Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-15878 State: PUBLISHED Published: 2017-10-24T21:00:00 Last Updated: 2024-08-05T20:04:50.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/keystonejs/keystone/pull/4478 - http://www.securityfocus.com/bid/101541 - https://www.exploit-db.com/exploits/43054/ - http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/ - https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-C
etration-testing-report/ - https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.html
CVE ID: CVE-2017-15879 State: PUBLISHED Published: 2017-10-24T21:00:00 Last Updated: 2024-08-05T20:04:50.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/keystonejs/keystone/pull/4478 - https://www.exploit-db.com/exploits/43053/ - https://packetstormsecurity.com/files/144755/KeystoneJS-4.0.0-beta.5-Unauthenticated-CSV-Injection.html
CVE ID: CVE-2017-15880 State: PUBLISHED Published: 2017-10-24T22:00:00Z Last Updated: 2024-09-17T03:54:19.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php (for insert_group and update_group). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsj730sos/cve/blob/master/Eonweb_module_admin_group_add_modify_group.php-update_group-SQL%20injection%20vulnerability - https://github.com/jsj730sos/cve/blob/master
n_group_add_modify_group.php-update_group-SQL%20injection%20vulnerability - https://github.com/jsj730sos/cve/blob/master/Eonweb_module_admin_group_add_modify_group.php%20SQLi
CVE ID: CVE-2017-15881 State: PUBLISHED Published: 2017-10-24T22:00:00 Last Updated: 2024-08-05T20:04:50.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101541 - http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/ - https://github.com/keystonejs/keystone/issues/4437 - https://github.com/keystonejs/keystone
enetration-testing-report/ - https://github.com/keystonejs/keystone/issues/4437 - https://github.com/keystonejs/keystone/pull/4478
CVE ID: CVE-2017-15882 State: PUBLISHED Published: 2017-10-26T05:00:00 Last Updated: 2024-08-05T20:04:50.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: The London Trust Media Private Internet Access (PIA) application before 1.3.3.1 for Android allows remote attackers to cause a denial of service (application crash) via a large VPN server-list file. Additional Analyst Notes: - CVE Program Container: References: - https://wwws.nightwatchcybersecurity.com/2017/10/25/advisory-pia-android-app-cve-2017-15882/
CVE ID: CVE-2017-15883 State: PUBLISHED Published: 2018-01-08T19:00:00 Last Updated: 2024-08-05T20:04:50.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vectors related to weak cryptography. Additional Analyst Notes: - CVE Program Container: References: - https://www.mnemonic.no/news/2017/vulnerability-finding-sitefinity-cms/ - https://knowledgebase.progress.com/articles/Article/Sitefinity-Security-Advisory-for-cryptographic-vulnerability-CVE-2017-15883
CVE ID: CVE-2017-15884 State: PUBLISHED Published: 2017-10-31T18:00:00 Last Updated: 2024-08-05T20:04:50.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://m4.rkw.io/blog/cve201715884-local-root-privesc-in-hashicorp-vagrantvmwarefusion-500.html - https://www.exploit-db.com/exploits/43222/
CVE ID: CVE-2017-15885 State: PUBLISHED Published: 2017-10-25T06:00:00Z Last Updated: 2024-09-17T01:00:55.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS in the web administration portal on the Axis 2100 Network Camera 2.03 allows an attacker to execute arbitrary JavaScript via the conf_Layout_OwnTitle parameter to view/view.shtml. NOTE: this might overlap CVE-2007-5214. Additional Analyst Notes: - CVE Program Container: References: - https://distributedcompute.com/2017/10/24/axis-2100-network-camera-2-03-xss-vulnerability/
CVE ID: CVE-2017-15886 State: PUBLISHED Published: 2017-12-28T15:00:00Z Last Updated: 2024-09-16T20:57:53.573Z Vendors: Synology Products: Chat Problem Types: CWE-918 Description: Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_78
CVE ID: CVE-2017-15887 State: PUBLISHED Published: 2017-11-07T15:00:00Z Last Updated: 2024-09-16T22:03:13.049Z Vendors: Synology Products: Synology CardDAV Server Problem Types: CWE-307 Description: An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_64_CardDAV_Server
CVE ID: CVE-2017-15888 State: PUBLISHED Published: 2017-10-30T18:00:00Z Last Updated: 2024-09-17T01:15:50.497Z Vendors: Synology Products: Synology Audio Station Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inject arbitrary web script or HTML via the NAME parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_61_Audio_Station
CVE ID: CVE-2017-15889 State: PUBLISHED Published: 2017-12-04T19:00:00Z Last Updated: 2024-09-16T17:34:05.344Z Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-77 Description: Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_65_DSM - http://packetstormsecurity.com/files/157807/Synology-DiskStation-Manager-smart.cgi-Remote-Command-Execution.html
