Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-6874 State: PUBLISHED Published: 2017-03-14T09:02:00 Last Updated: 2024-08-05T15:41:17.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction between put_ucounts and get_ucounts. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=040757f738e13caaa9c5078bca79aa97e11dde88 - http://www.securityf
.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=040757f738e13caaa9c5078bca79aa97e11dde88 - http://www.securityfocus.com/bid/96856 - https://github.com/torvalds/linux/commit/040757f738e13caaa9c5078bca79aa97e11dde88
CVE ID: CVE-2017-6877 State: PUBLISHED Published: 2017-03-14T09:02:00 Last Updated: 2024-08-05T15:41:17.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SVG file handling in Lutim 0.7.1 and earlier allows remote attackers to inject arbitrary web script. Additional Analyst Notes: - CVE Program Container: References: - https://framagit.org/luc/lutim/issues/38 - https://framagit.org/luc/lutim/commit/4c0df8f8b10122339b908dcd9b1117348b49dcab - http://www.securityfocus.com/bid/96855
CVE ID: CVE-2017-6878 State: PUBLISHED Published: 2017-03-27T15:00:00 Last Updated: 2024-08-05T15:41:17.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Mar/49 - http://www.securityfocus.com/bid/96974 - http://packetstormsecurity.com/files/141689/MetInfo-5.3.15-Cross-Site-Scripting.html
CVE ID: CVE-2017-6880 State: PUBLISHED Published: 2017-03-17T17:00:00 Last Updated: 2024-08-05T15:41:17.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41620/
CVE ID: CVE-2017-6883 State: PUBLISHED Published: 2017-03-14T09:02:00 Last Updated: 2024-08-05T15:41:17.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ConvertToPDF plugin in Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF image. The vulnerability could lead to information disclosure; an attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advi
current process. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-17-133/ - https://www.foxitsoftware.com/support/security-bulletins.php - http://www.securityfocus.com/bid/96870
CVE ID: CVE-2017-6884 State: PUBLISHED Published: 2017-04-06T17:00:00.000Z Last Updated: 2025-10-21T23:55:42.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/41782/
CVE ID: CVE-2017-6885 State: PUBLISHED Published: 2017-05-16T15:00:00 Last Updated: 2024-08-05T15:41:17.696Z Vendors: Flexera Software LLC Products: FlexNet Manager Suite Problem Types: Privilege escalation by locally authenticated users Description: An error when handling certain external commands and services related to the FlexNet Inventory Agent and FlexNet Beacon of the Flexera Software FlexNet Manager Suite 2017 before 2017 R1 and 2014 R3 through 2016 R1 SP1 can be exploited to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://secuniaresearch.flexerasoftware.com/advisories/76223/
CVE ID: CVE-2017-6886 State: PUBLISHED Published: 2017-05-16T15:00:00 Last Updated: 2024-08-05T15:41:17.677Z Vendors: LibRaw Products: LibRaw Problem Types: Denial of Service Description: An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/commit/d7c3d2cb460be10a3ea7b32e9443a83c243b2251 - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-5/ - http://www.securityfocus.com/bid/98605 - https://secuniaresearch.flexerasoftware.com/advisories/75737/ - http://www.debian.org/security/2017/dsa-395
/bid/98605 - https://secuniaresearch.flexerasoftware.com/advisories/75737/ - http://www.debian.org/security/2017/dsa-3950
CVE ID: CVE-2017-6887 State: PUBLISHED Published: 2017-05-16T15:00:00 Last Updated: 2024-08-05T15:41:17.692Z Vendors: LibRaw Products: LibRaw Problem Types: Memory Corruption, System Compromise and Denial of Service Description: A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98592 - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-6/ - http
