Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-5584 State: PUBLISHED Published: 2017-03-15T14:00:00 Last Updated: 2024-08-05T15:04:15.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1, 6.x before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96371 - http://www.securitytracker.com/id/1037889 - https://security.paloaltonetworks.com/CVE-2017-5584
CVE ID: CVE-2017-5585 State: PUBLISHED Published: 2017-02-22T16:00:00 Last Updated: 2024-08-05T15:04:15.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and return_top_results_row_based config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2520. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/141
CVE-2014-2520. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/141124/OpenText-Documentum-Content-Server-7.3-SQL-Injection.html - http://www.securityfocus.com/bid/96224
CVE ID: CVE-2017-5586 State: PUBLISHED Published: 2017-02-22T16:00:00 Last Updated: 2024-08-05T15:04:15.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the BeanShell (bsh) and Apache Commons Collections (ACC) libraries. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/141105/OpenText-Documentum-D2-4.x-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/41366/ - http://www.securityfocus.com/bid/96216
CVE ID: CVE-2017-5589 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android). Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/02/09/29 - https://github.com/ge0rg/yaxim/commit/65a38dc77545d9568732189e86089390f0ceaf9f - http://www.securi
urity/2017/02/09/29 - https://github.com/ge0rg/yaxim/commit/65a38dc77545d9568732189e86089390f0ceaf9f - http://www.securityfocus.com/bid/96170 - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
CVE ID: CVE-2017-5590 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for ChatSecure (3.2.0 - 4.0.0; only iOS) and Zom (all versions up to 1.0.11; only iOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zom/Zom-iOS/commit/880051eaa8ba32d1b257c87a7d8798a93561bfd3 - http://openwall.com/lists/oss-
ences: - https://github.com/zom/Zom-iOS/commit/880051eaa8ba32d1b257c87a7d8798a93561bfd3 - http://openwall.com/lists/oss-security/2017/02/09/29 - http://www.securityfocus.com/bid/96165 - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf - https://github.com/ChatSecure/ChatSecure-iOS/commit/a340b4bb519227d89f85f2716a10a197a65d4856
CVE ID: CVE-2017-5591 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96166 - http://openwall.com/lists/oss-security/2
- CVE Program Container: References: - http://www.securityfocus.com/bid/96166 - http://openwall.com/lists/oss-security/2017/02/09/29 - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf - https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8
CVE ID: CVE-2017-5592 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0). Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/02/09/29 - http://www.securityfocus.com/bid/96173 - https://github.com/boothj5/profanity/commit/8e75437a7e43d4c55e861691f748
9/29 - http://www.securityfocus.com/bid/96173 - https://github.com/boothj5/profanity/commit/8e75437a7e43d4c55e861691f74892e666e29b0b - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
CVE ID: CVE-2017-5593 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Psi+ (0.16.563.580 - 0.16.571.627). Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/02/09/29 - https://github.com/psi-im/iris/pull/47/commits/02e976d4426a1319a7af7d26d7aba9d8c6077570 - https://rt-sol
2017/02/09/29 - https://github.com/psi-im/iris/pull/47/commits/02e976d4426a1319a7af7d26d7aba9d8c6077570 - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf - http://www.securityfocus.com/bid/96169
CVE ID: CVE-2017-5594 State: PUBLISHED Published: 2017-01-25T18:00:00 Last Updated: 2024-08-05T15:04:15.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95806 - https://securelayer7.net/download/poc/password-reset-vulnerability-exploit-ruby-pagekit-cms.rb.txt - https://github.com/pagekit/pagekit/commit/e0454f9c
ad/poc/password-reset-vulnerability-exploit-ruby-pagekit-cms.rb.txt - https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b - https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf - https://www.exploit-db.com/exploits/41143/
CVE ID: CVE-2017-5595 State: PUBLISHED Published: 2017-02-06T17:00:00 Last Updated: 2024-08-05T15:04:15.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file&path= request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Feb/11 - http://