CVE ID: CVE-2017-15890 State: PUBLISHED Published: 2017-12-15T15:00:00Z Last Updated: 2024-09-16T18:56:25.021Z Vendors: Synology Products: MailPlus Server Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web script or HTML via the NAME parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_75
CVE ID: CVE-2017-15891 State: PUBLISHED Published: 2017-12-08T16:00:00Z Last Updated: 2024-09-16T20:46:59.679Z Vendors: Synology Products: Synology Calendar Problem Types: CWE-284 Description: Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_68_Calendar
CVE ID: CVE-2017-15892 State: PUBLISHED Published: 2017-12-28T15:00:00Z Last Updated: 2024-09-16T16:42:31.922Z Vendors: Synology Products: Chat Problem Types: CWE-79 Description: Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via (1) COMMAND, (2) COMMANDS INSTRUCTION, or (3) DESCRIPTION parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_78
CVE ID: CVE-2017-15893 State: PUBLISHED Published: 2017-12-08T16:00:00Z Last Updated: 2024-09-17T02:16:52.281Z Vendors: Synology Products: Synology File Station Problem Types: CWE-22 Description: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_69_File_Station
CVE ID: CVE-2017-15894 State: PUBLISHED Published: 2017-12-08T16:00:00Z Last Updated: 2024-09-16T19:31:51.358Z Vendors: Synology Products: Synology DiskStation Manager (DSM) Problem Types: CWE-22 Description: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_70_DSM
CVE ID: CVE-2017-15895 State: PUBLISHED Published: 2017-12-08T16:00:00Z Last Updated: 2024-09-16T17:39:14.692Z Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-22 Description: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_71_SRM
CVE ID: CVE-2017-15896 State: PUBLISHED Published: 2017-12-11T21:00:00Z Last Updated: 2024-09-16T19:50:49.572Z Vendors: The Node.js Project Products: Node.js Problem Types: Data Confidentiality/Integrity Description: Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
CVE ID: CVE-2017-15897 State: PUBLISHED Published: 2017-12-11T21:00:00Z Last Updated: 2024-09-17T03:42:59.193Z Vendors: The Node.js Project Products: Node.js Problem Types: Un-initialized Data Description: Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
CVE ID: CVE-2017-15906 State: PUBLISHED Published: 2017-10-26T00:00:00 Last Updated: 2024-08-05T20:04:50.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssh.com/txt/release-7.6 - http://www.securityfocus.com/bid/101552 - https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19 - https://security.gentoo.org/glsa/201801-05 - https://security.netapp.com/advisory/ntap-20180423-0004/ - https://access.redh
ps://security.gentoo.org/glsa/201801-05 - https://security.netapp.com/advisory/ntap-20180423-0004/ - https://access.redhat.com/errata/RHSA-2018:0980 - https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
CVE ID: CVE-2017-15907 State: PUBLISHED Published: 2017-10-26T05:00:00 Last Updated: 2024-08-05T20:04:50.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to newsdesk/newsdesk.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.sstrunk.com/cve/phpCollab_newsdesk.html
CVE ID: CVE-2017-15908 State: PUBLISHED Published: 2017-10-26T14:00:00 Last Updated: 2024-08-05T20:04:50.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039662 - http://www.securityfocus.com/bid/101600 - https://github.com/systemd/systemd/pull/7184 - https://usn.ubuntu.com/3558-1/ - https://bugs.launchpad.net/ubuntu/+source/sy
s://github.com/systemd/systemd/pull/7184 - https://usn.ubuntu.com/3558-1/ - https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1725351
CVE ID: CVE-2017-15909 State: PUBLISHED Published: 2017-10-26T03:00:00Z Last Updated: 2024-09-17T01:30:55.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp2.dlink.com/PRODUCTS/DGS-1500-52/REVA/DGS-1500_REVA_FIRMWARE_PATCH_NOTES_2.51.021_EN.pdf - ftp://ftp2.dlink.com/PRODUCTS/DGS-1500-28P/REVA/DGS-1500_REVA_FIRMWARE_PATCH_NOTES_2.51.021_EN.pdf - ftp://ftp2.dlink.com/PRODUCTS/DGS-1500-28/REVA/DGS-1500_REVA_FIRMWARE_PATCH_NOTES_2.51.021_EN.pdf - ftp://ftp2.dlink.com/PRODUCTS/DGS-1500-2
/PRODUCTS/DGS-1500-28/REVA/DGS-1500_REVA_FIRMWARE_PATCH_NOTES_2.51.021_EN.pdf - ftp://ftp2.dlink.com/PRODUCTS/DGS-1500-20/REVA/DGS-1500_REVA_FIRMWARE_PATCH_NOTES_2.51.021_EN.pdf
CVE ID: CVE-2017-15911 State: PUBLISHED Published: 2017-10-26T17:00:00 Last Updated: 2024-08-05T20:04:50.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. Additional Analyst Notes: - CVE Program Container: References: - https://becomepentester.blogspot.ae/2017
e application. Additional Analyst Notes: - CVE Program Container: References: - https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html - https://issues.igniterealtime.org/browse/OF-1417
CVE ID: CVE-2017-15913 State: PUBLISHED Published: 2018-01-08T03:00:00 Last Updated: 2024-08-05T20:04:50.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Installer in Whale allows DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://bugbounty.whale.naver.com/en/halloffame - https://cve.naver.com/detail/cve-2017-15913.html
