Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-14092 State: PUBLISHED Published: 2017-12-15T14:00:00 Last Updated: 2024-08-05T19:13:41.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/1118486 - https://www.coresecurity.com/advisories/trend-micro-scanmail-microsoft-exchange-multiple-vulnerabilities
CVE ID: CVE-2017-14093 State: PUBLISHED Published: 2017-12-15T14:00:00 Last Updated: 2024-08-05T19:13:41.870Z Vendors: Trend Micro Products: Trend Micro ScanMail for Exchange Problem Types: Cross Site Scripting (XSS) Description: The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/1118486 - https://www.coresecurity.com/advisories/trend-micro-scanmail-microsoft-exchange-multiple-vulnerabilities
CVE ID: CVE-2017-14094 State: PUBLISHED Published: 2018-01-19T19:00:00 Last Updated: 2024-08-05T19:13:41.885Z Vendors: Trend Micro Products: Trend Micro Smart Protection Server (Standalone) Problem Types: CWE-78 Description: A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a cron job injection on a vulnerable system. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43388/ - http://www.securityfocus.com/bid/102275 - https://success.trendmicro.com/solution/1118992 - https://www.coresecurity.com/advisories/trend-micro-smart-protection-serv
ps://success.trendmicro.com/solution/1118992 - https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
CVE ID: CVE-2017-14095 State: PUBLISHED Published: 2018-01-19T19:00:00 Last Updated: 2024-08-05T19:20:39.837Z Vendors: Trend Micro Products: Trend Micro Smart Protection Server (Standalone) Problem Types: CWE-98 Description: A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable system. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43388/ - http://www.securityfocus.com/bid/102275 - https://success.trendmicro.com/solution/1118992 - https://www.coresecurity.com/advisories/trend-micro-smart-protection-se
ttps://success.trendmicro.com/solution/1118992 - https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
CVE ID: CVE-2017-14096 State: PUBLISHED Published: 2018-01-19T19:00:00 Last Updated: 2024-08-05T19:20:39.889Z Vendors: Trend Micro Products: Trend Micro Smart Protection Server (Standalone) Problem Types: Cross Site Scripting (XSS) Description: A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to execute a malicious payload on vulnerable systems. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43388/ - http://www.securityfocus.com/bid/102275 - https://success.trendmicro.com/solution/1118992 - https://www.coresecurity.com/advisories/trend-micr
us.com/bid/102275 - https://success.trendmicro.com/solution/1118992 - https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
CVE ID: CVE-2017-14097 State: PUBLISHED Published: 2018-01-19T19:00:00 Last Updated: 2024-08-05T19:20:39.884Z Vendors: Trend Micro Products: Trend Micro Smart Protection Server (Standalone) Problem Types: Incorrect Access Control Description: An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to decrypt contents of a database with information that could be used to access a vulnerable system. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43388/ - http://www.securityfocus.com/bid/102275 - https://success.trendmicro.com/solution/1118992 - https://www.co
oits/43388/ - http://www.securityfocus.com/bid/102275 - https://success.trendmicro.com/solution/1118992 - https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
CVE ID: CVE-2017-14098 State: PUBLISHED Published: 2017-09-02T16:00:00 Last Updated: 2024-08-05T19:20:41.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/873909 - http://www.securitytracker.com/id/1039253 - http://downloads.asterisk.org/pub/security/AST-2017-007.html - http://www.securityfocus.com/bid/100583 - https://issues.asterisk.org/jira/browse/ASTERISK-27152
CVE ID: CVE-2017-14099 State: PUBLISHED Published: 2017-09-02T16:00:00 Last Updated: 2024-08-05T19:20:39.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized data disclosure (media takeover in the RTP stack) is possible with careful timing by an attacker. The "strictrtp" option in rtp.conf enables a feature of the RTP stack that learns the source address of media for a session and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk
