Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
of service condition. This issue only affects the following platforms: (1) EX2200, EX3300, XRE200 (2) MX Series routers with MPC7E/8E/9E PFEs installed, and only if 'extended-statistics' are enabled under the [edit chassis] configuration. Affected releases are Juniper Networks Junos OS 14.1 prior to 14.1R8-S5, 14.1R9 on MX Series; 14.1X53 prior to 14.1X53-D46, 14.1X53-D50 on EX2200, EX3300, XRE200; 14.2 prior to 14.2R7-S9, 14.2R8 on MX Series; 15.1 prior to 15.1F5-S8, 15.1F6-S8, 15.1R5-S3, 15.1R6 on MX Series; 16.1 prior to 16.1R4-S5, 16.1R5, 16.1R6 on MX Series; 16.1X65 prior to 16.1X65-D45 on EX2200, EX3300, XRE200; 16.2 prior to 16.2R2-S1, 16.2R3 on MX Series; 17.1 prior to 17.1R2-S2, 17.
ior to 16.1X65-D45 on EX2200, EX3300, XRE200; 16.2 prior to 16.2R2-S1, 16.2R3 on MX Series; 17.1 prior to 17.1R2-S2, 17.1R3 on MX Series; 17.2 prior to 17.2R1-S3, 17.2R2 on MX Series; 17.2X75 prior to 17.2X75-D50 on MX Series; 17.3 prior to 17.3R1-S1, 17.3R2 on MX Series. No other Juniper Networks products or platforms are affected by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10814
CVE ID: CVE-2017-10612 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-17T02:26:17.415Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos Space Problem Types: Persistent cross site scripting vulnerability Description: A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malicious Javascript or HTML which may be used to steal information or perform actions as other Junos Space users or administrators. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. Additional Analyst Notes: - CVE Program Container
eleases are Juniper Networks Junos Space all versions prior to 17.1R1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10826 - http://www.securityfocus.com/bid/101256
CVE ID: CVE-2017-10613 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-16T17:03:06.624Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: kernel hang, resource consumption Description: A vulnerability in a specific loopback filter action command, processed in a specific logical order of operation, in a running configuration of Juniper Networks Junos OS, allows an attacker with CLI access and the ability to initiate remote sessions to the loopback interface with the defined action, to hang the kernel. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D55; 12.3X48 pr
ned action, to hang the kernel. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D55; 12.3X48 prior to 12.3X48-D35; 14.1 prior to 14.1R8-S4, 14.1R9; 14.1X53 prior to 14.1X53-D40; 14.2 prior to 14.2R4-S9, 14.2R7-S8, 14.2R8; 15.1 prior to 15.1F5-S3, 15.1F6, 15.1R4; 15.1X49 prior to 15.1X49-D60; 15.1X53 prior to 15.1X53-D47; 16.1 prior to 16.1R2. No other Juniper Networks products or platforms are affected by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10816
CVE ID: CVE-2017-10614 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-16T16:48:37.837Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Juniper Networks Products: Junos OS Problem Types: resource consumption, denial of service Description: A vulnerability in telnetd service on Junos OS allows a remote attacker to cause a limited memory and/or CPU consumption denial of service attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D45; 12.3X48 prior to 12.3X48-D30; 14.1 prior to 14.1R4-S9, 14.1R8; 14.2 prior to 14.2R6; 15.1 prior to 15.1F5, 15.1R3;
D45; 12.3X48 prior to 12.3X48-D30; 14.1 prior to 14.1R4-S9, 14.1R8; 14.2 prior to 14.2R6; 15.1 prior to 15.1F5, 15.1R3; 15.1X49 prior to 15.1X49-D40; 15.1X53 prior to 15.1X53-D232, 15.1X53-D47. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10817
CVE ID: CVE-2017-10615 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-16T23:30:38.181Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: remote code execution vulnerability Description: A vulnerability in the pluggable authentication module (PAM) of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM. Affected Juniper Networks Junos OS releases are: 14.1 from 14.1R5 prior to 14.1R8-S4, 14.1R9; 14.1X53 prior to 14.1X53-D50 on EX and QFX series; 14.2 from 14.2R3