dditional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Feb/11 - http://www.securityfocus.com/bid/96125 - https://github.com/ZoneMinder/ZoneMinder/commit/8b19fca9927cdec07cc9dd09bdcf2496a5ae69b3 - http://seclists.org/bugtraq/2017/Feb/6
CVE ID: CVE-2017-5596 State: PUBLISHED Published: 2017-01-25T21:00:00 Last Updated: 2024-08-05T15:04:15.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=781f03580c81339513bb1238b202b72469a1240b - http://www.securityfocus.com/bid/95795 - https://bugs.wireshark.org/bugzilla/show_
3580c81339513bb1238b202b72469a1240b - http://www.securityfocus.com/bid/95795 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13344 - https://www.wireshark.org/security/wnpa-sec-2017-01.html - http://www.debian.org/security/2017/dsa-3811 - https://code.wireshark.org/review/#/c/19746/ - http://www.securitytracker.com/id/1037694
CVE ID: CVE-2017-5597 State: PUBLISHED Published: 2017-01-25T21:00:00 Last Updated: 2024-08-05T15:04:15.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dhcpv6.c by changing a data type to avoid an integer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2017-02.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=57894f741f7cc98b46c9fdce7eee8256d2a4ae3f - https://code.wireshark.org/re
rg/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=57894f741f7cc98b46c9fdce7eee8256d2a4ae3f - https://code.wireshark.org/review/#/c/19747/ - http://www.securityfocus.com/bid/95798 - http://www.debian.org/security/2017/dsa-3811 - http://www.securitytracker.com/id/1037694 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13345
CVE ID: CVE-2017-5598 State: PUBLISHED Published: 2017-01-27T10:10:00 Last Updated: 2024-08-05T15:04:15.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability affects the EmployeePortalServlet page and the following parameter: employer. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/malerisch/de
rameter: employer. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/malerisch/ded4d6e6e980667ee9f7fc7f2818f4fa - http://www.securityfocus.com/bid/95836
CVE ID: CVE-2017-5599 State: PUBLISHED Published: 2017-01-27T10:10:00 Last Updated: 2024-08-05T15:04:15.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a reflected Cross Site Scripting vulnerability which affects the raceMasterList.jsp page within the Patient Portal. Inserted payload is rendered within the Patient Portal and the raceMasterList.jsp page does not require authentication. The vulnerability can be used to extract sensitive information or perform attacks against the user's browser. The vulnerability affects the raceMasterList.jsp page and the following parameter: race. Additional Analyst
r's browser. The vulnerability affects the raceMasterList.jsp page and the following parameter: race. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95835 - https://gist.github.com/malerisch/8a2c195f385dff7f935db831a8dc2697
CVE ID: CVE-2017-5600 State: PUBLISHED Published: 2017-02-02T15:00:00 Last Updated: 2024-08-05T15:04:15.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privileged account. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/s/article/NTAP-20170131-0001 - http://www.securityfocus.com/bid/96041
CVE ID: CVE-2017-5601 State: PUBLISHED Published: 2017-01-27T22:01:00 Last Updated: 2024-08-05T15:04:15.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive. Additional Analyst Notes: - CVE Program Container: References: - https://secunia.com/secunia_research/2017-3/ - https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9 - http://www.securityfocus.com/bid/95837 - https://lists.debian.org/debian-lts-announce/20
854bf987557e55e55fff7abbf3ea9 - http://www.securityfocus.com/bid/95837 - https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html - http://www.securitytracker.com/id/1037974
CVE ID: CVE-2017-5602 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for jappix 1.0.0 to 1.1.6. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96176 - http://openwall.com/lists/oss-security/2017/02/09/29 - https://github.com/jappix/jappix/commit/ea6de7c65b80880bdf85df47c1a8a5d3d684
wall.com/lists/oss-security/2017/02/09/29 - https://github.com/jappix/jappix/commit/ea6de7c65b80880bdf85df47c1a8a5d3d68491af - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
CVE ID: CVE-2017-5603 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/02/09/29 - http://www.securityfocus.com/bid/96174 - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https:/
9/29 - http://www.securityfocus.com/bid/96174 - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf - https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315
