Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re
880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apach
3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2017-3168 State: REJECTED Published: 2017-08-11T01:00:00 Last Updated: 2017-08-11T00:57:01 Description: No description available.
CVE ID: CVE-2017-3169 State: PUBLISHED Published: 2017-06-20T01:00:00 Last Updated: 2024-08-05T14:16:28.220Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-476 Description: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208221 - https://access.redhat.com/errata/RHSA-2017:2479 - https://access.redhat.com/errata/RHSA-2017:2483 - https://security.netapp.com/advisory/ntap-20180601-0002/ - https://lists.apache.org/thre
hat.com/errata/RHSA-2017:2483 - https://security.netapp.com/advisory/ntap-20180601-0002/ - https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae%40%3Cdev.httpd.apache.org%3E - https://www.nomachine.com/SU08O00185 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us - https://access.redhat.com/errata/RHSA-2017:3475 - https://access.redhat.com/errata/RHSA-2017:3195 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - https://access.redhat.com/errata/RHSA-2017:3476 - https://access.redhat.com/errata/RHSA-2017:3477 - http://www.debian.org/security/2017/dsa-3896 - https://access.redhat.c
https://access.redhat.com/errata/RHSA-2017:3477 - http://www.debian.org/security/2017/dsa-3896 - https://access.redhat.com/errata/RHSA-2017:3194 - https://access.redhat.com/errata/RHSA-2017:3193 - http://www.securitytracker.com/id/1038711 - https://github.com/gottburgm/Exploits/tree/master/CVE-2017-3169 - http://www.securityfocus.com/bid/99134 - https://security.gentoo.org/glsa/201710-32 - https://access.redhat.com/errata/RHSA-2017:2478 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https:/
s.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r
43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apac
%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2
0d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E - https://lists.
.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2017-3170 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3171 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3172 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3173 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3174 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3175 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3176 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3177 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3178 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3179 State: REJECTED Published: 2018-09-11T19:00:00 Last Updated: 2018-09-11T18:57:01 Description: No description available.
CVE ID: CVE-2017-3180 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T14:16:28.225Z Vendors: TIBCO Products: Silver Fabric Enabler for Spotfire Web Player , Spotfire Analyst, Spotfire Analytics Platform for AWS Marketplace, Spotfire Automation Services 6, Spotfire Connectors, Spotfire Deployment Kit, Spotfire Desktop, Spotfire Desktop Developer Edition, Spotfire Desktop Language Packs, Spotfire Professional, Spotfire Web Player Problem Types: CWE-20 Description: Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbit
lities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The products and versions that are affected include the following: TIBCO Silver Fabric Enabler for Spotfire Web Player 2.1.2 and earlier TIBCO Spotfire Analyst 7.5.0 TIBCO Spotfire Analyst 7.6.0 TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Analytics Platform for AWS Marketplace 7.0.2 and earlier TIBCO Spotfire Automation Services 6.5.3 and earlier TIBCO Spotfire Automation Servic
AWS Marketplace 7.0.2 and earlier TIBCO Spotfire Automation Services 6.5.3 and earlier TIBCO Spotfire Automation Services 7.0.0, and 7.0.1 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 6.5.3 and earlier TIBCO Spotfire Deployment Kit 7.0.0, and 7.0.1 TIBCO Spotfire Deployment Kit 7.5.0 TIBCO Spotfire Deployment Kit 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 6.5.2 and earlier TIBCO Spotfire Desktop 7.0.0, and 7.0.1 TIBCO Spotfire Desktop 7.5.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.0.1 and earlier TIBCO Spotfire Desktop Language Packs 7.5.0 TIBCO Spot
ion 7.7.0 TIBCO Spotfire Desktop Language Packs 7.0.1 and earlier TIBCO Spotfire Desktop Language Packs 7.5.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 TIBCO Spotfire Professional 6.5.3 and earlier TIBCO Spotfire Professional 7.0.0 and 7.0.1 TIBCO Spotfire Web Player 6.5.3 and earlier TIBCO Spotfire Web Player 7.0.0 and 7.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com//support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3180 - https://www.securityfocus.com/bid/95699
CVE ID: CVE-2017-3181 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T14:16:28.244Z Vendors: TIBCO Products: Spotfire Analyst, Spotfire Connectors, Spotfire Deployment Kit, Spotfire Desktop, Spotfire Desktop Developer Edition, Spotfire Desktop Language Packs, Spotfire Web Player Client, Spotfire Client Problem Types: CWE-89 Description: Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying dat
n attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-j
Notes: - CVE Program Container: References: - https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3181 - https://www.securityfocus.com/bid/95696
CVE ID: CVE-2017-3182 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T14:16:28.142Z Vendors: ThreatMetrix Products: SDK Problem Types: CWE-295 Description: On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attack. ThreatMetrix is a security library for mobile applications, which aims to provide fraud prevention and device identity capabilities. The ThreatMetrix SDK versions prior to 3.2 do not validate SSL certificates on the iOS platform. An affected application will communicate with https://h-sdk.online-metrix.net, regardl
certificates on the iOS platform. An affected application will communicate with https://h-sdk.online-metrix.net, regardless of whether the connection is secure or not. An attacker on the same network as or upstream from the iOS device may be able to view or modify ThreatMetrix network traffic that should have been protected by HTTPS. Additional Analyst Notes: - CVE Program Container: References: - https://www.securityfocus.com/bid/95360 - https://www.kb.cert.org/vuls/id/767208
