Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-5913 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5914 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5915 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5916 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:49.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5917 State: REJECTED Published: 2017-05-05T07:04:00 Last Updated: 2017-05-05T07:57:01 Description: No description available.
CVE ID: CVE-2017-5918 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5919 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T15:11:48.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-5923 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-05T15:11:49.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VirusTotal/yara/issues/597 - http://www.securityfocus.com/bid/98080 - https://github.com/VirusTotal/yara/commit/ab906da53ff2a68c6fd6d1fa73f2b7c7bf0bc636
CVE ID: CVE-2017-5924 State: PUBLISHED Published: 2017-04-03T05:44:00 Last Updated: 2024-08-05T15:18:48.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VirusTotal/yara/commit/7f02eca670f29c00a1d2c305e96febae6ce5d37b - http://www.securityfocus.com/bid/98075 - https://github.com/VirusTotal/yara/issues/593
CVE ID: CVE-2017-5925 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:18:48.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96452 - http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf - https://www.vusec.net/projects/anc
CVE ID: CVE-2017-5926 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:18:48.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf - http://www.securityfocus.com/bid/96457 - https://www.vusec.net/projects/anc
CVE ID: CVE-2017-5927 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:18:48.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern ARM processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf - https://www.vusec.net/projects/anc - http://www.securityfocus.com/bid/96459
CVE ID: CVE-2017-5928 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:18:48.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 protection mechanism in place, which makes it easier for remote attackers to conduct AnC attacks via crafted JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf - http://www.securityfocus.co
gram Container: References: - http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf - http://www.securityfocus.com/bid/97036 - https://www.vusec.net/projects/anc
CVE ID: CVE-2017-5929 State: PUBLISHED Published: 2017-03-13T06:14:00 Last Updated: 2024-08-05T15:18:48.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1832 - https://access.redhat.com/errata/RHSA-2017:1675 - https://access.redhat.com/errata/RHSA-2018:2927 - https://logback.qos.ch/news.html - https://access.redhat.com/errata/RHSA-2017:1676 - https://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203%40%3Ccommits
A-2017:1676 - https://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E - https://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169%40%3Cdev.mnemonic.apache.org%3E - https://lists.apache.org/thre
bb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169%40%3Cdev.mnemonic.apache.org%3E - https://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc%40%3Cdev.mnemonic.apache.org%3E - https://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790%40%3Ccommits.mnemonic.apache.org%3E - https://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02
b%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79%40%3Ccommits.cassandra.apach
ps://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6%40%3Ccommits.cassandra.apache.org%3E
CVE ID: CVE-2017-5930 State: PUBLISHED Published: 2017-03-20T16:00:00 Last Updated: 2024-08-05T15:18:48.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/postfixadmin/mailman/message/35646827/ - https://github.com/postfixadmin/postfixadmin/blob/postfixadmin-3.0.2/CHANGELOG.TXT - http://www.securityfocus.com/bid/96142 - http://lists.opensuse.org/opensuse-updates/2017-02/msg00076.html - htt
OG.TXT - http://www.securityfocus.com/bid/96142 - http://lists.opensuse.org/opensuse-updates/2017-02/msg00076.html - http://www.openwall.com/lists/oss-security/2017/02/08/1 - https://github.com/postfixadmin/postfixadmin/pull/23 - http://www.openwall.com/lists/oss-security/2017/02/09/1
CVE ID: CVE-2017-5931 State: PUBLISHED Published: 2017-03-27T15:00:00 Last Updated: 2024-08-05T15:18:48.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg01368.html - http://www.securityfocus.com/bid/96141 - https://security.gentoo.org/glsa/201702-28 - http://git.qemu
01/msg01368.html - http://www.securityfocus.com/bid/96141 - https://security.gentoo.org/glsa/201702-28 - http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=a08aaff811fb194950f79711d2afe5a892ae03a4 - http://www.openwall.com/lists/oss-security/2017/02/08/2 - https://bugzilla.redhat.com/show_bug.cgi?id=1420092
CVE ID: CVE-2017-5932 State: PUBLISHED Published: 2017-03-27T15:00:00 Last Updated: 2024-08-05T15:18:48.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter. Additional Analyst Notes: - CVE Program Container: References: - http://git.savannah.gnu.org/cgit/bash.git/commit/?id=4f747edc625815f449048579f6e65869914dd715 - https://lists.gnu.org/archive/html/bug-bash/2017-01/msg00034.html - http://www.openwall.com/lists/oss-security/2017/02/08/3 - http://www.securityfocus.com/bid/96136
CVE ID: CVE-2017-5933 State: PUBLISHED Published: 2017-02-08T16:00:00 Last Updated: 2024-08-05T15:18:48.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces, which makes it marginally easier for remote attackers to obtain the GCM authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nonce-disrespect/nonce-disrespect - https://support.citrix.com/article/CTX220329
iner: References: - https://github.com/nonce-disrespect/nonce-disrespect - https://support.citrix.com/article/CTX220329 - http://www.securityfocus.com/bid/96151
