Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-16711 State: PUBLISHED Published: 2017-11-09T17:00:00 Last Updated: 2024-08-05T20:35:19.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: The swf_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2 mishandles an uncompress failure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) because of extractDefinitions in lib/readers/swf.c and fill_line_bitmap in lib/devices/render.c, as demonstrated by swfrender. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/46 - http://www.securityfocus.com/bid/101797
CVE ID: CVE-2017-16714 State: PUBLISHED Published: 2018-09-06T19:00:00Z Last Updated: 2024-09-17T01:51:12.158Z Vendors: Ice Qube Products: Thermal Management Center Problem Types: CWE-256 Description: In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-249-01 - http://www.securityfocus.com/bid/105303
CVE ID: CVE-2017-16715 State: PUBLISHED Published: 2017-11-16T21:00:00 Last Updated: 2024-08-05T20:35:19.957Z Vendors: n/a Products: Moxa NPort 5110, 5130, and 5150 Problem Types: CWE-200 Description: An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to exploit a flaw in the handling of Ethernet frame padding that may allow for information exposure. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101885 - https://ics-cert.us-cert.gov/advisories/ICSA-1
rogram Container: References: - http://www.securityfocus.com/bid/101885 - https://ics-cert.us-cert.gov/advisories/ICSA-17-320-01
CVE ID: CVE-2017-16716 State: PUBLISHED Published: 2018-01-05T08:00:00 Last Updated: 2024-08-05T20:35:20.466Z Vendors: n/a Products: Advantech WebAccess Problem Types: CWE-89 Description: A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102424 - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02 - https://www.exploit-db.com/exploits/43928/
CVE ID: CVE-2017-16717 State: PUBLISHED Published: 2017-12-20T19:00:00 Last Updated: 2024-08-05T20:35:19.945Z Vendors: n/a Products: WECON Technology Co., Ltd. LeviStudio HMI Problem Types: CWE-122 Description: A Heap-based Buffer Overflow issue was discovered in WECON LeviStudio HMI. The heap-based buffer overflow vulnerability has been identified, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-353-05
CVE ID: CVE-2017-16718 State: PUBLISHED Published: 2018-06-27T19:00:00Z Last Updated: 2024-09-16T17:28:00.754Z Vendors: ICS-CERT Products: Beckhoff TwinCAT Problem Types: CWE-522 Description: Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured routes, that can be edited remotely via ADS. This special command supports encrypted authentication with username/password. The encryption uses a fixed key, that could be extracted by an attacker. Precondition of the exploitation of this weakness is network access at the moment a route is added. Additional Analyst Notes: - CVE Program Container: Re
of this weakness is network access at the moment a route is added. Additional Analyst Notes: - CVE Program Container: References: - https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2017-002.pdf
CVE ID: CVE-2017-16719 State: PUBLISHED Published: 2017-11-16T21:00:00 Last Updated: 2024-08-05T20:35:19.967Z Vendors: n/a Products: Moxa NPort 5110, 5130, and 5150 Problem Types: CWE-74 Description: An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to inject packets that could potentially disrupt the availability of the device. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101885 - https://ics-cert.us-cert.gov/advisories/ICSA-17-320-01
CVE ID: CVE-2017-16720 State: PUBLISHED Published: 2018-01-05T08:00:00 Last Updated: 2024-08-05T20:35:20.912Z Vendors: n/a Products: Advantech WebAccess Problem Types: CWE-22 Description: A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structure of the target device. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44278/ - http://www.securityfocus.com/bid/102424 - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02 - https://www.tenable.com/security/research/tra-2018-23
CVE ID: CVE-2017-16721 State: PUBLISHED Published: 2017-12-04T15:00:00 Last Updated: 2024-08-05T20:35:20.474Z Vendors: n/a Products: Geovap Reliance SCADA Problem Types: CWE-79 Description: A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unauthenticated attacker to inject arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102031 - https://ics-cert.us-cert.gov/advisories/ICSA-17-334-02