on and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk 11 and above. The "nat" and "rtp_symmetric" options (for chan_sip and chan_pjsip, respectively) enable symmetric RTP support in the RTP stack. This uses the source address of incoming media as the target address of any sent media. This option is not enabled by default, but is commonly enabled to handle devices behind NAT. A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support, this introduced an avenue where media could be hijacked. Instead of only learning a new address
e symmetric RTP support, this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected, the new code allowed a new source address to be learned at all times. If a flood of RTP traffic was received, the strict RTP support would allow the new address to provide media, and (with symmetric RTP enabled) outgoing traffic would be sent to this new address, allowing the media to be hijacked. Provided the attacker continued to send traffic, they would continue to receive traffic as well. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201710-29 - https://issues.asterisk.org/jira/browse/ASTERISK-27013 - h
r: References: - https://security.gentoo.org/glsa/201710-29 - https://issues.asterisk.org/jira/browse/ASTERISK-27013 - http://www.debian.org/security/2017/dsa-3964 - http://www.securitytracker.com/id/1039251 - http://downloads.asterisk.org/pub/security/AST-2017-005.html - https://bugs.debian.org/873907 - https://rtpbleed.com
CVE ID: CVE-2017-14100 State: PUBLISHED Published: 2017-09-02T16:00:00 Last Updated: 2024-08-05T19:20:39.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted sourc
d to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection. Additional Analyst Notes: - CVE Program Container: References: - https://issues.asterisk.org/jira/browse/ASTERISK-27103 - http://www.securitytracker.com/id/1039252 - https://bugs.debian.org/873908 - https://security.gentoo.org/glsa/201710-29 - http://www.debian.org/security/2017/dsa-3964 - http://downloads.asterisk.org/pub/security/AST-2017-006.html
CVE ID: CVE-2017-14101 State: PUBLISHED Published: 2017-12-15T18:00:00 Last Updated: 2024-08-05T19:20:39.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical Imaging Company, which is now a Change Healthcare company. An unauthenticated user supplying a modified HTTP SOAP request to the vulnerable service allows for arbitrary file read access to the local file system as well as the transmittal of the application service's account hashed credentials to a remote attacker. Additional Analyst Notes: - CVE Program Container: Refer
tion service's account hashed credentials to a remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://technical.nttsecurity.com/post/102emjg/conserus-image-repository-xml-external-entity-vulnerability
CVE ID: CVE-2017-14102 State: PUBLISHED Published: 2017-09-01T05:00:00Z Last Updated: 2024-09-17T02:37:01.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: MIMEDefang 2.80 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by the init-script.in and mimedefang-init.in scripts. Additional Analyst Notes: - CVE Program Container: References: - http://lists.roaringpenguin.com/pipermail/mimedefang/2017-August/038077.html - http://lists.roaringpengui
References: - http://lists.roaringpenguin.com/pipermail/mimedefang/2017-August/038077.html - http://lists.roaringpenguin.com/pipermail/mimedefang/2017-August/038085.html
CVE ID: CVE-2017-14103 State: PUBLISHED Published: 2017-09-01T13:00:00 Last Updated: 2024-08-05T19:20:40.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, which allows remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11403. Additional Analyst Notes: - CVE Program Container: References: - http://hg.code.sf.net/p/graphicsmagick/code/rev/98721124e51f - https://blogs.gentoo.org/
rogram Container: References: - http://hg.code.sf.net/p/graphicsmagick/code/rev/98721124e51f - https://blogs.gentoo.org/ago/2017/09/01/graphicsmagick-use-after-free-in-closeblob-blob-c-incomplete-fix-for-cve-2017-11403/
CVE ID: CVE-2017-14105 State: PUBLISHED Published: 2017-09-01T17:00:00 Last Updated: 2024-08-05T19:20:39.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at HiveManager/tomcat/webapps/hm/domains/$yourtenant/maps (it will be exposed at the web interface). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theguly/CVE-2017-14105
