Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-0927 State: PUBLISHED Published: 2018-03-21T20:00:00 Last Updated: 2024-08-05T13:25:16.907Z Vendors: GitLab Products: GitLab Community and Enterprise Editions Problem Types: CWE-285 Description: Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deployment keys by guest users. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/37594 - https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
CVE ID: CVE-2017-0928 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T04:04:20.635Z Vendors: HackerOne Products: html-janitor node module Problem Types: CWE-642 Description: html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/308158 - https://github.com/guardian/html-janitor/issues/35
CVE ID: CVE-2017-0929 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-16T22:45:56.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dnnsoftware/Dnn.Platform/commit/d3953db85fee77bb5e6383747692c507ef8b94c3
CVE ID: CVE-2017-0930 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T16:32:58.291Z Vendors: HackerOne Products: augustine node module Problem Types: CWE-22 Description: augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/296282
CVE ID: CVE-2017-0931 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T03:59:01.542Z Vendors: HackerOne Products: html-janitor node module Problem Types: CWE-79 Description: html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/guardian/html-janitor/issues/34 - https://hackerone.com/reports/308155
CVE ID: CVE-2017-0932 State: PUBLISHED Published: 2018-03-22T14:00:00Z Last Updated: 2024-09-17T02:27:44.980Z Vendors: Ubiquiti Networks Products: EdgeRouter X Problem Types: CWE-269 Description: Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation on the input of the Feature functionality. An attacker with access to an operator (read-only) account and ssh connection to the devices could escalate privileges to admin (root) access in the system. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/239719 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-E
ainer: References: - https://hackerone.com/reports/239719 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-security-release-v1-9-7-hotfix-3/ba-p/2054117
CVE ID: CVE-2017-0933 State: PUBLISHED Published: 2018-03-22T14:00:00Z Last Updated: 2024-09-16T19:41:56.531Z Vendors: Ubiquiti Networks Products: EdgeRouter X Problem Types: CWE-352 Description: Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-only) account could lure an admin (root) user to access the attacker-controlled page, allowing the attacker to gain admin privileges in the system. Additional Analyst Notes: - CVE Program Container: References: - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-9-1-1/ba-p/1910524 - https://hackerone.com/r
ity.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-9-1-1/ba-p/1910524 - https://hackerone.com/reports/240098
CVE ID: CVE-2017-0934 State: PUBLISHED Published: 2018-03-22T14:00:00Z Last Updated: 2024-09-17T04:23:56.390Z Vendors: Ubiquiti Networks Products: EdgeRouter X Problem Types: CWE-269 Description: Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/241044 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-so
ences: - https://hackerone.com/reports/241044 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-release-v1-9-1-1/ba-p/1910524
CVE ID: CVE-2017-0935 State: PUBLISHED Published: 2018-03-22T14:00:00Z Last Updated: 2024-09-17T01:11:19.422Z Vendors: Ubiquiti Networks Products: EdgeRouter X Problem Types: CWE-269 Description: Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/242407 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-
erences: - https://hackerone.com/reports/242407 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeRouter-software-security-release-v1-9-7-hotfix-3/ba-p/2054117
CVE ID: CVE-2017-0936 State: PUBLISHED Published: 2018-03-28T20:00:00Z Last Updated: 2024-09-16T21:58:27.852Z Vendors: Nextcloud Products: Nextcloud Server Problem Types: CWE-639 Description: Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/297751 - https://nextcloud.com/security/advisory/?id=nc-sa-2018-0
Container: References: - https://hackerone.com/reports/297751 - https://nextcloud.com/security/advisory/?id=nc-sa-2018-001
CVE ID: CVE-2017-0938 State: PUBLISHED Published: 2019-02-12T22:00:00Z Last Updated: 2024-09-16T18:49:35.479Z Vendors: HackerOne Products: airMAX, EdgeMAX Problem Types: CWE-400 Description: Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks. Additional Analyst Notes: - CVE Program Container: References: - https://community.ubnt.com/t5/airMAX-Updates-Blog/airOS-v6-0-7-Has-Been-Released/ba-p/2056522 - https://hackerone.com/reports/221625 - https://community.ubnt.com/t5/airMAX-Updates-Blog/airOS-v8-3-2-Has-Been-Released/ba-p/2049215
CVE ID: CVE-2017-0981 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0982 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0983 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0984 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0985 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0986 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0987 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0988 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0989 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0990 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0991 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0992 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0993 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0994 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0995 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0996 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0997 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0998 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-0999 State: REJECTED Published: N/A Last Updated: 2023-02-22T00:00:00 Description: No description available.
CVE ID: CVE-2017-1000000 State: REJECTED Published: 2019-02-19T15:00:00 Last Updated: 2019-02-19T14:57:01 Description: No description available.
