Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-8780 State: PUBLISHED Published: 2017-05-04T14:00:00Z Last Updated: 2024-09-17T01:55:42.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/semplon/GeniXCMS/issues/74
CVE ID: CVE-2017-8781 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:48:21.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: XnView Classic for Windows Version 2.40 allows user-assisted remote attackers to execute code via a crafted JPEG 2000 file that is mishandled during the opening of a directory in "Browser" mode, because of a "Stack Buffer Overrun" issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-8781
CVE ID: CVE-2017-8782 State: PUBLISHED Published: 2017-05-31T03:54:00 Last Updated: 2024-08-05T16:48:21.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: The readString function in util/read.c and util/old/read.c in libming 0.4.8 allows remote attackers to cause a denial of service via a large file that is mishandled by listswf, listaction, etc. This occurs because of an integer overflow that leads to a memory allocation error. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98793 - http://seclists.org/fulldisclosure/2017/May/106
CVE ID: CVE-2017-8783 State: PUBLISHED Published: 2018-02-04T01:00:00 Last Updated: 2024-08-05T16:48:22.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Security_Center - https://bugzilla.zimbra.com/show_bug.cgi?id=107878 - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://bugzilla.zimbra.com/show_bug.cgi?id=107885
CVE ID: CVE-2017-8784 State: REJECTED Published: 2017-05-07T17:00:00 Last Updated: 2017-05-07T16:57:01 Description: No description available.
CVE ID: CVE-2017-8785 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:48:21.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: FastStone Image Viewer 6.2 has a "Data from Faulting Address may be used as a return value" issue. This issue can be triggered by a malformed JPEG 2000 file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-8785
CVE ID: CVE-2017-8786 State: PUBLISHED Published: 2017-05-05T00:00:00 Last Updated: 2024-08-05T16:48:22.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201710-09 - https://vcs.pcre.org/pcre2?view=revision&revision=697 - https://vcs.pcre.org/pcre2?view=revision&revision=696 - https://bugs.exim.org/show_bug.cgi?id=2079 - https://blogs.gentoo.org/ago/2017/04/29/libpcre-heap-based-buffer-overflow-write
://bugs.exim.org/show_bug.cgi?id=2079 - https://blogs.gentoo.org/ago/2017/04/29/libpcre-heap-based-buffer-overflow-write-in-pcre2test-c/
CVE ID: CVE-2017-8787 State: PUBLISHED Published: 2017-05-05T07:04:00 Last Updated: 2024-08-05T16:48:22.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861738
CVE ID: CVE-2017-8788 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:21.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a CRLF vulnerability in settings_global_text_edit.php allowing ?display=x%0Dnewline attacks. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8789 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:21.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. A report_error.php?year='payload SQL injection vector exists. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8790 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:22.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8791 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:22.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a home/seos/courier/login.html auth_params CRLF attack vector. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8792 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:22.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/user_add.html with the param parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8793 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:22.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site access with a bypass of the Same Origin Policy. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8794 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:21.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8795 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:21.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/smtpg_add.html with the param parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8796 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:21.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because mysql_real_escape_string is misused, seos/courier/communication_p2p.php allows SQL injection with the app_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE ID: CVE-2017-8797 State: PUBLISHED Published: 2017-07-02T17:00:00 Last Updated: 2024-08-05T16:48:22.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security
