Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-14582 State: PUBLISHED Published: 2017-09-29T20:00:00 Last Updated: 2024-08-05T19:34:38.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101091 - https://wwws.nightwatchcybersecurity.com/2017/09/27/zoho-site24x7-mobile-network-poller-for-android-didnt-properly-validate-ssl-cve-2017-14582/
CVE ID: CVE-2017-14583 State: PUBLISHED Published: 2017-12-18T14:00:00Z Last Updated: 2024-09-17T01:00:35.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a Denial of Service (DoS) in SMB environments. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20171215-0001/
CVE ID: CVE-2017-14585 State: PUBLISHED Published: 2017-11-27T16:00:00Z Last Updated: 2024-09-16T19:31:45.090Z Vendors: Atlassian Products: Hipchat Server, Hipchat Data Center Problem Types: Remote Code Execution Description: A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected. Additional Analyst Notes: - CVE Program Container: References: - ht
r starting with 3.0.0 and before 3.1.0 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/HCPUB-3526 - http://www.securityfocus.com/bid/101945 - https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html
CVE ID: CVE-2017-14586 State: PUBLISHED Published: 2017-11-27T16:00:00Z Last Updated: 2024-09-16T18:08:06.305Z Vendors: Atlassian Products: Hipchat for Mac desktop client Problem Types: Client Side Remote Code Execution Description: The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above version 4.0 and before version 4.30 are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101947 - https://jira.atlassian.com/browse/HCPUB-3473 - https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-93
ira.atlassian.com/browse/HCPUB-3473 - https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html
CVE ID: CVE-2017-14587 State: PUBLISHED Published: 2017-10-11T18:00:00Z Last Updated: 2024-09-17T01:55:33.174Z Vendors: Atlassian Products: Atlassian Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101266 - https://jira.atlassian.com/browse/CRUC-8112 - https://jira.atlassian.com/browse/FE-6933
CVE ID: CVE-2017-14588 State: PUBLISHED Published: 2017-10-11T18:00:00Z Last Updated: 2024-10-15T19:14:38.109Z Vendors: Atlassian Products: Atlassian Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/101268 - https://jira.atlassian.com/browse/FE-6935 - https://jira.atlassian.com/browse/CRUC-8113
CVE ID: CVE-2017-14589 State: PUBLISHED Published: 2017-12-13T15:00:00Z Last Updated: 2024-09-16T19:10:55.831Z Vendors: Atlassian Products: Bamboo Problem Types: Remote Code Execution Description: It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration rights to Bamboo or who hosts a website that a Bamboo administrator visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Bamboo. All versions of Bamboo before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this v
ore 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BAM-18842 - http://www.securityfocus.com/bid/102188 - https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html
CVE ID: CVE-2017-14590 State: PUBLISHED Published: 2017-12-13T15:00:00Z Last Updated: 2024-09-16T22:50:26.106Z Vendors: Atlassian Products: Bamboo Problem Types: Remote Code Execution Description: Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to create a repository in Bamboo, edit an existing plan that has a non-linked Mercurialrepository, create or edit a plan when there is at least one linked Mercurial repository that the attacker has permission to use, or commit to a Mercurial repository used by a Bamboo plan which has branch detection enabled can execute code of their choice on systems that run a vul
tory used by a Bamboo plan which has branch detection enabled can execute code of their choice on systems that run a vulnerable version of Bamboo Server. Versions of Bamboo starting with 2.7.0 before 6.1.6 (the fixed version for 6.1.x) and from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BAM-18843 - http://www.securityfocus.com/bid/102193 - https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-12-13-939939816.html
CVE ID: CVE-2017-14591 State: PUBLISHED Published: 2017-11-29T21:00:00Z Last Updated: 2024-09-16T20:46:54.683Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Arbitrary Code Execution Description: Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.atlassian.com/x/plcGO - http://www.securityfocus.com/bid/102194
