Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-14718 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - http://www.securityfocus.com/bid/100912 - https://core.trac.wordpress.org/changeset/41393 - http://www.securitytracker.com/id/1039553 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
CVE ID: CVE-2017-14719 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - http://www.securityfocus.com/bid/100912 - http://www.securitytracker.com/id/1039553 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ - https://wpvulndb.com/vulnerabilities/8911 - https://core.trac.wordpress.org/changeset/41457
CVE ID: CVE-2017-14720 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - http://www.securityfocus.com/bid/100912 - http://www.securitytracker.com/id/1039553 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ - https://core.trac.wordpress.org/changeset/41412
CVE ID: CVE-2017-14721 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - http://www.securityfocus.com/bid/100912 - http://www.securitytracker.com/id/1039553 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ - https://core.trac.wordpress.org/changeset/41412
CVE ID: CVE-2017-14722 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - http://www.securityfocus.com/bid/100912 - https://core.trac.wordpress.org/changeset/41397 - http://www.securitytracker.com/id/1039553 - https://wpvulndb.com/vulnerabilities/8912 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
CVE ID: CVE-2017-14723 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - https://medium.com/websec/wordpress-sqli-poc-f1827c20bf8e - http://www.securityfocus.com/bid/100912 - http://www.securitytracker.com/id/1039553 - https://github.com/WordPress/WordPress/commit/fc930d3daed1c
com/bid/100912 - http://www.securitytracker.com/id/1039553 - https://github.com/WordPress/WordPress/commit/fc930d3daed1c3acef010d04acc2c5de93cd18ec - https://core.trac.wordpress.org/changeset/41470 - https://core.trac.wordpress.org/changeset/41496 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ - https://medium.com/websec/wordpress-sqli-bbb2afcc8e94 - https://github.com/WordPress/WordPress/commit/70b21279098fc973eae803693c0705a548128e48
CVE ID: CVE-2017-14724 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - https://wpvulndb.com/vulnerabilities/8913 - https://core.trac.wordpress.org/changeset/41448 - http://www.securityfocus.com/bid/100912 - http://www.securitytracker.com/id/1039553 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
CVE ID: CVE-2017-14725 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - http://www.securityfocus.com/bid/100912 - https://core.trac.wordpress.org/changeset/41398 - http://www.securitytracker.com/id/1039553 - https://wpvulndb.com/vulnerabilities/8910 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
CVE ID: CVE-2017-14726 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-3997 - https://core.trac.wordpress.org/changeset/41395 - http://www.securityfocus.com/bid/100912 - http://www.securitytracker.com/id/1039553 - https://wpvulndb.com/vulnerabilities/8914 - https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
CVE ID: CVE-2017-14727 State: PUBLISHED Published: 2017-09-23T20:00:00 Last Updated: 2024-08-05T19:34:39.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101003 - https://weechat.org/download/security/ - https://github.com/weechat/weechat/commit/f105c6f0b56fb5687b2d2aedf37cb1d1b434d556 - https://weechat.org/news/98/20170923-Version-1.9.1-security-release/
CVE ID: CVE-2017-14728 State: PUBLISHED Published: 2019-06-03T18:47:42 Last Updated: 2024-08-05T19:34:40.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public. Additional Analyst Notes: - CVE Program Container: References: - http://www.orpak.com/allproducts/siteomat-station-controller-sw/ - https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01 - http://www.securityfocus.com/bid/108167
CVE ID: CVE-2017-14729 State: PUBLISHED Published: 2017-09-25T16:00:00Z Last Updated: 2024-09-17T01:21:31.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22170 - https://bl
Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22170 - https://blogs.gentoo.org/ago/2017/09/25/binutils-heap-based-buffer-overflow-in-_bfd_x86_elf_get_synthetic_symtab-elfxx-x86-c/ - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=61e3bf5f83f7e505b6bc51ef65426e5b31e6e360 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=56933f9e3e90eebf1018ed7417d6c1184b91db6b
