSA-2017-0316.html - http://rhn.redhat.com/errata/RHSA-2017-0294.html - http://rhn.redhat.com
p://rhn.redhat.com/errata/RHSA-2017-0316.html - http://rhn.redhat.com/errata/RHSA-2017-0294.html - http://rhn.redhat.com/errata/RHSA-2017-0295.html - http://rhn.redhat.com/errata/RHSA-2017-0366.html - http://rhn.redhat.com/errata/RHSA-2017-0346.html - https://github.com/torvalds/linux/commit/5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 - http://rhn.redhat.com/errata/RHSA-2017-0403.html - http://www.debian.org/security/2017/dsa-3791 - http://rhn.redhat.com/errata/RHSA-2017-0293.html - https://www.tenable.com/security/tns-2017-07 - http://www.securityfocus.com/bid/96310 - https://www.exploit-db.com/exploits/41457/ - https://www.exploit-db.com/exploits/41458/ - http://rhn.redhat.com/errata/RHSA-201
/www.exploit-db.com/exploits/41457/ - https://www.exploit-db.com/exploits/41458/ - http://rhn.redhat.com/errata/RHSA-2017-0345.html
CVE ID: CVE-2017-6076 State: PUBLISHED Published: 2017-02-23T21:00:00 Last Updated: 2024-08-05T15:18:49.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96422 - https://github.com/wolfSSL/wolfssl/releases/tag/v3.10.2-stable
CVE ID: CVE-2017-6077 State: PUBLISHED Published: 2017-02-22T23:00:00.000Z Last Updated: 2025-10-21T23:55:46.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/96408 - https://www.exploit-db.com/exploits/41394/
CVE ID: CVE-2017-6078 State: PUBLISHED Published: 2017-02-21T07:46:00 Last Updated: 2024-08-05T15:18:49.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone MaxView 3.0 and 3.1 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with a crafted biSize field in the BITMAPINFOHEADER section. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilsani/rd/tree/master/security-advisories/faststone/maxview-cve-2017-6078
CVE ID: CVE-2017-6079 State: PUBLISHED Published: 2017-05-16T17:00:00 Last Updated: 2024-08-05T15:18:49.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side from the web application: if the command is valid, it executes. An example is the wget command. The page that allows this has been confirmed in firmware as old as 2006. Additional Analyst Notes: - CVE Program Container: References: - http
his has been confirmed in firmware as old as 2006. Additional Analyst Notes: - CVE Program Container: References: - https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices
CVE ID: CVE-2017-6080 State: PUBLISHED Published: 2017-03-13T06:14:00 Last Updated: 2024-08-05T15:18:49.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie and receive the result. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96937 - https://zammad.com/de/news/security-advisory-zaa-2017-01
CVE ID: CVE-2017-6081 State: PUBLISHED Published: 2017-03-13T06:14:00 Last Updated: 2024-08-05T15:18:49.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. To exploit the vulnerability, an attacker can send cross-domain requests directly to the REST API for users with a valid session cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96937 - https://zammad.com/de/news/security-advisory-zaa-2017-01
CVE ID: CVE-2017-6086 State: PUBLISHED Published: 2017-06-27T20:00:00 Last Updated: 2024-08-05T15:18:49.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (2) remove an administrator user via a crafted GET request to <vimbadmin directory>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimb
>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (4) add a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (5) delete a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (6) archive a mailbox address via a crafted GET request to <vimbadmin directory>/application/controllers/ArchiveController.php, (7) add an alias address via a crafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address