s are: 14.1 from 14.1R5 prior to 14.1R8-S4, 14.1R9; 14.1X53 prior to 14.1X53-D50 on EX and QFX series; 14.2 from 14.2R3 prior to 14.2R7-S8, 14.2R8; No other Junos OS releases are affected by this issue. No other Juniper Networks products are affected by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10818 - http://www.securitytracker.com/id/1040039
CVE ID: CVE-2017-10616 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-17T04:19:11.053Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Juniper Networks Products: Contrail Problem Types: hardcoded credential Description: The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Additional Analyst Notes: - CVE Program Con
combined CVSSv3 score of 5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10819 - https://github.com/orangecertcc/security-research/security/advisories/GHSA-qx9c-49m4-f3vj
CVE ID: CVE-2017-10617 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-17T02:52:26.490Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Juniper Networks Products: Contrail Problem Types: XML External Entity (XXE) vulnerability Description: The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/
o 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10819 - https://github.com/orangecertcc/security-research/security/advisories/GHSA-wjp8-8qf6-vqmc
CVE ID: CVE-2017-10618 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-17T04:04:08.195Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: Denial of service Description: When the 'bgp-error-tolerance' feature &#xe2;&#x80;" designed to help mitigate remote session resets from malformed path attributes &#xe2;&#x80;" is enabled, a BGP UPDATE containing a specifically crafted set of transitive attributes can cause the RPD routing process to crash and restart. Devices with BGP enabled that do not have 'bgp-error-tolerance' configured are not vulnerable to this issue. Affected releases are Juni
P enabled that do not have 'bgp-error-tolerance' configured are not vulnerable to this issue. Affected releases are Juniper Networks Junos OS 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R8-S4, 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D45, 14.1X53-D50; 14.2 prior to 14.2R7-S7, 14.2R8; 15.1 prior to 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D64, 15.1X53-D70; 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R5; 16.2 prior to 16.2R1-S5, 16.2R2; 17.1 prior to 17.1R1-S3, 17.1R2; 17.2 prior to 17.2R1-S2, 17.2R2; 17.2X75 prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue. Add
2, 17.2R2; 17.2X75 prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.juniper.net/documentation/en_US/junos/topics/concept/bgp-error-handling-overview.html - https://kb.juniper.net/JSA10820 - https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/bgp-error-tolerance.html
CVE ID: CVE-2017-10619 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-16T17:27:42.838Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: denial of service Description: When Express Path (formerly known as service offloading) is configured on Juniper Networks SRX1400, SRX3400, SRX3600, SRX5400, SRX5600, SRX5800 in high availability cluster configuration mode, certain multicast packets might cause the flowd process to crash, halting or interrupting traffic from flowing through the device and triggering RG1+ (data-plane) fail-over to the secondary node. Repeated crashes of the flowd process
ough the device and triggering RG1+ (data-plane) fail-over to the secondary node. Repeated crashes of the flowd process may constitute an extended denial of service condition. This service is not enabled by default and is only supported in high-end SRX platforms. Affected releases are Juniper Networks Junos OS 12.3X48 prior to 12.3X48-D45, 15.1X49 prior to 15.1X49-D80 on SRX1400, SRX3400, SRX3600, SRX5400, SRX5600, SRX5800. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10821
CVE ID: CVE-2017-10620 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-16T22:15:01.262Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: insufficient verification Description: Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures to cause service disruptions or make the device not detect certain types of attacks. Affected Junos OS releases are: 12.1X46 prior to 12.1X46-D71; 12.3X48 prior to 12.3X48-D55; 15.1X49 prior to 15.1X49-D110; Additional