CVE ID: CVE-2017-14592 State: PUBLISHED Published: 2018-01-26T02:00:00Z Last Updated: 2024-09-16T22:09:36.844Z Vendors: Atlassian Products: Sourcetree for macOS Problem Types: OS Command Injection Description: Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree for macOS, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler. Versions of Sourcetree for macOS starting with 1.0b2 before version 2.7.0 are affect
use of the Sourcetree URI handler. Versions of Sourcetree for macOS starting with 1.0b2 before version 2.7.0 are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/SRCTREE-5243 - http://www.securityfocus.com/bid/102926 - https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
CVE ID: CVE-2017-14593 State: PUBLISHED Published: 2018-01-26T02:00:00Z Last Updated: 2024-09-17T01:56:19.487Z Vendors: Atlassian Products: Sourcetree for Windows Problem Types: OS Command Injection Description: Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. From version 0.8.4b of Sourcetree for Windows, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler. Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4
rough the use of the Sourcetree URI handler. Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4.7.0 are affected by this vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102926 - https://jira.atlassian.com/browse/SRCTREEWIN-8256 - https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
CVE ID: CVE-2017-14594 State: PUBLISHED Published: 2018-01-12T14:00:00Z Last Updated: 2024-09-16T17:14:01.826Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-66495
CVE ID: CVE-2017-14595 State: PUBLISHED Published: 2017-09-20T18:00:00 Last Updated: 2024-08-05T19:34:38.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/710-20170901-core-information-disclosure - http://www.securitytracker.com/id/1039407 - http://www.securityfocus.com/bid/100900
CVE ID: CVE-2017-14596 State: PUBLISHED Published: 2017-09-20T18:00:00 Last Updated: 2024-08-05T19:34:39.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/711-20170902-core-ldap-information-disclosure - https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/ - http://www.securitytracker.com/id/1039407 - http://www.securityfocus.com/bid/100898
CVE ID: CVE-2017-14597 State: PUBLISHED Published: 2017-09-19T07:00:00Z Last Updated: 2024-09-16T19:31:49.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain. Additional Analyst Notes: - CVE Program Container: References: - https://auroramail.wordpress.com/2017/08/28/vulnerability-in-webmailaurora-closed/
CVE ID: CVE-2017-14600 State: PUBLISHED Published: 2017-09-19T07:00:00Z Last Updated: 2024-09-17T03:28:27.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injection in cms/admin.lib.php via $_GET['del_black'], resulting in Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/delta/pragyan/issues/228
CVE ID: CVE-2017-14601 State: PUBLISHED Published: 2017-09-19T07:00:00Z Last Updated: 2024-09-16T17:23:13.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pragyan CMS v3.0 is vulnerable to a Boolean-based SQL injection in cms/admin.lib.php via $_GET['forwhat'], resulting in Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/delta/pragyan/issues/228
CVE ID: CVE-2017-14602 State: PUBLISHED Published: 2017-09-26T14:00:00 Last Updated: 2024-08-05T19:34:38.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before build 135.18, 10.5 before build 66.9, 10.5e before build 60.7010.e, 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13 (except for build 41.24) that, if exploited, could allow an attacker with access to the NetScaler management interface to gain administrative access to the appliance. Additional Analyst Notes: - CVE Program Container: References:
interface to gain administrative access to the appliance. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX228091 - https://support.citrix.com/article/CTX227928 - http://www.securityfocus.com/bid/100980
CVE ID: CVE-2017-14603 State: PUBLISHED Published: 2017-10-09T14:00:00 Last Updated: 2024-08-05T19:34:39.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2017-008.html - http://www.debian.org/security/2017/dsa-3990 - htt
ces: - http://downloads.asterisk.org/pub/security/AST-2017-008.html - http://www.debian.org/security/2017/dsa-3990 - https://issues.asterisk.org/jira/browse/ASTERISK-27274
CVE ID: CVE-2017-14604 State: PUBLISHED Published: 2017-09-20T08:00:00 Last Updated: 2024-08-05T19:34:39.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solu