CVE ID: CVE-2017-1000001 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:26.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fedora-infra/fedmsg/blob/0.18.2/CHANGELOG.rst
CVE ID: CVE-2017-1000002 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:25.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99599 - http://www.atutor.ca/atutor/mantis/view.php?id=5681 - http://www.atutor.ca/atutor/mantis/changelog_page.php?ve
d/99599 - http://www.atutor.ca/atutor/mantis/view.php?id=5681 - http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55
CVE ID: CVE-2017-1000003 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:26.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Module component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to a incorrect access control check vulnerability in the Alternative Content component resulting in privilege escalation. Additional Analyst Notes: -
check vulnerability in the Alternative Content component resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99599 - http://www.atutor.ca/atutor/mantis/view.php?id=5681 - http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55
CVE ID: CVE-2017-1000004 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:25.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook compon
ages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99599 - http://www.atutor.ca/atutor/mantis/view.php?id=5681 - http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55
CVE ID: CVE-2017-1000005 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:25.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping of data (stealing data). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/osalabs/phpminiadmin
CVE ID: CVE-2017-1000006 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:26.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue. Additional Analyst Notes: - CVE Program Container: References: - http://help.plot.ly/security-advisories/2016-08-08-plotlyjs-xss-advisory/
CVE ID: CVE-2017-1000007 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:26.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/twisted/txaws/issues/24
CVE ID: CVE-2017-1000008 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:26.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xenocrat/chyrp-lite/commit/79bb2de7f57d163d256b6bdb127dc09cfdb6235a
CVE ID: CVE-2017-1000009 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:45:26.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/akeneo/pim-community-dev/blob/master/CHANGELOG-1.4.md#bug-fixes - https://github.com/akeneo/pim-community-dev/blob/1.5/CHANGELOG-1.5.md#bug-fixes-2 - https://github.com/akeneo/pim-community-dev/blob/master/CHANGELOG-1.6.md#bug-fixes-2
CVE ID: CVE-2017-1000010 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:05.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/140365/Audacity-2.1.2-DLL-Hijacking.html - https://github.com/GitHubAssessments/CVE_Assessments_10_2019
CVE ID: CVE-2017-1000011 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:05.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of information Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Samnan/MyWebSQL
CVE ID: CVE-2017-1000012 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:05.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DSB/MySQLDumper
CVE ID: CVE-2017-1000013 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:05.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2017-1 - http://www.securityfocus.com/bid/95720
CVE ID: CVE-2017-1000014 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:05.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2017-3 - http://www.securityfocus.com/bid/95721
CVE ID: CVE-2017-1000015 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95726 - https://www.phpmyadmin.net/security/PMASA-2017-4
CVE ID: CVE-2017-1000016 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:05.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2017-5
CVE ID: CVE-2017-1000017 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:05.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2017-6 - http://www.securityfocus.com/bid/95732
CVE ID: CVE-2017-1000018 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95738 - https://www.phpmyadmin.net/security/PMASA-2017-7
CVE ID: CVE-2017-1000019 State: REJECTED Published: 2017-05-07T20:00:00Z Last Updated: 2024-09-17T02:01:03.777Z Description: No description available.
CVE ID: CVE-2017-1000020 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos Embedded Web Servers used by Multiple Routers and Home devices, while sending SYN Flood or FIN Flood packets fails to validate and handle the packets and does not ask for any sign of authentication resulting in Authentication Bypass. An attacker can take complete advantage of this bug and take over the device remotely or locally. The bug has been successfully tested and reproduced in some versions of SOHO
take over the device remotely or locally. The bug has been successfully tested and reproduced in some versions of SOHO Routers manufactured by TOTOLINK, GREATEK and others." Additional Analyst Notes: - CVE Program Container: References: - http://ecos.sourceware.org/ecos/problemreport.html
CVE ID: CVE-2017-1000021 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. Additional Analyst Notes: - CVE Program Container: References: - http://blog.randorisec.fr/logicaldoc-from-guest-to-root/
CVE ID: CVE-2017-1000022 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:05.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - http://blog.randorisec.fr/logicaldoc-from-guest-to-root/
CVE ID: CVE-2017-1000023 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document. Additional Analyst Notes: - CVE Program Container: References: - http://blog.randorisec.fr/logicaldoc-from-guest-to-root/
CVE ID: CVE-2017-1000024 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission Additional Analyst Notes: - CVE Program Container: References: - https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html
CVE ID: CVE-2017-1000025 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resulting in the remote exfiltration of stored passwords for a selected set of websites. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.gnome.org/show_bug.cgi?id=752738 - https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/silver
CVE ID: CVE-2017-1000026 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chef/mixlib-archive/blob/master/CHANGELOG.md
CVE ID: CVE-2017-1000027 State: PUBLISHED Published: 2017-07-13T20:00:00 Last Updated: 2024-08-05T21:53:06.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access. Additional Analyst Notes: - CVE Program Container: References: - https://forums.contribs.org/index.php/topic%2C52838.0.html - https://cp270.wordpress.com/2017/02/02/security-advisory-open-url-redirect-in-sme-server/