s OS releases are: 12.1X46 prior to 12.1X46-D71; 12.3X48 prior to 12.3X48-D55; 15.1X49 prior to 15.1X49-D110; Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10822
CVE ID: CVE-2017-10621 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-16T18:43:34.769Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Juniper Networks Products: Junos OS Problem Types: denial of service Description: A denial of service vulnerability in telnetd service on Juniper Networks Junos OS allows remote unauthenticated attackers to cause a denial of service. Affected Junos OS releases are: 12.1X46 prior to 12.1X46-D71; 12.3X48 prior to 12.3X48-D50; 14.1 prior to 14.1R8-S5, 14.1R9; 14.1X53 prior to 14.1X53-D50; 14.2 prior to 14.2R7-S9, 14.2R8; 15.1 prior to 15.1F2-S16, 15.1F5-S7, 15.1F6-S6, 15.1R5-S2, 15.1R6; 15.1X49 prior to 1
; 14.2 prior to 14.2R7-S9, 14.2R8; 15.1 prior to 15.1F2-S16, 15.1F5-S7, 15.1F6-S6, 15.1R5-S2, 15.1R6; 15.1X49 prior to 15.1X49-D90; 15.1X53 prior to 15.1X53-D47; 16.1 prior to 16.1R4-S1, 16.1R5; 16.2 prior to 16.2R1-S3, 16.2R2; Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10817
CVE ID: CVE-2017-10622 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-17T02:48:01.943Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos Space Problem Types: authentication bypass Description: An authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform may allow a remote unauthenticated network based attacker to login as any privileged user. This issue only affects Junos Space Network Management Platform 17.1R1 without Patch v1 and 16.1 releases prior to 16.1R3. This issue was found by an external security researcher. Additional Analyst Notes: - CVE Program Contai
prior to 16.1R3. This issue was found by an external security researcher. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10824 - http://www.securityfocus.com/bid/101258
CVE ID: CVE-2017-10623 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-17T03:07:21.286Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos Space Problem Types: insufficient verification Description: Lack of authentication and authorization of cluster messages in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to intercept, inject or disrupt Junos Space cluster operations between two nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10826
CVE ID: CVE-2017-10624 State: PUBLISHED Published: 2017-10-13T17:00:00Z Last Updated: 2024-09-16T23:35:54.890Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos Space Problem Types: insufficient verification Description: Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10826 - http://www.securityfocus.com/bid/101255
CVE ID: CVE-2017-10651 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10652 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10653 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10654 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10655 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10656 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10657 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10658 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10659 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10660 State: REJECTED Published: 2018-08-29T21:00:00 Last Updated: 2018-08-29T20:57:01 Description: No description available.
CVE ID: CVE-2017-10661 State: PUBLISHED Published: 2017-08-19T18:00:00 Last Updated: 2024-08-05T17:41:55.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - http://www.securityfocus.com/bid/100215 - https://bugzilla.redhat.com/show_bug.cgi?id=1481136 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.15
15 - https://bugzilla.redhat.com/show_bug.cgi?id=1481136 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.15 - http://www.debian.org/security/2017/dsa-3981 - https://source.android.com/security/bulletin/2017-08-01 - https://github.com/torvalds/linux/commit/1e38da300e1e395a15048b0af1e5305bd91402f6 - https://www.exploit-db.com/exploits/43345/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1e38da300e1e395a15048b0af1e5305bd91402f6 - https://access.redhat.com/errata/RHSA-2018:3096 - https://access.redhat.com/errata/RHSA-2019:4058 - https://access.redhat.com/errata/RHSA-2019:4057 - https://access.redhat.com/errata/RHSA-2020:0036