CVE ID: CVE-2017-5604 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for mcabber 1.0.0 - 1.0.4. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96184 - http://openwall.com/lists/oss-security/2017/02/09/29 - https://mcabber.com/hg/rev/2a9569fd7644 - https://rt-solutions.de/en/2017/02
wall.com/lists/oss-security/2017/02/09/29 - https://mcabber.com/hg/rev/2a9569fd7644 - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
CVE ID: CVE-2017-5605 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Movim 0.8 - 0.10. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/02/09/29 - http://www.securityfocus.com/bid/96177 - https://github.com/movim/moxl/commit/838b0a42efc3b67cc17d63e25ae1d0ea849cd89b - h
tp://www.securityfocus.com/bid/96177 - https://github.com/movim/moxl/commit/838b0a42efc3b67cc17d63e25ae1d0ea849cd89b - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
CVE ID: CVE-2017-5606 State: PUBLISHED Published: 2017-02-09T20:00:00 Last Updated: 2024-08-05T15:04:15.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Xabber (only if manually enabled: 1.0.30, 1.0.30 VIP, beta 1.0.3 - 1.0.74; Android). Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/02/09/29 - http://www.securityfocus.com/bid/96186 - https://rt-sol
rences: - http://openwall.com/lists/oss-security/2017/02/09/29 - http://www.securityfocus.com/bid/96186 - https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ - https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
CVE ID: CVE-2017-5607 State: PUBLISHED Published: 2017-04-10T15:00:00 Last Updated: 2024-08-05T15:04:15.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038170 - https://www.exploit-db.com/exploits/4
- CVE Program Container: References: - http://www.securitytracker.com/id/1038170 - https://www.exploit-db.com/exploits/41779/ - http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt - http://www.securityfocus.com/bid/97286 - http://seclists.org/fulldisclosure/2017/Mar/89 - https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607 - http://www.securityfocus.com/archive/1/540346/100/0/threaded - http://www.securityfocus.com/bid/97265
CVE ID: CVE-2017-5608 State: PUBLISHED Published: 2017-01-28T18:00:00 Last Updated: 2024-08-05T15:04:15.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the image upload function in Piwigo before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via a crafted image filename. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/600 - http://www.securityfocus.com/bid/95848 - https://github.com/Piwigo/Piwigo/commit/6ec3f2d0fae0437f0c2cc8c475a26fb6aeb0d4cb - http://piwigo.org/releases/2.8.6
CVE ID: CVE-2017-5609 State: PUBLISHED Published: 2017-01-28T18:00:00 Last Updated: 2024-08-05T15:04:15.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95850 - https://github.com/s9y/Serendipity/releases/tag/2.1-rc1 - https://github.com/s9y/Serendipity/commit/c62d667287f2d76c81e03a740a581eb3c51249b6
CVE ID: CVE-2017-5610 State: PUBLISHED Published: 2017-01-30T04:24:00 Last Updated: 2024-08-05T15:04:15.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms. Additional Analyst Notes: - CVE Program Container: References: - https://codex.wordpress.org/Version_4.7.2 - http://www.securityfocus.com/bid/95816 - http://www.debian.org/security/2017/dsa-3779 - http://www.openwall.com/lists/oss-security/2017/01/28/5 - https://github.com/WordPress/
ian.org/security/2017/dsa-3779 - http://www.openwall.com/lists/oss-security/2017/01/28/5 - https://github.com/WordPress/WordPress/commit/21264a31e0849e6ff793a06a17de877dd88ea454 - https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ - https://wpvulndb.com/vulnerabilities/8729 - http://www.securitytracker.com/id/1037731
CVE ID: CVE-2017-5611 State: PUBLISHED Published: 2017-01-30T04:24:00 Last Updated: 2024-08-05T15:04:15.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95816 - http://www.debian.org/security/2017/dsa-3779 - http://www.openwall.com/lists/oss-security/2017/01/28/5 - http://www.securitytracker.com/id/1037731 - https://www.oracle.
ttp://www.openwall.com/lists/oss-security/2017/01/28/5 - http://www.securitytracker.com/id/1037731 - https://www.oracle.com/security-alerts/cpujan2021.html - https://codex.wordpress.org/Version_4.7.2 - https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ - https://github.com/WordPress/WordPress/commit/85384297a60900004e27e417eac56d24267054cb - https://wpvulndb.com/vulnerabilities/8730