Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/pub/linux/kernel/v4.x/ChangeLog-4.1.49 - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-21/ - https://www.debian.org/security/2018/dsa-4187 - https://usn.ubuntu.com/3619-2/ - https://www.spinics.net/lists/linux-usb/msg163480.html - https://secuniaresearch.flexerasoftware.com/advisories/80722/ - https://usn.ubuntu.com/3754-1/ - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8 - http://www.securityfocus.com/bid/102150 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.107 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.71 - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3619-1/ - https://git.ke
1 - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3619-1/ - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/drivers/usb/usbip?id=be6123df1ea8f01ee2f896a16c2b7be3e4557a5a
CVE ID: CVE-2017-16919 State: PUBLISHED Published: 2017-11-21T08:00:00 Last Updated: 2024-08-05T20:35:21.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: MapOS 3.1.11 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in /clientes/visualizar, which allows remote attackers to inject arbitrary web script or HTML via a crafted description parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RamonSilva20/mapos/issues/81
CVE ID: CVE-2017-16920 State: PUBLISHED Published: 2017-11-21T13:00:00 Last Updated: 2024-08-05T20:35:21.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/dayrui/finecms/commit/ff4b7ad3c3fbd3245b3bb7bc774d20c9705d9882 - https://user-images.githubusercontent.com/31153532/33065202-21b536f2-cee3-11e7-997a-c7d4f1b00ca7.jpg
CVE ID: CVE-2017-16921 State: PUBLISHED Published: 2017-12-08T15:00:00 Last Updated: 2024-08-05T20:35:21.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user. Additional Analyst Notes: - CVE Program Container: References: - https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/ - https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html - https:/
y-2017-09-security-update-otrs-framework/ - https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html - https://www.exploit-db.com/exploits/43853/ - https://www.debian.org/security/2017/dsa-4066 - http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html
CVE ID: CVE-2017-16922 State: PUBLISHED Published: 2018-03-05T18:00:00 Last Updated: 2024-08-05T20:35:21.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file are possible via a remote, specifically crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2017-16922.txt
CVE ID: CVE-2017-16923 State: PUBLISHED Published: 2017-11-21T14:00:00Z Last Updated: 2024-09-17T03:14:10.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(6318_)_cn, Ac15 US_AC15V1.0BR_V15.03.05.18_multi_TD01, Ac15 US_AC15V1.0BR_V15.03.05.19_multi_TD01, Ac18 US_AC18V1.0BR_V15.03.05.05_multi_TD01, and Ac18 ac18_kf_V15.03.05.19(6318_)_cn devices allows remote unauthenticated attackers to execute arbitrary OS commands via a crafted cgi-bin/luci/usbeject?dev_name= GET request from the LAN. This occurs because the "sub_A6E8 usbeject_process_entry" f
ed cgi-bin/luci/usbeject?dev_name= GET request from the LAN. This occurs because the "sub_A6E8 usbeject_process_entry" function executes a system function with untrusted input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Iolop/Poc/tree/master/Router/Tenda
CVE ID: CVE-2017-16924 State: PUBLISHED Published: 2018-02-19T04:00:00 Last Updated: 2024-08-05T20:35:21.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data/<client_id>/collections/##/usermgmt.xml URL, as demonstrated by passwords and Wi-Fi keys. This is fixed in build 100157. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/desktop-management-msp/password-encryption-policy-violation.html - https://github.c
nces: - https://www.manageengine.com/desktop-management-msp/password-encryption-policy-violation.html - https://github.com/snoonan77/security-research/blob/master/CVE-2017-16924
CVE ID: CVE-2017-16926 State: PUBLISHED Published: 2017-11-22T08:00:00 Last Updated: 2024-08-05T20:35:21.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ohcount 3.0.0 is prone to a command injection via specially crafted filenames containing shell metacharacters, which can be exploited by an attacker (providing a source tree for Ohcount processing) to execute arbitrary code as the user running Ohcount. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/882372
CVE ID: CVE-2017-16927 State: PUBLISHED Published: 2017-11-23T06:00:00 Last Updated: 2024-08-05T20:35:21.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/xrdp-devel/PmVfMuy_xBA - https://github.com/neutrinolabs/xrdp/pull/958 - https://lists.debian.org/debian-lts-anno
1topic/xrdp-devel/PmVfMuy_xBA - https://github.com/neutrinolabs/xrdp/pull/958 - https://lists.debian.org/debian-lts-announce/2017/12/msg00005.html
CVE ID: CVE-2017-16928 State: PUBLISHED Published: 2018-01-31T20:00:00 Last Updated: 2024-08-05T20:43:57.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: The arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted update URL, as demonstrated by file:///tmp/blah/Arq.zip. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43925/ - http://packetstormsecurity.com/files/146158/Arq-5.10-Local-Privilege-Escalation.html - https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.html