: - http://www.securityfocus.com/bid/98592 - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-6/ - https://secuniaresearch.flexerasoftware.com/advisories/75737/ - http://www.debian.org/security/2017/dsa-3950 - https://github.com/LibRaw/LibRaw/commit/d7c3d2cb460be10a3ea7b32e9443a83c243b2251
CVE ID: CVE-2017-6888 State: PUBLISHED Published: 2018-04-25T21:00:00 Last Updated: 2024-08-05T15:41:17.756Z Vendors: FLAC Products: FLAC Problem Types: Denial of Service Description: An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file. Additional Analyst Notes: - CVE Program Container: References: - https://secuniaresearch.flexerasoftware.com/advisories/82639/ - https://git.xiph.org/?p=flac.git%3Ba=commit%3Bh=4f47b63e9c971e6391590caf00a0f2a5ed612e67 - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-7/ - https://lists.debian.org/debian-lts-ann
d612e67 - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-7/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00001.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33W6XZAAEJYRGU3XYHRO7XSYEA7YACUB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNZYTAU5UWBVXVJ4VHDWPR66ZVDLQZRE/
CVE ID: CVE-2017-6889 State: PUBLISHED Published: 2017-05-15T18:00:00 Last Updated: 2024-08-05T15:41:17.776Z Vendors: LibRaw Products: LibRaw-demosaic-pack-GPL2 Problem Types: Heap-based buffer overflow Description: An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://secuniaresearch.flexerasoftware.com/advisories/75000/ - https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2/commit/194f592e205990ea8fce72b6c571c14350aca716
CVE ID: CVE-2017-6890 State: PUBLISHED Published: 2017-05-15T18:00:00 Last Updated: 2024-08-05T15:41:17.747Z Vendors: LibRaw Products: LibRaw-demosaic-pack-GPL2 Problem Types: Stack-based buffer overflow Description: A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://secuniaresearch.flexerasoftware.com/advisories/75000/ - https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2/commit/194f592e205990ea8fce72b6c571c14350aca716
CVE ID: CVE-2017-6891 State: PUBLISHED Published: 2017-05-22T19:00:00 Last Updated: 2024-08-05T15:41:17.677Z Vendors: Flexera Software LLC Products: GnuTLS libtasn1 Problem Types: Stack-based buffer overflow leading to system compromise Description: Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201710-11 - http://www.debian.org/security/2017/dsa-3861 - https://secuniaresearch.flexe
ttps://security.gentoo.org/glsa/201710-11 - http://www.debian.org/security/2017/dsa-3861 - https://secuniaresearch.flexerasoftware.com/advisories/76125/ - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/ - http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=5520704d075802df25ce4ffccc010ba1641bd484 - http://www.securityfocus.com/bid/98641 - http://www.securitytracker.com/id/1038619 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29
a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2017-6892 State: PUBLISHED Published: 2017-06-12T16:00:00 Last Updated: 2024-08-05T15:41:17.695Z Vendors: Flexera Software LLC Products: libsndfile Problem Types: Out-of-bounds read memory access leading to information disclosure Description: In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/ - https://secuniaresearch.flexerasoftware.com/advisories/76717/ - https://github.com/erikd/libsndfile/commit/f833c53cb596e9e179
://secuniaresearch.flexerasoftware.com/advisories/76717/ - https://github.com/erikd/libsndfile/commit/f833c53cb596e9e1792949f762e0b33661822748 - https://security.gentoo.org/glsa/201811-23 - https://usn.ubuntu.com/4013-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00030.html