hole system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/06/27/5 - http://www.securitytracker.com/id/1038790 - https://access.redhat.com/errata/RHSA-2017:2437 - https://github.com/torvalds/linux/commit/f961e3f2acae94b727380c0b74e2d3954d0edf79 - https://access.redhat.com/errata/RHSA-2017:2669 - https://bugzilla.redhat.com/show_bug.cgi?id=1466329 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f961e3f2acae94b727380c0b74e2d3954d0edf79 - https://github.com/torvalds/linux/commit/b550a32e60a4941994b437a8d662432a486235a5 - https://access.redhat.com/errata/RHSA-2017:2077 - http://www.kernel.org/pub/linux
a32e60a4941994b437a8d662432a486235a5 - https://access.redhat.com/errata/RHSA-2017:2077 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.3 - https://access.redhat.com/errata/RHSA-2017:1842 - http://www.securityfocus.com/bid/99298 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b550a32e60a4941994b437a8d662432a486235a5
CVE ID: CVE-2017-8798 State: PUBLISHED Published: 2017-05-11T01:00:00 Last Updated: 2024-08-05T16:48:21.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - http://miniupnp.free.fr/files/changelog.php?file=miniupnpc-2.0.20170509.tar.gz - https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798 - https://lists.debian.org/debian-lts-announce/2020/04/msg00027.html
CVE ID: CVE-2017-8799 State: PUBLISHED Published: 2017-05-05T18:00:00 Last Updated: 2024-08-05T16:48:22.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted input execution via igetwild in all iRODS versions before 4.1.11 and 4.2.1 allows other iRODS users (potentially anonymous) to execute remote shell commands via iRODS virtual pathnames. To exploit this vulnerability, a virtual iRODS pathname that includes a semicolon would be retrieved via igetwild. Because igetwild is a Bash script, the part of the pathname following the semicolon would be executed in the user's shell. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/irods/irods/is
in the user's shell. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/irods/irods/issues/3452
CVE ID: CVE-2017-8801 State: PUBLISHED Published: 2017-05-05T19:00:00Z Last Updated: 2024-09-16T23:50:58.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro OfficeScan 11.0 before SP1 CP 6325 (with Agent Module Build before 6152) and XG before CP 1352 has XSS via a crafted URI using a blocked website. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/1117204-security-bulletin-trend-micro-officescan-11-xg-multiple-vulnerabilities - http://files.trendmicro.com/products/officescan/11.0_SP1/readme/osce-11-sp1-patch1-win-all-criticalpatch-6325_readme.txt
CVE ID: CVE-2017-8802 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T16:48:22.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.zimbra.com/show_bug.cgi?id=107925 - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-001_zimbra_stored_xss.txt - http://www.securityfocu
.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-001_zimbra_stored_xss.txt - http://www.securityfocus.com/archive/1/541661/100/0/threaded
CVE ID: CVE-2017-8803 State: PUBLISHED Published: 2017-07-05T19:00:00 Last Updated: 2024-08-05T16:48:22.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: Notepad++ 7.3.3 (32-bit) with Hex Editor Plugin v0.9.5 might allow user-assisted attackers to execute code via a crafted file, because of a "Data from Faulting Address controls Code Flow" issue. One threat model is a victim who obtains an untrusted crafted file from a remote location and issues several user-defined commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-8803
CVE ID: CVE-2017-8804 State: PUBLISHED Published: 2017-05-07T18:00:00 Last Updated: 2024-08-05T16:48:22.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1037559#c7 - http
tional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1037559#c7 - https://sourceware.org/ml/libc-alpha/2017-05/msg00105.html - http://www.securityfocus.com/bid/98339 - https://sourceware.org/bugzilla/show_bug.cgi?id=21461 - http://www.openwall.com/lists/oss-security/2017/05/05/2 - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00049.html - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00026.html - https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00128.html - https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00129.html - h
e.org/legacy-ml/libc-alpha/2017-05/msg00128.html - https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00129.html - https://seclists.org/oss-sec/2017/q2/228
CVE ID: CVE-2017-8805 State: PUBLISHED Published: 2017-10-17T18:00:00 Last Updated: 2024-08-05T16:48:21.804Z Vendors: n/a Products: Debian ftpsync before 20171017 Problem Types: directory traversal Description: Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/10/17/2 - https://lists.debian.org/debian-mirrors/2017/10/msg00017.html - https://anonscm.debian.org/cgit/mirror/archvsync.git/commit/?id=d1ca2ab2210990b6dfb664cd6776a41b71c48016
CVE ID: CVE-2017-8806 State: PUBLISHED Published: 2017-11-13T09:00:00 Last Updated: 2024-08-05T16:48:21.905Z Vendors: n/a Products: PostgreSQL-related scripts that are specific to Debian and Ubuntu Problem Types: handled symbolic links insecurely Description: The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://metadata.ftp-master.debian.org/changelogs