CVE ID: CVE-2017-5934 State: PUBLISHED Published: 2018-10-15T19:00:00 Last Updated: 2024-08-05T15:18:48.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024 - https://www.debian.org/security/2018/dsa-4318 - http://moinmo.in/SecurityFixes - https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html - https://usn.ubuntu.com/3794-1/ - http://
ityFixes - https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html - https://usn.ubuntu.com/3794-1/ - http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00024.html
CVE ID: CVE-2017-5936 State: PUBLISHED Published: 2017-04-12T22:00:00 Last Updated: 2024-08-05T15:18:48.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96182 - https://bugs.launchpad.net/nova-lxd/+bug/1656847 - http://www.ubuntu.com/usn/USN-3195-1 - https://github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2 - http://www.openwall.com/lists/oss-security/201
.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2 - http://www.openwall.com/lists/oss-security/2017/02/09/3
CVE ID: CVE-2017-5937 State: PUBLISHED Published: 2017-03-15T19:00:00 Last Updated: 2024-08-05T15:18:48.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1420246 - http://www.securityfocus.com/bid/96180 - http://www.openwall.com/lists/oss-security/2017/02/09/4 - https://cgit.freedesktop.org/virglrenderer/commit/?id=48f67f60967f963b698
openwall.com/lists/oss-security/2017/02/09/4 - https://cgit.freedesktop.org/virglrenderer/commit/?id=48f67f60967f963b698ec8df57ec6912a43d6282
CVE ID: CVE-2017-5938 State: PUBLISHED Published: 2017-03-15T14:00:00 Last Updated: 2024-08-05T15:18:49.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/viewvc/viewvc/releases/tag/1.0.14 - https://github.com/viewvc/viewvc/issues/137 - http://www.securityfocus.com/bid/96185 - https://github.com/viewvc/viewvc/commit/9dcfc7daa4c940992920d3b2fbd317da20e44aad - https://github.com/viewvc
bid/96185 - https://github.com/viewvc/viewvc/commit/9dcfc7daa4c940992920d3b2fbd317da20e44aad - https://github.com/viewvc/viewvc/releases/tag/1.1.26 - http://www.openwall.com/lists/oss-security/2017/02/09/6 - http://www.debian.org/security/2017/dsa-3784 - http://lists.opensuse.org/opensuse-updates/2017-02/msg00082.html
CVE ID: CVE-2017-5940 State: PUBLISHED Published: 2017-02-09T18:00:00 Last Updated: 2024-08-05T15:18:48.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netblue30/firejail/commit/b8a4ff9775318ca5e679183884a6a63f3da8f863 -
Program Container: References: - https://github.com/netblue30/firejail/commit/b8a4ff9775318ca5e679183884a6a63f3da8f863 - https://security.gentoo.org/glsa/201702-03 - https://github.com/netblue30/firejail/commit/38d418505e9ee2d326557e5639e8da49c298858f - https://firejail.wordpress.com/download-2/release-notes/ - http://www.openwall.com/lists/oss-security/2017/01/31/16 - https://github.com/netblue30/firejail/commit/903fd8a0789ca3cc3c21d84cd0282481515592ef - http://www.securityfocus.com/bid/96221
CVE ID: CVE-2017-5941 State: PUBLISHED Published: 2017-02-09T19:00:00 Last Updated: 2024-08-05T15:18:48.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE). Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/311 - https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/ - http://www.securityfocus.com/bid/96225 - http://pac
/exploiting-node-js-deserialization-bug-for-remote-code-execution/ - http://www.securityfocus.com/bid/96225 - http://packetstormsecurity.com/files/161356/Node.JS-Remote-Code-Execution.html - http://packetstormsecurity.com/files/163222/Node.JS-Remote-Code-Execution.html
CVE ID: CVE-2017-5942 State: PUBLISHED Published: 2017-02-10T06:51:00 Last Updated: 2024-08-05T15:18:48.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the context of the user receiving the mail. Additional Analyst Notes: - CVE Program Container: References: - https://cjc.im/advisories/0006/ - http://www.securityfocus.com/bid/96211
CVE ID: CVE-2017-5943 State: PUBLISHED Published: 2017-07-03T16:00:00 Last Updated: 2024-08-05T15:18:48.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016 - http://www.securityfocus.com/bid/99384 - http://www.debian.org/security/2017/dsa-3882
CVE ID: CVE-2017-5944 State: PUBLISHED Published: 2017-07-03T16:00:00 Last Updated: 2024-08-05T15:18:49.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name. Additional Analyst Notes: - CVE Program Container: References: - https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016 - http://www.securityfocus.com/bid/99381 - http://www.debian.org/security/2017/dsa-3882
CVE ID: CVE-2017-5945 State: PUBLISHED Published: 2017-02-10T06:51:00 Last Updated: 2024-08-05T15:18:49.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the PoodLL Filter plugin through 3.0.20 for Moodle. The vulnerability exists due to insufficient filtration of user-supplied data in the "poodll_audio_url" HTTP GET parameter passed to the "filter_poodll_moodle32_2016112802/poodll/mp3recorderskins/brazil/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/justinhunt/moodle-filter_poodll/issues
ditional Analyst Notes: - CVE Program Container: References: - https://github.com/justinhunt/moodle-filter_poodll/issues/23 - http://www.securityfocus.com/bid/96212
CVE ID: CVE-2017-5946 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:18:49.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubyzip/rubyzip/releases - http://www.securityfocus.com/bid/96445 - https://github.com/rubyzip/rubyzip/issues/315 - http://www.debian.org/security/2017/dsa-3801
CVE ID: CVE-2017-5947 State: PUBLISHED Published: 2018-03-29T18:00:00 Last Updated: 2024-08-05T15:18:49.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download (EDL) mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as the Android Bootloader. Additional Analyst Notes: - CVE Program Container: References: - https://alephsecurity.com/vulns/aleph-2017007