CVE ID: CVE-2017-16929 State: PUBLISHED Published: 2017-12-05T09:00:00 Last Updated: 2024-08-05T20:43:57.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request, allowing a remote attacker to read/write arbitrary files. This can be exploited via ../ sequences in the pathname to miner_file or miner_getfile. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43231/ - https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929 - http://www.openwall.co
ploit-db.com/exploits/43231/ - https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929 - http://www.openwall.com/lists/oss-security/2017/12/04/3
CVE ID: CVE-2017-16930 State: PUBLISHED Published: 2017-12-05T09:00:00 Last Updated: 2024-08-05T20:43:57.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. This can be exploited via a long API request that is mishandled during logging. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43231/ - http://www.openwall.com/lists/oss-security/2017/12/04/3 - https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16930
CVE ID: CVE-2017-16931 State: PUBLISHED Published: 2017-11-23T21:00:00 Last Updated: 2024-08-05T20:43:57.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://bugzilla.gnome.org/show_bug.cgi?id=766956 - http://xmlsoft.org/news.html - https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c438
_bug.cgi?id=766956 - http://xmlsoft.org/news.html - https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3
CVE ID: CVE-2017-16932 State: PUBLISHED Published: 2017-11-23T21:00:00 Last Updated: 2024-08-05T20:43:57.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Additional Analyst Notes: - CVE Program Container: References: - https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html - https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html - http://xmlsoft.org/news.html - https://usn.ubuntu.com/3739-1/ - https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961 - https://bugzilla.gnome.org/show_bug.cgi?id=759579 - https://lists.apache.org/thread.html
13b8e32449a08a361e0de127dd961 - https://bugzilla.gnome.org/show_bug.cgi?id=759579 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
CVE ID: CVE-2017-16933 State: PUBLISHED Published: 2017-11-24T05:00:00 Last Updated: 2024-08-05T20:43:59.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local users to gain privileges by leveraging access to the $ICINGA2_USER account for creation of a link. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Icinga/icinga2/issues/5793
CVE ID: CVE-2017-16934 State: PUBLISHED Published: 2017-11-24T07:00:00 Last Updated: 2024-08-05T20:43:57.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a change_password.csp request, which supports a "<%%25call system.exec:" string in the passwd parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3437
CVE ID: CVE-2017-16935 State: PUBLISHED Published: 2017-11-24T07:00:00 Last Updated: 2024-08-05T20:43:57.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3517 - https://issues.ametys.o
s: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3517 - https://issues.ametys.org/browse/RUNTIME-2582
CVE ID: CVE-2017-16936 State: PUBLISHED Published: 2017-11-24T07:00:00 Last Updated: 2024-08-05T20:43:59.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(6318_)_cn, Ac15 US_AC15V1.0BR_V15.03.05.18_multi_TD01, Ac15 US_AC15V1.0BR_V15.03.05.19_multi_TD01, Ac18 US_AC18V1.0BR_V15.03.05.05_multi_TD01, and Ac18 ac18_kf_V15.03.05.19(6318_)_cn devices allows remote unauthenticated attackers to read arbitrary files via a cgi-bin/luci/request?op=1&path= URI that uses directory traversal sequences after a /usb/ substring. Additional Analyst Notes: - CVE
request?op=1&path= URI that uses directory traversal sequences after a /usb/ substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Iolop/Poc/tree/master/Router/Tenda
CVE ID: CVE-2017-16938 State: PUBLISHED Published: 2017-11-24T07:00:00 Last Updated: 2024-08-05T20:43:57.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00042.html - https://www.debian.org/security/2017/dsa-4058 - https://sourceforge.net/p/optipng/bugs/69/ - https://security.gentoo.org/glsa/201801-02
CVE ID: CVE-2017-16939 State: PUBLISHED Published: 2017-11-24T10:00:00 Last Updated: 2024-08-05T20:43:59.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4082 - https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00
ebian.org/debian-lts-announce/2017/12/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html - https://bugzilla.suse.com/show_bug.cgi?id=1069702 - https://github.com/torvalds/linux/commit/1137b5e2529a8f5ca8ee709288ecba3e68044df2 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11 - http://seclists.org/fulldisclosure/2017/Nov/40 - https://access.redhat.com/errata/RHSA-2018:1355 - https://access.redhat.com/errata/RHSA-2018:1318 - http://www.securityfocus.com/bid/101954 - https://blogs.securiteam.com/index.php/archives/3535 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1137b5e2529a8f5ca8ee709288ecba3e68044df2 - https:
p://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1137b5e2529a8f5ca8ee709288ecba3e68044df2 - https://access.redhat.com/errata/RHSA-2019:1170 - https://access.redhat.com/errata/RHSA-2019:1190
CVE ID: CVE-2017-16941 State: PUBLISHED Published: 2017-11-25T05:00:00 Last Updated: 2024-08-05T20:43:57.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering. Additional Analyst Notes: - CVE Pro
as access to manage/upload themes] is a threat model that we need to be considering. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/issues/3257
CVE ID: CVE-2017-16942 State: PUBLISHED Published: 2017-11-25T17:00:00 Last Updated: 2024-08-05T20:43:59.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead to DoS when playing a crafted audio file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erikd/libsndfile/issues/341 - https://usn.ubuntu.com/4013-1/
CVE ID: CVE-2017-16943 State: PUBLISHED Published: 2017-11-25T17:00:00 Last Updated: 2024-08-05T20:43:59.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039872 - https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html - https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde - http://openwall.com/lists/oss-security/2017/11/25/3 - htt
org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde - http://openwall.com/lists/oss-security/2017/11/25/3 - https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944 - http://openwall.com/lists/oss-security/2017/11/25/1 - https://git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4 - http://openwall.com/lists/oss-security/2017/11/25/2 - https://www.debian.org/security/2017/dsa-4053 - https://bugs.exim.org/show_bug.cgi?id=2199 - http://www.openwall.com/lists/oss-security/2021/05/04/7
CVE ID: CVE-2017-16944 State: PUBLISHED Published: 2017-11-25T17:00:00 Last Updated: 2024-08-05T20:43:57.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function. Additional Analyst Notes: - CVE Program Container: References: - https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html - http://openwall.com/lists/oss-security/2017/11/25/3 - https://bugs.exim.org/
/message/20171125.034842.d1d75cac.en.html - http://openwall.com/lists/oss-security/2017/11/25/3 - https://bugs.exim.org/show_bug.cgi?id=2201 - http://openwall.com/lists/oss-security/2017/11/25/1 - http://www.securitytracker.com/id/1039873 - http://openwall.com/lists/oss-security/2017/11/25/2 - https://www.debian.org/security/2017/dsa-4053 - https://www.exploit-db.com/exploits/43184/ - http://www.openwall.com/lists/oss-security/2021/05/04/7
CVE ID: CVE-2017-16945 State: PUBLISHED Published: 2018-01-31T20:00:00 Last Updated: 2024-08-05T20:43:59.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted restore path. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43926/ - http://packetstormsecurity.com/files/146159/Arq-5.10-Local-Privilege-Escalation.html - https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.html
CVE ID: CVE-2017-16946 State: PUBLISHED Published: 2017-11-25T18:00:00 Last Updated: 2024-08-05T20:43:57.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/7d5890b2fc63285f010d5845913894dd71cf232c
CVE ID: CVE-2017-16948 State: PUBLISHED Published: 2017-11-26T21:00:00Z Last Updated: 2024-09-16T19:46:17.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730008 DeviceIoControl request to \\.\Viragtlt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Vir.IT-explorer-Anti-Virus-Null-Pointer-Reference-PoC/tree/master/VirIT_NullPointerReference1
CVE ID: CVE-2017-16949 State: PUBLISHED Published: 2017-12-18T17:00:00 Last Updated: 2024-08-05T20:43:59.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and file-uploader/file-uploader-class.php. This allows the attacker to upload anything they want to the server, as demonstrated by an action=ap_file_upload_action&allowedExtensions[]=php request to /wp-admin/admin-ajax.php that results in a .php file upload an
=ap_file_upload_action&allowedExtensions[]=php request to /wp-admin/admin-ajax.php that results in a .php file upload and resultant PHP code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43324/ - https://wpvulndb.com/vulnerabilities/8977 - http://packetstormsecurity.com/files/145398/Accesspress-Anonymous-Post-Pro-Unauthenticated-Arbitrary-File-Upload.html
CVE ID: CVE-2017-16950 State: PUBLISHED Published: 2017-12-17T05:00:00 Last Updated: 2024-08-05T20:43:57.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross - site scripting (XSS) vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.urbackup.org/server_changelog.html - https://www.urbackup.org/2017/11/30/urbackup-server-2.1.20.html
CVE ID: CVE-2017-16951 State: PUBLISHED Published: 2017-11-28T15:00:00 Last Updated: 2024-08-05T20:43:59.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, or AIF file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43186/
CVE ID: CVE-2017-16952 State: PUBLISHED Published: 2017-11-28T15:00:00 Last Updated: 2024-08-05T20:43:57.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43185/