CVE ID: CVE-2017-16723 State: PUBLISHED Published: 2017-12-11T16:00:00 Last Updated: 2024-08-05T20:35:20.646Z Vendors: n/a Products: PHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH Problem Types: XSS Description: A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL COMSERVER UNI 232/422/485-T, FL COM SERVER RS232, FL COM SERVER RS485, and PSI-MODEM/ETH (running firmware versions prior to 1.99, 2.20, or 2.40). The cross-site scripting vulnerability has been identified, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - h
en identified, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/de-de/advisories/vde-2017-004 - https://ics-cert.us-cert.gov/advisories/ICSA-17-341-03 - http://www.securityfocus.com/bid/102111
CVE ID: CVE-2017-16724 State: PUBLISHED Published: 2018-01-05T08:00:00 Last Updated: 2024-08-05T20:35:20.312Z Vendors: n/a Products: Advantech WebAccess Problem Types: CWE-121 Description: A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows too much data to be written to a location on the stack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102424 - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02
CVE ID: CVE-2017-16725 State: PUBLISHED Published: 2017-12-20T19:00:00 Last Updated: 2024-08-05T20:35:20.568Z Vendors: n/a Products: Xiongmai Technology IP Cameras and DVRs Problem Types: stack-based buffer overflow Description: A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. The stack-based buffer overflow vulnerability has been identified, which may allow an attacker to execute code remotely or crash the device. After rebooting, the device restores itself to a more vulnerable state in which Telnet is accessible. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com
hich Telnet is accessible. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102125 - https://ics-cert.us-cert.gov/advisories/ICSA-17-341-01
CVE ID: CVE-2017-16726 State: PUBLISHED Published: 2018-06-27T19:00:00Z Last Updated: 2024-09-16T17:08:08.110Z Vendors: ICS-CERT Products: Beckhoff TwinCAT Problem Types: CWE-285 Description: Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve security purposes and therefore does not include any encryption algorithms because of their negative effect on performance and throughput. An attacker can forge arbitrary ADS packets when legitimate ADS traffic is observable. Additional Analyst Notes: - CVE Program Container: References: - https://download.beckhoff.com/download/Document/product-sec
tional Analyst Notes: - CVE Program Container: References: - https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2017-001.pdf
CVE ID: CVE-2017-16727 State: PUBLISHED Published: 2017-12-22T02:00:00 Last Updated: 2024-08-05T20:35:20.279Z Vendors: n/a Products: Moxa NPort W2150A and W2250A Problem Types: CWE-255 Description: A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is empty on the device. An unauthorized user can access the device without a password. An unauthorized user has the ability to completely compromise the confidentiality and integrity of the wireless traffic. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-355-01 - http://www.security
tes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-355-01 - http://www.securityfocus.com/bid/102254
CVE ID: CVE-2017-16728 State: PUBLISHED Published: 2018-01-05T08:00:00 Last Updated: 2024-08-05T20:35:20.278Z Vendors: n/a Products: Advantech WebAccess Problem Types: CWE-822 Description: An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attacker to cause the program to use an invalid memory address, resulting in a program crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102424 - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02
CVE ID: CVE-2017-16731 State: PUBLISHED Published: 2017-12-20T19:00:00 Last Updated: 2024-08-05T20:35:20.504Z Vendors: n/a Products: ABB Ellipse Problem Types: CWE-523 Description: An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select). A vulnerability exists in the authentication of Ellipse to LDAP/AD using the LDAP protocol. An attacker could exploit the vulnerability by sniffing local network traffic, allowing the discovery of authentication credentials. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-353-01
CVE ID: CVE-2017-16732 State: PUBLISHED Published: 2018-01-12T02:00:00 Last Updated: 2024-08-05T20:35:20.409Z Vendors: n/a Products: Advantech WebAccess Problem Types: CWE-416 Description: A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows an unauthenticated attacker to specify an arbitrary address. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A