CVE ID: CVE-2017-14106 State: PUBLISHED Published: 2017-09-01T16:00:00 Last Updated: 2024-08-05T19:20:39.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3200 - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html - https://access.redhat.com/errata/RHSA-2017:2918 - https://access.redhat.com/errata/RHS
-announce/2018-01/msg00007.html - https://access.redhat.com/errata/RHSA-2017:2918 - https://access.redhat.com/errata/RHSA-2017:2931 - http://www.securityfocus.com/bid/100878 - http://www.debian.org/security/2017/dsa-3981 - https://access.redhat.com/errata/RHSA-2018:2172 - https://github.com/torvalds/linux/commit/499350a5a6e7512d9ed369ed63a4244b6536f4f8 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=499350a5a6e7512d9ed369ed63a4244b6536f4f8 - https://www.mail-archive.com/netdev%40vger.kernel.org/msg186255.html - https://access.redhat.com/errata/RHSA-2017:2930 - http://www.securitytracker.com/id/1039549
CVE ID: CVE-2017-14107 State: PUBLISHED Published: 2017-09-01T17:00:00 Last Updated: 2024-08-05T19:20:39.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/ - https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5 - https://lists.debian.org/debian-lts-
https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5 - https://lists.debian.org/debian-lts-announce/2021/12/msg00022.html
CVE ID: CVE-2017-14108 State: PUBLISHED Published: 2017-09-05T06:00:00 Last Updated: 2024-08-05T19:20:41.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: libgedit.a in GNOME gedit through 3.22.1 allows remote attackers to cause a denial of service (CPU consumption) via a file that begins with many '\0' characters. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/143983/libgedit.a-3.22.1-Denial-Of-Service.html - https://bugzilla.gnome.org/show_bug.cgi?id=791037 - https://cxsecurity.com/issue/WLB-2017090008
CVE ID: CVE-2017-14111 State: PUBLISHED Published: 2017-11-17T20:00:00 Last Updated: 2024-08-05T19:20:41.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: The workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) 2.3.0 and earlier and Xcelera R4.1L1 and earlier records domain authentication credentials, which if accessed allows an attacker to use credentials to access the application, or other user entitlements. Additional Analyst Notes: - CVE Program Container: References: - https://www.usa.philips.com/healthcare/about/customer-support/product-security - http://www.securityfocus.com/bid/101850 - https://ics-cert.us-cert.gov/advisories/ICSMA-17-318-01
CVE ID: CVE-2017-14113 State: REJECTED Published: 2017-09-14T15:00:00 Last Updated: 2017-09-14T14:57:01 Description: No description available.
CVE ID: CVE-2017-14114 State: PUBLISHED Published: 2017-09-02T16:00:00Z Last Updated: 2024-09-17T02:21:43.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: RTPproxy through 2.2.alpha.20160822 has a NAT feature that results in not properly determining the IP address and port number of the legitimate recipient of RTP traffic, which allows remote attackers to obtain sensitive information or cause a denial of service (communication outage) via crafted RTP packets. Additional Analyst Notes: - CVE Program Container: References: - https://rtpbleed.com
CVE ID: CVE-2017-14115 State: PUBLISHED Published: 2017-09-03T19:00:00 Last Updated: 2024-08-05T19:20:40.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH logins to the remotessh account with the 5SaP9I26 password, which allows remote attackers to access a "Terminal shell v1.0" service, and subsequently obtain unrestricted root privileges, by establishing an SSH session and then entering certain shell metacharacters and BusyBox commands. Additional Analyst Notes: - CVE Program Container: References: - https://threatpost.com/
haracters and BusyBox commands. Additional Analyst Notes: - CVE Program Container: References: - https://threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753/ - http://www.securityfocus.com/bid/100585 - https://www.nomotion.net/blog/sharknatto/
CVE ID: CVE-2017-14116 State: PUBLISHED Published: 2017-09-03T19:00:00 Last Updated: 2024-08-05T19:20:40.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 and then installing new software, such as BusyBox with "nc -l" support. Additional Analyst Notes: - CVE Program Container: References: - https://threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753