CVE ID: CVE-2017-14730 State: PUBLISHED Published: 2017-09-25T17:00:00 Last Updated: 2024-08-05T19:34:39.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.gentoo.org/628558 - https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbd6cb398c1740c68e9b1b78340c887c58c1fbda - https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f2
mmit/?id=bbd6cb398c1740c68e9b1b78340c887c58c1fbda - https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f291b31ae7a902719f1c17c79fa - https://github.com/gentoo/gentoo/pull/5665
CVE ID: CVE-2017-14731 State: PUBLISHED Published: 2017-09-25T21:00:00 Last Updated: 2024-08-05T19:34:39.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00038.html - https://github.com/libofx/libofx/issues/10 - https://security.gentoo.org/glsa/201908-26
CVE ID: CVE-2017-14733 State: PUBLISHED Published: 2017-09-25T21:00:00 Last Updated: 2024-08-05T19:34:39.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4321 - http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=5381c71724e3 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - https://sourceforge.net/p/gra
3Bnode=5381c71724e3 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - https://sourceforge.net/p/graphicsmagick/bugs/458/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4232-1/
CVE ID: CVE-2017-14734 State: PUBLISHED Published: 2017-09-25T21:00:00Z Last Updated: 2024-09-16T20:37:55.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to hevc_decode_init1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leonzhao7/vulnerability/blob/master/A%20heap-buffer-overflow%20vulnerability%20in%20hevc_decode_init1%20of%20libbpg.md
CVE ID: CVE-2017-14735 State: PUBLISHED Published: 2017-09-25T21:00:00 Last Updated: 2024-08-05T19:34:39.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105656 - https://www.oracle.com/security-alerts/cpuapr2020.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https:
advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://github.com/nahsra/antisamy/issues/10 - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2017-14737 State: PUBLISHED Published: 2017-09-26T01:00:00 Last Updated: 2024-08-05T19:34:39.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-shuai - https://github.com/randombit/botan/issues/1222 - https://lists.debian.o
y17/technical-sessions/presentation/wang-shuai - https://github.com/randombit/botan/issues/1222 - https://lists.debian.org/debian-lts-announce/2021/11/msg00006.html
CVE ID: CVE-2017-14738 State: PUBLISHED Published: 2017-09-29T08:00:00 Last Updated: 2024-08-05T19:34:39.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module (under the search function). Additional Analyst Notes: - CVE Program Container: References: - http://feedback.filerun.com/topics/189-critical-security-update-available/ - https://www.exploit-db.com/exploits/42922/ - https://blog.spentera.com/2017/09/29/blind-sql-injection-vulnerability-in-filerun-2017-09-18/
CVE ID: CVE-2017-14739 State: PUBLISHED Published: 2017-09-26T02:00:00 Last Updated: 2024-08-05T19:34:40.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackers to cause a denial of service (NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and application crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/780 - https://usn.ubuntu.com/3681-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - h
ick/issues/780 - https://usn.ubuntu.com/3681-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-14740 State: PUBLISHED Published: 2018-04-26T14:00:00 Last Updated: 2024-08-05T19:34:39.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/faizzaidi/GeniXCMS-Version-1.1.0-Cross-Site-Scripting-XSS
CVE ID: CVE-2017-14741 State: PUBLISHED Published: 2017-09-26T02:00:00 Last Updated: 2024-08-05T19:34:39.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop) via a crafted font file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/771 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-14742 State: PUBLISHED Published: 2019-10-25T21:01:58 Last Updated: 2024-08-05T19:34:39.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43236/
CVE ID: CVE-2017-14743 State: PUBLISHED Published: 2017-09-26T06:00:00Z Last Updated: 2024-09-17T02:16:06.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in an XML document to /onvif/device_service, as demonstrated by reading the admin password. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/iotsploit/faleemi-fsc-880-multiple-security-vulnerabilities-ed1d132c2cce