CVE ID: CVE-2017-6894 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T17:20:35.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in FlexNet Manager Suite releases 2015 R2 SP3 and earlier (including FlexNet Manager Platform 9.2 and earlier) that affects the inventory gathering components and can be exploited by local users to perform certain actions with elevated privileges on the local system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.flexera.com/t5/FlexNet-Manager-Knowledge-Base/A-vulnerability-exists-in-FlexNet-Manager-Suite-release-2015-R2/ta-p/1891
CVE ID: CVE-2017-6895 State: PUBLISHED Published: 2017-03-23T20:00:00 Last Updated: 2024-08-05T15:41:17.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml. Additional Analyst Notes: - CVE Program Container: References: - https://secur1tyadvisory.wordpress.com/2017/03/15/usb-pratirodh-xml-external-entity-injection-vulnerability/ - http://seclists.org/fulldisclosure/2017/Mar/42 - http://packetstormsecurity.com/files/141652/USB-Pratirodh-XXE-Injection.html - http://www.securityfocus.com/bid/96936
CVE ID: CVE-2017-6896 State: PUBLISHED Published: 2017-03-14T20:00:00 Last Updated: 2024-08-05T15:41:17.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Base64-encoded session cookie value. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/0B6715xUqH18MX29uRlpaSVJ4OTA/view?usp=sharing - http://seclists.org/fulldisclosure/2017/Mar/52 - https://packetstormsecurity.com/files/141693/digisol-escalate.txt - https://www.exploit-db.com/exploits/41633/ - https://www
s://packetstormsecurity.com/files/141693/digisol-escalate.txt - https://www.exploit-db.com/exploits/41633/ - https://www.indrajithan.com/DIGISOL_router_previlage_escaltion
CVE ID: CVE-2017-6899 State: PUBLISHED Published: 2017-06-16T17:00:00 Last Updated: 2024-08-05T15:41:17.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The msm_bus_dbg_update_request_write function in drivers/platform/msm/msm_bus/msm_bus_dbg.c in android_kernel_huawei_msm8916 through 2017-06-16 in LineageOS, and possibly other kernels for MSM devices, allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted /sys/kernel/debug/msm-bus-dbg/client-data/update-request write request. Additional Analyst Notes: - CVE Program Container: References: - http://blog.secret-team.cn/index.php/archives/5/ - http://www.securityfocus.com/bid/99107
CVE ID: CVE-2017-6900 State: PUBLISHED Published: 2019-07-03T16:28:27 Last Updated: 2024-08-05T15:41:17.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass, the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to this, VAL0 and VAL1 should be sanitised to ensure they do not contain malicious characters. Passing it the username of '-' will cause it to time out and log the user in because of poor error handling. This will log the attacker in as an
f '-' will cause it to time out and log the user in because of poor error handling. This will log the attacker in as an administrator where the telnet / ssh services can be enabled, and the credentials for local users can be reset. Also, login.cgi accepts the username as a GET parameter, so login can be achieved by browsing to the /cgi-bin/login.cgi?username=-%20a URI. Additional Analyst Notes: - CVE Program Container: References: - https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/ - https://web.archive.org/web/20170205100702/https://blog.synack.co.uk/2017/01/31/my-first-exploit-db-post/
CVE ID: CVE-2017-6902 State: REJECTED Published: 2017-03-14T21:00:00 Last Updated: 2017-03-17T08:57:01 Description: No description available.