CVE ID: CVE-2017-3183 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T14:16:28.331Z Vendors: Sage Products: XRT Treasury Problem Types: CWE-639 Description: Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Sage XRT Treasury is a business finance management application. Database user access privileges are determined by the USER_CODE field associated with the querying user. By modifying the USER_CODE value to match that of a privileged user, a low-privileged, authenticated user may gain privileged access to the SQL database. A remot
that of a privileged user, a low-privileged, authenticated user may gain privileged access to the SQL database. A remote, authenticated user can submit specially crafted SQL queries to gain privileged access to the application database. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/742632 - https://www.securityfocus.com/bid/96477
CVE ID: CVE-2017-3184 State: PUBLISHED Published: 2017-12-15T14:00:00 Last Updated: 2024-08-05T14:16:28.231Z Vendors: ACTi Corporation Products: ACTi D, B, I, and E series cameras Problem Types: CWE-306 Description: ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unauthenticated, remote attacker can exploit this vulnerability by directly accessing the http://x.x.x.x/setup/setup_maintain_firmware-default.html page. This will allow an attacker to perform a factory reset on the device, leading to a denial of service condition or the ability to make use of default credentials (CVE-2017-3186
on the device, leading to a denial of service condition or the ability to make use of default credentials (CVE-2017-3186). Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/hack3rsca/status/839599437907386368 - http://www.securityfocus.com/bid/96720/info - https://twitter.com/Hfuhs/status/839252357221330944 - https://www.kb.cert.org/vuls/id/355151
CVE ID: CVE-2017-3185 State: PUBLISHED Published: 2017-12-15T14:00:00 Last Updated: 2024-08-05T14:16:28.235Z Vendors: ACTi Corporation Products: ACTi D, B, I, and E series cameras Problem Types: CWE-598 Description: ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/hack3rsca/status/839599437907386368 - http://www.securityfo
: - CVE Program Container: References: - https://twitter.com/hack3rsca/status/839599437907386368 - http://www.securityfocus.com/bid/96720/info - https://twitter.com/Hfuhs/status/839252357221330944 - https://www.kb.cert.org/vuls/id/355151
CVE ID: CVE-2017-3186 State: PUBLISHED Published: 2017-12-15T14:00:00 Last Updated: 2024-08-05T14:16:28.334Z Vendors: ACTi Corporation Products: ACTi D, B, I, and E series cameras Problem Types: CWE-521 Description: ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take complete control of a device using default admin credentials. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/hack3rsca/status/839599437907386368 - http://www.securityfocus.com/bid/96720/info - https://twitter.com/Hfuhs/status/839252357221330944 - https://www.kb.cert.org/v
//www.securityfocus.com/bid/96720/info - https://twitter.com/Hfuhs/status/839252357221330944 - https://www.kb.cert.org/vuls/id/355151
CVE ID: CVE-2017-3187 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T14:16:28.217Z Vendors: docCMS Products: Administration Panel Problem Types: CWE-352 Description: The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execut
te attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/168699 - http://www.securityfocus.com/bid/96616
CVE ID: CVE-2017-3188 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T14:16:28.240Z Vendors: docCMS Products: Administration Panel Problem Types: CWE-22 Description: The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, the filenames of its contents are not properly checked, allowing for writing files to arbitrary directories on the file system. These archives may be uploaded directly via the administrator panel, or using the CSRF vulnerability (CVE-2017-3187). An unauthenticated remote attacker ma
ctly via the administrator panel, or using the CSRF vulnerability (CVE-2017-3187). An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/168699 - http://www.securityfocus.com/bid/96616
CVE ID: CVE-2017-3189 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T14:16:28.234Z Vendors: docCMS Products: Administration Panel Problem Types: CWE-434 Description: The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle contains. This vulnerability combined with the path traversal vulnerability (CVE-2017-3188) can lead to remote command execution with the permissions of the user running the dotCMS application. An unauthenticated rem
lead to remote command execution with the permissions of the user running the dotCMS application. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/168699 - http://www.securityfocus.com/bid/96616
CVE ID: CVE-2017-3190 State: PUBLISHED Published: 2017-12-15T14:00:00 Last Updated: 2024-08-05T14:16:28.226Z Vendors: Flash Seats Products: Flash Seats Mobile App Problem Types: CWE-295 Description: Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/ - https://www.kb.cert.org/vuls/id/247016 - http://www.securityfocus.com/b
ios-fails-to-validate-ssl-certificates.392553/ - https://www.kb.cert.org/vuls/id/247016 - http://www.securityfocus.com/bid/96719
CVE ID: CVE-2017-3191 State: PUBLISHED Published: 2017-12-15T14:00:00 Last Updated: 2024-08-05T14:16:28.213Z Vendors: D-Link Products: DIR-130, DIR-330 Problem Types: CWE-294 Description: D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages such as tools_admin.asp without credentials. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/123293 - https://www.kb.cert.org/vuls/id/553503 - htt
References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/123293 - https://www.kb.cert.org/vuls/id/553503 - https://www.wilderssecurity.com/threads/d-link-dir-130-and-dir-330-are-vulnerable-to-authentication-bypass-and-do-not-protect-credentials.392703/ - https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/
CVE ID: CVE-2017-3192 State: PUBLISHED Published: 2017-12-15T14:00:00 Last Updated: 2024-08-05T14:16:28.229Z Vendors: D-Link Products: DIR-130, DIR-330 Problem Types: CWE-522 Description: D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/553503 - https://w
ice. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/553503 - https://www.wilderssecurity.com/threads/d-link-dir-130-and-dir-330-are-vulnerable-to-authentication-bypass-and-do-not-protect-credentials.392703/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/123292 - https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/