ainer: References: - https://threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753/ - http://www.securityfocus.com/bid/100585 - https://www.nomotion.net/blog/sharknatto/
CVE ID: CVE-2017-14117 State: PUBLISHED Published: 2017-09-03T19:00:00 Last Updated: 2024-08-05T19:20:40.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01 followed by other predictable values. Additional Analyst Notes: - CVE Program Container: References: - https://threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753/ - http://www.securityfocus.com/bi
post.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753/ - http://www.securityfocus.com/bid/100585 - https://www.nomotion.net/blog/sharknatto/
CVE ID: CVE-2017-14118 State: PUBLISHED Published: 2017-09-03T20:00:00Z Last Updated: 2024-09-16T19:56:57.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php. Additional Analyst Notes: - CVE Program Container: References: - http://kk.whitecell-club.org/index.php/archives/220/
CVE ID: CVE-2017-14119 State: PUBLISHED Published: 2017-09-03T20:00:00Z Last Updated: 2024-09-16T17:08:50.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\snmpwalk.php does not properly restrict popen calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in a parameter. Additional Analyst Notes: - CVE Program Container: References: - http://kk.whitecell-club.org/index.php/archives/220/
CVE ID: CVE-2017-14120 State: PUBLISHED Published: 2017-09-03T20:00:00 Last Updated: 2024-08-05T19:20:41.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a directory traversal vulnerability for RAR v2 archives: pathnames of the form ../[filename] are unpacked into the upper directory. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/874059 - http://www.openwall.com/lists/oss-security/2017/08/20/1 - https://lists.debian.org/debian-lts-announce/2021/02/msg00026.html
CVE ID: CVE-2017-14121 State: PUBLISHED Published: 2017-09-03T20:00:00 Last Updated: 2024-08-05T19:20:39.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DecodeNumber function in unrarlib.c in unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a NULL pointer dereference flaw triggered by a crafted RAR archive. NOTE: this may be the same as one of the several test cases in the CVE-2017-11189 references. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/874061 - http://www.openwall.com/lists/oss-security/2017/08/20/1 - https://lists.debian.org/debian-lts-announce/2021/02/msg00026.html
CVE ID: CVE-2017-14122 State: PUBLISHED Published: 2017-09-03T20:00:00 Last Updated: 2024-08-05T19:20:40.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a stack-based buffer over-read in unrarlib.c, related to ExtrFile and stricomp. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/874060 - http://www.openwall.com/lists/oss-security/2017/08/20/1 - https://lists.debian.org/debian-lts-announce/2021/02/msg00026.html
CVE ID: CVE-2017-14123 State: PUBLISHED Published: 2017-09-04T20:00:00 Last Updated: 2024-08-05T19:20:40.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch - https://blogs.securiteam.com/index.php/archives/3228
CVE ID: CVE-2017-14124 State: PUBLISHED Published: 2017-09-13T16:00:00 Last Updated: 2024-08-05T19:20:41.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: In eLux RP 5.x before 5.5.1000 LTSR and 5.6.x before 5.6.2 CR when classic desktop mode is used, it is possible to start applications other than defined, even if the user does not have permissions to change application definitions. Additional Analyst Notes: - CVE Program Container: References: - https://www.myelux.com/cvesingle.htm?cve_id=CVE-2017-14124
CVE ID: CVE-2017-14125 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-05T19:20:40.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/55 - https://wpvulndb.com/vulnerabilities/8907
CVE ID: CVE-2017-14126 State: PUBLISHED Published: 2017-09-04T20:00:00 Last Updated: 2024-08-05T19:20:40.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Participants Database plugin before 1.7.5.10 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42618/ - https://wordpress.org/plugins/participants-database/#developers - https://limbenjamin.com/articles/cve-2017-14126-participants-database-xss.html