CVE ID: CVE-2017-16733 State: PUBLISHED Published: 2017-12-20T19:00:00 Last Updated: 2024-08-05T20:35:20.617Z Vendors: n/a Products: Ecava IntegraXor Problem Types: SQL Injection Description: A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. The SQL Injection vulnerability has been identified, which an attacker can leverage to disclose sensitive information from the database. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-353-03
CVE ID: CVE-2017-16735 State: PUBLISHED Published: 2017-12-20T19:00:00 Last Updated: 2024-08-05T20:35:20.454Z Vendors: n/a Products: Ecava IntegraXor Problem Types: SQL Injection Description: A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. The SQL Injection vulnerability has been identified, which generates an error in the database log. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-353-03
CVE ID: CVE-2017-16736 State: PUBLISHED Published: 2018-01-12T02:00:00 Last Updated: 2024-08-05T20:35:20.670Z Vendors: n/a Products: Advantech WebAccess Problem Types: CWE-434 Description: An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows a remote attacker to upload arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A
CVE ID: CVE-2017-16737 State: PUBLISHED Published: 2018-01-12T20:00:00 Last Updated: 2024-08-05T20:35:20.570Z Vendors: n/a Products: WECON Technology Co., Ltd. LeviStudio HMI Editor Problem Types: CWE-122 Description: An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. A specially-crafted malicious file may be able to cause a heap-based buffer overflow vulnerability when opened by a user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102493 - https://ics-cert.us-cert.gov/advisories/ICSA-18-011-01
CVE ID: CVE-2017-16739 State: PUBLISHED Published: 2018-01-12T20:00:00 Last Updated: 2024-08-05T20:35:20.924Z Vendors: n/a Products: WECON Technology Co., Ltd. LeviStudio HMI Editor Problem Types: CWE-121 Description: An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. Specially-crafted malicious files may be able to cause stack-based buffer overflow vulnerabilities, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102493 - https://ics-cert.us-cert.gov/advisories/ICSA-18-011-01
CVE ID: CVE-2017-16740 State: PUBLISHED Published: 2018-01-09T21:00:00 Last Updated: 2024-08-05T20:35:21.014Z Vendors: n/a Products: Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers Problem Types: CWE-120 Description: A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and earlier. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102474 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1070883 - https://ics-cert.us-cert.gov/advi
bid/102474 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1070883 - https://ics-cert.us-cert.gov/advisories/ICSA-18-009-01
CVE ID: CVE-2017-16741 State: PUBLISHED Published: 2018-01-12T20:00:00 Last Updated: 2024-08-05T20:35:20.313Z Vendors: n/a Products: PHOENIX CONTACT FL SWITCH Problem Types: CWE-200 Description: An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to use Monitor Mode on the device to read diagnostic information. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2017-006 - https://ics-cert.us-cert.gov/advisories/ICSA-18-011-03
CVE ID: CVE-2017-16743 State: PUBLISHED Published: 2018-01-12T20:00:00 Last Updated: 2024-08-05T20:35:20.399Z Vendors: n/a Products: PHOENIX CONTACT FL SWITCH Problem Types: CWE-285 Description: An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing the attacker to obtain administrative privileges on the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2017-006 - https://ics-cert.us-cert.go
- CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2017-006 - https://ics-cert.us-cert.gov/advisories/ICSA-18-011-03
CVE ID: CVE-2017-16744 State: PUBLISHED Published: 2018-08-20T21:00:00Z Last Updated: 2024-09-17T00:42:31.941Z Vendors: ICS-CERT Products: Niagara AX Framework and Niagara 4 Framework Problem Types: CWE-22 Description: A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform (administrator) credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105101 - https://ics-cert.us-cert.gov/advisories/ICSA-18-191-03 - https://ics-cert.us-cert.gov/advisories/ICSA-19-022-01
CVE ID: CVE-2017-16745 State: PUBLISHED Published: 2018-03-15T23:00:00 Last Updated: 2024-08-05T20:35:20.911Z Vendors: n/a Products: Delta Electronics Delta Industrial Automation Screen Editor Problem Types: CWE-843 Description: A Type Confusion issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. An access of resource using incompatible type ('type confusion') vulnerability may allow an attacker to execute remote code when processing specially crafted .dpb files. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-01 - http://www.securityfocus.com/bid/102426