files. Additional Analyst Notes: - CVE Program Container: References: - http://metadata.ftp-master.debian.org/changelogs/main/p/postgresql-common/postgresql-common_181+deb9u1_changelog - http://www.securityfocus.com/bid/101810 - https://usn.ubuntu.com/usn/usn-3476-1/ - https://www.debian.org/security/2017/dsa-4029
CVE ID: CVE-2017-8807 State: PUBLISHED Published: 2017-11-16T02:00:00 Last Updated: 2024-08-05T16:48:21.686Z Vendors: n/a Products: Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 Problem Types: memory disclosure Description: vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/881808 - http://varnish-cache.org/security/VSV00002.html -
CVE Program Container: References: - https://bugs.debian.org/881808 - http://varnish-cache.org/security/VSV00002.html - https://github.com/varnishcache/varnish-cache/pull/2429 - https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1c460c15f6a1a6af5a7 - https://www.debian.org/security/2017/dsa-4034 - http://www.securityfocus.com/bid/101886
CVE ID: CVE-2017-8808 State: PUBLISHED Published: 2017-11-15T08:00:00 Last Updated: 2024-08-05T16:48:22.553Z Vendors: n/a Products: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 Problem Types: XSS Description: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039812 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html - https://www.debian.org/security/2017/dsa-4036
CVE ID: CVE-2017-8809 State: PUBLISHED Published: 2017-11-15T08:00:00 Last Updated: 2024-08-05T16:48:21.913Z Vendors: n/a Products: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 Problem Types: Reflected File Download Description: api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039812 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html - https://www.debian.org/security/2017/dsa-4036
CVE ID: CVE-2017-8810 State: PUBLISHED Published: 2017-11-15T08:00:00 Last Updated: 2024-08-05T16:48:22.197Z Vendors: n/a Products: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 Problem Types: information leak because of response discrepancy Description: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.co
via a series of requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039812 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html - https://www.debian.org/security/2017/dsa-4036
CVE ID: CVE-2017-8811 State: PUBLISHED Published: 2017-11-15T08:00:00 Last Updated: 2024-08-05T16:48:22.605Z Vendors: n/a Products: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 Problem Types: HTML mangling Description: The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039812 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html - https://www.debian.org/security/2017/dsa-4036
CVE ID: CVE-2017-8812 State: PUBLISHED Published: 2017-11-15T08:00:00 Last Updated: 2024-08-05T16:48:22.653Z Vendors: n/a Products: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 Problem Types: greater than injection Description: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039812 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html - https://www.debian.org/security/2017/dsa-4036
CVE ID: CVE-2017-8813 State: REJECTED Published: 2017-06-23T12:00:00 Last Updated: 2017-06-23T11:57:01 Description: No description available.
CVE ID: CVE-2017-8814 State: PUBLISHED Published: 2017-11-15T08:00:00 Last Updated: 2024-08-05T16:48:21.905Z Vendors: n/a Products: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 Problem Types: unrestricted text replacement Description: The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk." Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039812 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html - https://www.debian.org/security/2017/dsa-4036
CVE ID: CVE-2017-8815 State: PUBLISHED Published: 2017-11-15T08:00:00 Last Updated: 2024-08-05T16:48:21.919Z Vendors: n/a Products: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 Problem Types: attribute injection Description: The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039812 - https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html - https://www.debian.org/security/2017/dsa-4036
CVE ID: CVE-2017-8816 State: PUBLISHED Published: 2017-11-29T18:00:00 Last Updated: 2024-08-05T16:48:21.978Z Vendors: n/a Products: curl and libcurl before 7.57.0 Problem Types: integer overflow Description: The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields. Additional Analyst Notes: - CVE Program Container: References: - http://security.cucumberlinux.com/security/details.php?id=161 - https://security.gentoo.org/glsa/201712-04 - https://access.redh
ecurity.cucumberlinux.com/security/details.php?id=161 - https://security.gentoo.org/glsa/201712-04 - https://access.redhat.com/errata/RHSA-2018:3558 - https://curl.haxx.se/docs/adv_2017-12e7.html - http://www.securityfocus.com/bid/101998 - http://www.securitytracker.com/id/1039896 - https://www.debian.org/security/2017/dsa-4051 - http://www.securitytracker.com/id/1040608