CVE ID: CVE-2017-14744 State: PUBLISHED Published: 2017-09-26T06:00:00Z Last Updated: 2024-09-16T22:20:54.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element. Additional Analyst Notes: - CVE Program Container: References: - http://www.yuag.org/2017/09/19/ueditor%E5%82%A8%E5%AD%98%E5%9E%8Bxss%E6%BC%8F%E6%B4%9E/
CVE ID: CVE-2017-14745 State: PUBLISHED Published: 2017-09-26T16:00:00Z Last Updated: 2024-09-16T20:01:44.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22148
CVE ID: CVE-2017-14746 State: PUBLISHED Published: 2017-11-27T22:00:00 Last Updated: 2024-08-05T19:34:39.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2017-14746.html - https://access.redhat.com/errata/RHSA-2017:3278 - https://www.debian.org/security/2017/dsa-4043 - https://access.redhat.com/errata/RHSA-2017:3260 - http://www.securitytracker.com/id/1039856 - http://www.securityfocus.com/bid/101907 - https://access.redhat.com/errata/RHSA-20
/www.securitytracker.com/id/1039856 - http://www.securityfocus.com/bid/101907 - https://access.redhat.com/errata/RHSA-2017:3261 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03817en_us - https://security.gentoo.org/glsa/201805-07 - http://www.ubuntu.com/usn/USN-3486-1 - https://www.synology.com/support/security/Synology_SA_17_72_Samba
CVE ID: CVE-2017-14748 State: PUBLISHED Published: 2017-09-26T17:00:00 Last Updated: 2024-08-05T19:34:39.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service (season bans and SR losses for other users) by leaving a competitive match at a specific time during the initial loading of that match. Additional Analyst Notes: - CVE Program Container: References: - https://www.reddit.com/r/Overwatch/comments/72euqx/theres_a_bug_out_there_that_can_instantly/ - http://www.securityfocus.com/bid/101087 - https://us.battle.net/forums/en/overwatch/topic/20759216554
CVE ID: CVE-2017-14749 State: PUBLISHED Published: 2017-09-26T18:00:00Z Last Updated: 2024-09-17T03:23:30.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: JerryScript 1.0 allows remote attackers to cause a denial of service (jmem_heap_alloc_block_internal heap memory corruption) or possibly execute arbitrary code via a crafted .js file, because unrecognized \ characters cause incorrect 0x00 characters in bytecode.literal data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/2008
CVE ID: CVE-2017-14751 State: PUBLISHED Published: 2017-09-26T22:00:00 Last Updated: 2024-08-05T19:34:40.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-jobs/#developers - http://bbs.microdesktop.com/2017/09/25/wordpress-4-8-wp-jobs-1-5-job-qualification-edit-box-xss/ - http://www.securityfocus.com/bid/101030
CVE ID: CVE-2017-14752 State: PUBLISHED Published: 2017-10-31T18:00:00 Last Updated: 2024-08-05T19:34:39.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as their first name, last name, or display name in the profile fields that can cause issues such as escalation of privileges or unknown execution of malicious code when replying to messages in Mahara. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1719491
CVE ID: CVE-2017-14753 State: PUBLISHED Published: 2017-09-27T03:00:00 Last Updated: 2024-08-05T19:34:39.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/module_filters/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsj730sos/Vulnerability-details/wiki/eyesofnetwork_eonweb-5.1_filter_cross-site-scripting-%28XSS%29 - http://www.securityfocus.com/bid/101031
CVE ID: CVE-2017-14754 State: PUBLISHED Published: 2017-10-02T17:00:00 Last Updated: 2024-08-05T19:34:39.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Arbitrary File Read: /xAdmin/html/cm_datasource_group_xsd.jsp, parameter: xsd_datasource_schema_file filename. In order for this vulnerability to be exploited, an attacker must authenticate to the application first. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/92 - https://knowledge.opentext.com/knowledge/llisapi.
tainer: References: - http://seclists.org/fulldisclosure/2017/Sep/92 - https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
CVE ID: CVE-2017-14755 State: PUBLISHED Published: 2017-10-02T17:00:00 Last Updated: 2024-08-05T19:34:39.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-Site Scripting: /xAdmin/html/XPressoDoc, parameter: categoryId. Additional Analyst Notes: - CVE Program Container: References: - https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 - http://seclists.org/fulldisclosure/2017/Sep/95