CVE ID: CVE-2017-6903 State: PUBLISHED Published: 2017-03-14T22:00:00 Last Updated: 2024-08-05T15:41:17.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwa
ecutable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998 - http://www.debian.org/security/2017/dsa-3812 - https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1 - https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372 - https://github.com/JACoders/OpenJK/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7 - https://github.com/ioquake/ioq3/commit/f61fe5f6a0419ef4a88d46a128052f2
commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7 - https://github.com/ioquake/ioq3/commit/f61fe5f6a0419ef4a88d46a128052f2e8352e85d - https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/ - https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd - https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857699
CVE ID: CVE-2017-6905 State: PUBLISHED Published: 2017-03-15T00:00:00 Last Updated: 2024-08-05T15:41:17.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "concrete5-legacy-master/web/concrete/tools/files/search_dialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/concrete5/concrete5-legacy/issues/1947 - https://github.com/concrete5/concrete5-legacy/commit/2b16399ce3
ps://github.com/concrete5/concrete5-legacy/issues/1947 - https://github.com/concrete5/concrete5-legacy/commit/2b16399ce3e962a8c27fb3ec14bc8e855d65b63a - https://github.com/Mnkras/concrete5/commit/3eab581ab670982676e9dabddc9ad439391174ee - http://www.securityfocus.com/bid/96891
CVE ID: CVE-2017-6906 State: PUBLISHED Published: 2017-03-15T00:00:00 Last Updated: 2024-08-05T15:41:17.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SiberianCMS before 4.10.0. The vulnerability exists due to insufficient filtration of user-supplied data (log) passed to the "SiberianCMS-master/errors/500.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96898 - https://github.com/Xtraball/SiberianCMS/issues/217
CVE ID: CVE-2017-6907 State: PUBLISHED Published: 2017-03-15T00:00:00 Last Updated: 2024-08-05T15:41:17.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open.GL before 2017-03-13. The vulnerability exists due to insufficient filtration of user-supplied data (content) passed to the "Open.GL-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96897 - https://github.com/Overv/Open.GL/issues/56
CVE ID: CVE-2017-6908 State: PUBLISHED Published: 2017-03-15T00:00:00 Last Updated: 2024-08-05T15:41:17.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selector_data.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/concrete5/concrete5-legacy/commit/62046f511fc02ad783ad170404c80db3c69f0408 - http://www.securityfocus.com/bid/96891
.com/concrete5/concrete5-legacy/commit/62046f511fc02ad783ad170404c80db3c69f0408 - http://www.securityfocus.com/bid/96891 - https://github.com/concrete5/concrete5-legacy/issues/1948
CVE ID: CVE-2017-6909 State: PUBLISHED Published: 2017-03-15T00:00:00 Last Updated: 2024-08-05T15:41:17.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Shimmie <= 2.5.1. The vulnerability exists due to insufficient filtration of user-supplied data (log) passed to the "shimmie2-master/ext/chatbox/history/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shish/shimmie2/issues/597 - http://www.securityfocus.com/bid/96932
CVE ID: CVE-2017-6910 State: PUBLISHED Published: 2018-04-12T15:00:00 Last Updated: 2024-08-05T15:41:17.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-15, 4.0.6 before hotfix-4, 4.0.7, 4.0.9 before hotfix-19, 4.4.x before 4.4.2 hotfix-1, 4.5.x before 4.5.3 hotfix-1, and Gateway Community and Enterprise Editions before 5.6.0 allow remote attackers to bypass intended access restrictions and obtain sensitive information via vectors related to HTTP request handling. Additional Analyst Notes: - CVE Program Container: References: - https://supp
vectors related to HTTP request handling. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaazing.com/hc/en-us/articles/115004752368
CVE ID: CVE-2017-6911 State: PUBLISHED Published: 2017-03-23T20:00:00 Last Updated: 2024-08-05T15:41:17.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96970 - http://packetstormsecurity.com/files/141651/USB-Pratirodh-Insecure-Password-Storage.html - http://seclists.org/fulldisclosure/2017/Mar/43 - http://www.secu
s/141651/USB-Pratirodh-Insecure-Password-Storage.html - http://seclists.org/fulldisclosure/2017/Mar/43 - http://www.securityfocus.com/archive/1/540289/100/0/threaded
CVE ID: CVE-2017-6912 State: PUBLISHED Published: 2019-05-22T19:19:21 Last Updated: 2024-08-05T15:41:17.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - http://open-xchange.com - https://documentation.open-xchange.com/7.10.0/release-notes/release-notes.html
CVE ID: CVE-2017-6913 State: PUBLISHED Published: 2018-09-18T20:00:00 Last Updated: 2024-08-05T15:41:17.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the event attribute in a time tag. Additional Analyst Notes: - CVE Program Container: References: - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_4133_7.6.3_2017-05-15.pdf - https://github.com/gquere/CVE-2017-6913