CVE ID: CVE-2017-15914 State: PUBLISHED Published: 2018-02-08T23:00:00 Last Updated: 2024-08-05T20:04:50.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3. Additional Analyst Notes: - CVE Program Container: References: - http://borgbackup.readthedocs.io/en/stable/changes.html#version-1-1-3-2017-11-27
CVE ID: CVE-2017-15917 State: PUBLISHED Published: 2017-10-26T17:00:00Z Last Updated: 2024-09-16T22:09:05.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Paessler PRTG Network Monitor 17.3.33.2830, it's possible to create a Map as a read-only user, by forging a request and sending it to the server. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issue-on-prtg-network-manager-ada65b45d37b
CVE ID: CVE-2017-15918 State: PUBLISHED Published: 2017-11-01T17:00:00 Last Updated: 2024-08-05T20:04:50.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks. Additional Analyst Notes: - CVE Program Container: References: - https://m4.rkw.io/blog/cve201715918-sera-12-local-root-privesc-and-password-disclosure.html - https://www.exploit-db.com/exploits/43221/
CVE ID: CVE-2017-15919 State: PUBLISHED Published: 2017-10-26T18:00:00 Last Updated: 2024-08-05T20:04:50.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2017/10/zero-day-vulnerability-ultimate-form-builder-lite/ - https://wpvulndb.com/vulnerabilities/8935 - http://www.securityfocus.com/bid/101604 - https://wordpress.org/plugins/ultimate-form-builder-lite/#developers
CVE ID: CVE-2017-15920 State: PUBLISHED Published: 2017-10-30T15:00:00 Last Updated: 2024-08-05T20:04:50.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnerability that gets triggered when sending an operation to ioctl 0x80002054. This is due to the input buffer being NULL or the input buffer size being 0 as they are not validated. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43058/ - http://packetstormsecurity.com/files/144786/Watchdog-Development-Anti-Malware-Online-Security-Pro-NULL-P
ploits/43058/ - http://packetstormsecurity.com/files/144786/Watchdog-Development-Anti-Malware-Online-Security-Pro-NULL-Pointer-Dereference.html
CVE ID: CVE-2017-15921 State: PUBLISHED Published: 2017-10-30T15:00:00 Last Updated: 2024-08-05T20:04:50.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnerability that gets triggered when sending an operation to ioctl 0x80002010. This is due to the input buffer being NULL or the input buffer size being 0 as they are not validated. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43058/ - http://packetstormsecurity.com/files/144786/Watchdog-Development-Anti-Malware-Online-Security-Pro-NULL-P
CVE ID: CVE-2017-15922 State: PUBLISHED Published: 2017-10-26T18:00:00 Last Updated: 2024-08-05T20:04:50.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101595 - http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00008.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
CVE ID: CVE-2017-15923 State: PUBLISHED Published: 2017-11-15T16:00:00 Last Updated: 2024-08-05T20:04:50.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: Konversation 1.4.x, 1.5.x, 1.6.x, and 1.7.x before 1.7.3 allow remote attackers to cause a denial of service (crash) via vectors related to parsing of IRC color formatting codes. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4033 - https://cgit.kde.org/konversation.git/commit/?h=1.7&id=6a7f59ee1b9dbc6e5cf9e5f3b306504d02b73ef0 - https://lists.debian.org/debian-lts-announce/2017/11/msg00020.html - https://konversation.kde.org/
CVE ID: CVE-2017-15924 State: PUBLISHED Published: 2017-10-27T16:00:00 Last Updated: 2024-08-05T20:04:50.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shadowsocks/shadowsocks-libev/commit/c67d275803dc6ea22c558d06b1f7ba9f94cd8de3 - https://github.com/shadowsocks/shadowsocks-libev/issues/1734 - https://www.x41-dsec.de/lab/advisor
d06b1f7ba9f94cd8de3 - https://github.com/shadowsocks/shadowsocks-libev/issues/1734 - https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/ - http://www.debian.org/security/2017/dsa-4009 - http://openwall.com/lists/oss-security/2017/10/13/2
CVE ID: CVE-2017-15928 State: PUBLISHED Published: 2017-10-27T17:00:00Z Last Updated: 2024-09-16T18:14:31.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ohler55/ox/issues/194 - https://rubygems.org/gems/ox/versions/2.8.0
CVE ID: CVE-2017-15930 State: PUBLISHED Published: 2017-10-27T18:00:00 Last Updated: 2024-08-05T20:04:50.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26, a Null Pointer Dereference occurs while transferring JPEG scanlines, related to a PixelPacket pointer. Additional Analyst Notes: - CVE Program Container: References: - http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=6fc54b6d2be8 - https://www.debian.org/security/2018/dsa-4321 - http://www.securityfocus.com/bid/101607 - http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=da135eaedc3b - https://sourceforge.net/p/graphicsmagick/bugs/