CVE ID: CVE-2017-10662 State: PUBLISHED Published: 2017-08-19T18:00:00 Last Updated: 2024-08-05T17:41:55.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sanity_check_raw_super function in fs/f2fs/super.c in the Linux kernel before 4.11.1 does not validate the segment count, which allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100215 - https://source.android.com/security/bulletin/2017-08-01 - https://github.com/torvalds/linux/commit/b9dd46188edc2f0d1f37328637860bb65a771124 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b9dd46188edc2
dc2f0d1f37328637860bb65a771124 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b9dd46188edc2f0d1f37328637860bb65a771124 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.1 - https://bugzilla.redhat.com/show_bug.cgi?id=1481146
CVE ID: CVE-2017-10663 State: PUBLISHED Published: 2017-08-19T18:00:00 Last Updated: 2024-08-05T17:41:55.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sanity_check_ckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100215 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=15d3042a937c13f5d9244241c7a9c8416ff6e82a - https://bugzilla.redhat.com/show_bug.cgi?id=1481149 - https://github.com/torvalds/linux/commit/15d3042a937c
416ff6e82a - https://bugzilla.redhat.com/show_bug.cgi?id=1481149 - https://github.com/torvalds/linux/commit/15d3042a937c13f5d9244241c7a9c8416ff6e82a - https://source.android.com/security/bulletin/2017-08-01 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.4
CVE ID: CVE-2017-10664 State: PUBLISHED Published: 2017-08-02T19:00:00 Last Updated: 2024-08-05T17:41:55.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3920 - https://access.redhat.com/errata/RHSA-2017:2445 - https://access.redhat.com/errata/RHSA-2017:3473 - http://www.securityfocus.com/bid/99513 - https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html - https://acces
://www.securityfocus.com/bid/99513 - https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html - https://access.redhat.com/errata/RHSA-2017:3470 - https://access.redhat.com/errata/RHSA-2017:3472 - https://access.redhat.com/errata/RHSA-2017:3474 - http://www.openwall.com/lists/oss-security/2017/06/29/1 - https://access.redhat.com/errata/RHSA-2017:3471 - https://bugzilla.redhat.com/show_bug.cgi?id=1466190 - https://access.redhat.com/errata/RHSA-2017:3466 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https://access.redhat.com/errata/RHSA-2017:2390
CVE ID: CVE-2017-10665 State: PUBLISHED Published: 2017-08-18T14:00:00 Last Updated: 2024-08-05T17:41:55.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in ajaxfileupload.php in Kayson Group Ltd. phpGrid before 7.2.5 allows remote attackers to execute arbitrary code by uploading a crafted file with a .. (dot dot) in the file name. Additional Analyst Notes: - CVE Program Container: References: - https://www.futureweb.at/security/CVE-2017-10665/ - https://phpgrid.com/announcement/version-7-2-5/
CVE ID: CVE-2017-10667 State: PUBLISHED Published: 2017-06-29T00:00:00Z Last Updated: 2024-09-17T00:11:08.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zencart/zencart/issues/1443 - https://github.com/zhonghaozhao/zencart/issues/1
CVE ID: CVE-2017-10668 State: PUBLISHED Published: 2017-06-30T12:00:00 Last Updated: 2024-08-05T17:41:55.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under an MITM condition within the OSCI infrastructure, an attacker needs to send crafted protocol messages to analyse the CBC mode padding in order to decrypt the transport encryption. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jun/44
CVE ID: CVE-2017-10669 State: PUBLISHED Published: 2017-06-30T12:00:00 Last Updated: 2024-08-05T17:41:55.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jun/44
CVE ID: CVE-2017-10670 State: PUBLISHED Published: 2017-06-30T12:00:00 Last Updated: 2024-08-05T17:41:55.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jun/44
CVE ID: CVE-2017-10671 State: PUBLISHED Published: 2017-06-29T08:00:00 Last Updated: 2024-08-05T17:41:55.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted filename. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/06/15/9 - https://github.com/blueness/sthttpd/releases/tag/v2.27.1 - https://github.com/blueness/sthttpd/commit/c0dc63a49d8605649f1d8e4a96c9b468b0bff660