sion. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/freedomofpress/securedrop/issues/2238 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268 - https://github.com/GNOME/nautilus/commit/1630f53481f445ada0a455e9979236d31a8d3bb0 - https://bugzilla.gnome.org/show_bug.cgi?id=777991 - http://www.securityfocus.com/bid/101012 - http://www.debian.org/security/2017/dsa-3994 - https://g
w_bug.cgi?id=777991 - http://www.securityfocus.com/bid/101012 - http://www.debian.org/security/2017/dsa-3994 - https://github.com/GNOME/nautilus/commit/bc919205bf774f6af3fa7154506c46039af5a69b - https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/ - https://access.redhat.com/errata/RHSA-2018:0223
CVE ID: CVE-2017-14607 State: PUBLISHED Published: 2017-09-20T17:00:00 Last Updated: 2024-08-05T19:34:39.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to ReadTIFFImage has been reported in coders/tiff.c. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4040 - https://usn.ubuntu.com/3681-1/ - https://www.debian.org/security/2017/dsa-4032 - https://github.com/ImageMagick/ImageMagick/issues/765 - http://www.securityfocus.com/bid/100944
CVE ID: CVE-2017-14608 State: PUBLISHED Published: 2017-09-20T17:00:00 Last Updated: 2024-08-05T19:34:39.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21 - https://github.com/LibRaw/LibRaw/issues/101
CVE ID: CVE-2017-14609 State: PUBLISHED Published: 2017-09-20T18:00:00Z Last Updated: 2024-09-17T00:16:42.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by bearerbox. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.kannel.org/issues/771
CVE ID: CVE-2017-14610 State: PUBLISHED Published: 2017-09-20T18:00:00Z Last Updated: 2024-09-16T17:32:56.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.bareos.org/view.php?id=847
CVE ID: CVE-2017-14611 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T19:34:38.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetch_url_contents component. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Apr/15
CVE ID: CVE-2017-14612 State: PUBLISHED Published: 2018-07-12T16:00:00 Last Updated: 2024-08-05T19:34:38.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: "Shpock Boot Sale & Classifieds" app before 3.17.0 -- aka shpock-boot-sale-classifieds/id557153158 -- for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.crissyfield.de/blog/2017/12/14/missing-certificate-validation/
CVE ID: CVE-2017-14614 State: PUBLISHED Published: 2017-10-09T14:00:00 Last Updated: 2024-08-05T19:34:39.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remote authenticated users to read arbitrary files on remote cluster nodes via a crafted path. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/10/05/1
CVE ID: CVE-2017-14615 State: PUBLISHED Published: 2017-09-20T20:00:00 Last Updated: 2024-08-05T19:34:39.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the context of any logged in user in the Web UI visiting "Traffic Monitor" sections "Events" and "All." As a side effect, no further events will be visible in the Traffic Monitor until the device is restarted. Additional Analyst Notes: - C
t, no further events will be visible in the Traffic Monitor until the device is restarted. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2017/Sep/22 - https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-Sidertia - https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000L0HSAU&lang=en_US
CVE ID: CVE-2017-14616 State: PUBLISHED Published: 2017-09-20T20:00:00 Last Updated: 2024-08-05T19:34:39.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login attempts, UI management of the device becomes impossible. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/540427 - https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fir
ces: - http://www.securityfocus.com/archive/1/540427 - https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-Sidertia
CVE ID: CVE-2017-14617 State: PUBLISHED Published: 2017-09-20T21:00:00Z Last Updated: 2024-09-16T18:19:50.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=102854
CVE ID: CVE-2017-14618 State: PUBLISHED Published: 2017-09-20T21:00:00 Last Updated: 2024-08-05T19:34:39.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42761/ - https://packetstormsecurity.com/files/144280/phpMyFAQ-2.9.8-Cross-Site-Scripting.html - http://www.phpmyfaq.de/security/advisory-2017-10-19
CVE ID: CVE-2017-14619 State: PUBLISHED Published: 2017-09-20T21:00:00 Last Updated: 2024-08-05T19:34:39.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42987/ - https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86 - http://www.phpmyfaq.de/security/advisory-2017-10-19 - https://packetstormsecurity.com/files/144603/phpMyFAQ-2.9.8-Cross-Site-Scripting.html