CVE ID: CVE-2017-16747 State: PUBLISHED Published: 2018-03-15T23:00:00 Last Updated: 2024-08-05T20:35:20.329Z Vendors: n/a Products: Delta Electronics Delta Industrial Automation Screen Editor Problem Types: CWE-787 Description: An Out-of-bounds Write issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. Specially crafted .dpb files may cause the system to write outside the intended buffer area. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-01 - http://www.securityfocus.com/bid/102426
CVE ID: CVE-2017-16748 State: PUBLISHED Published: 2018-08-20T21:00:00Z Last Updated: 2024-09-17T03:13:38.893Z Vendors: ICS-CERT Products: Niagara AX Framework and Niagara 4 Framework Problem Types: CWE-287 Description: An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105101 - https://ics-cert.us-cert.gov/advisories/ICSA-18-191-03 - https://ics-cert.us-cert.gov/advisories/ICSA-19-022-01
CVE ID: CVE-2017-16749 State: PUBLISHED Published: 2018-03-15T23:00:00 Last Updated: 2024-08-05T20:35:20.327Z Vendors: n/a Products: Delta Electronics Delta Industrial Automation Screen Editor Problem Types: CWE-416 Description: A Use-after-Free issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. Specially crafted .dpb files could exploit a use-after-free vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-01 - http://www.securityfocus.com/bid/102426
CVE ID: CVE-2017-16751 State: PUBLISHED Published: 2018-03-15T23:00:00 Last Updated: 2024-08-05T20:35:20.458Z Vendors: n/a Products: Delta Electronics Delta Industrial Automation Screen Editor Problem Types: CWE-121 Description: A Stack-based Buffer Overflow issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. Stack-based buffer overflow vulnerabilities caused by processing specially crafted .dpb files may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-01 - http://www.securityfocus.com/bid/102426
CVE ID: CVE-2017-16753 State: PUBLISHED Published: 2018-01-05T08:00:00 Last Updated: 2024-08-05T20:35:21.034Z Vendors: n/a Products: Advantech WebAccess Problem Types: CWE-20 Description: An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause the program to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102424 - https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02
CVE ID: CVE-2017-16754 State: PUBLISHED Published: 2017-11-09T19:00:00 Last Updated: 2024-08-05T20:35:20.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bolt/bolt/commit/aa21787241945457a2e4abc8b079672935fe0840 - http://www.securityfocus.com/bid/101777 - https://github.com/bolt/bolt/releases/tag/v3.3.6
CVE ID: CVE-2017-16755 State: PUBLISHED Published: 2018-02-19T14:00:00 Last Updated: 2024-08-05T20:35:21.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked. Additional Analyst Notes: - CVE Program Container: References: - https://www.helpspot.com/releases - https://ruby.sh/helpspot-disclosure-20180206.txt - https://www.helpspot.com/releases/version-4-7-2
CVE ID: CVE-2017-16756 State: PUBLISHED Published: 2018-02-19T14:00:00 Last Updated: 2024-08-05T20:35:20.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account. Additional Analyst Notes: - CVE Program Container: References: - https://www.helpspot.com/releases - https://ruby.sh/helpspot-disclosure-20180206.txt - https://www.helpspot.com/releases/version-4-7-2
CVE ID: CVE-2017-16757 State: PUBLISHED Published: 2017-11-09T21:00:00 Last Updated: 2024-08-05T20:35:20.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hola VPN 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, which allows local users to gain privileges via a Trojan horse 7za.exe or hola.exe file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101787 - https://www.vulnerability-lab.com/get_content.php?id=2062
CVE ID: CVE-2017-16758 State: PUBLISHED Published: 2017-11-09T22:00:00 Last Updated: 2024-08-05T20:35:21.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "access_token" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8947 - https://plugins.trac.wordpress.org/changeset/1758562/ultimate-instagram-feed - https://packetstormsecurity.com/files/144921/WordPress-Ultimate-Instagram-Feed-1.2-Cross-Site-S
ltimate-instagram-feed - https://packetstormsecurity.com/files/144921/WordPress-Ultimate-Instagram-Feed-1.2-Cross-Site-Scripting.html