Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
elete data, by supplying specially crafted strings in input parameters of the web service call. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100957 - http://www.securitytracker.com/id/1039418 - http://seclists.org/fulldisclosure/2017/Sep/51 - http://www.securitytracker.com/id/1039417
CVE ID: CVE-2017-8008 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-01-03T14:57:01 Description: No description available.
CVE ID: CVE-2017-8009 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-01-03T14:57:01 Description: No description available.
CVE ID: CVE-2017-8010 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-8011 State: PUBLISHED Published: 2017-07-17T14:00:00 Last Updated: 2024-08-05T16:19:29.762Z Vendors: n/a Products: EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net) Problem Types: undocumented accounts vulnerability Description: EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service
mote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038905 - http://www.securityfocus.com/bid/99555 - http://seclists.org/fulldisclosure/2017/Jul/21
CVE ID: CVE-2017-8012 State: PUBLISHED Published: 2017-09-22T01:00:00 Last Updated: 2024-08-05T16:19:29.486Z Vendors: n/a Products: EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net) for SAS Solution Packs Problem Types: Denial of Service Description: In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Java Management Extensions (JMX) protocol used to communicate between components in the Alerting and/or Compliance components can be leveraged to create a denial of service (DoS) condition. Attackers with knowledge of JMX agent user credentials could potentially exploit this vulnerability to create arbitrary files on the affected system and creat
user credentials could potentially exploit this vulnerability to create arbitrary files on the affected system and create a DoS condition by leveraging inherent JMX protocol capabilities. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039418 - http://www.securityfocus.com/bid/100982 - http://seclists.org/fulldisclosure/2017/Sep/51 - http://www.securitytracker.com/id/1039417
CVE ID: CVE-2017-8013 State: PUBLISHED Published: 2018-03-16T20:00:00Z Last Updated: 2024-09-16T16:58:08.085Z Vendors: Dell EMC Products: EMC Data Protection Advisor Problem Types: Hardcoded Password Vulnerability Description: EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. Affected accounts are: "Apollo System Test", "emc.dpa.agent.logon" and "emc.dpa.metrics.logon". An attacker with knowledge of the password could potentially use these accounts via REST APIs to gain unauthorized access to EMC Data Protection Advisor (including potentially access with administrative privileges). Add
in unauthorized access to EMC Data Protection Advisor (including potentially access with administrative privileges). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039370 - http://seclists.org/fulldisclosure/2017/Sep/36 - http://www.securityfocus.com/bid/100846
CVE ID: CVE-2017-8014 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2017-8015 State: PUBLISHED Published: 2017-09-12T20:00:00 Last Updated: 2024-08-05T16:19:29.767Z Vendors: n/a Products: EMC AppSync all versions prior to 3.5 Problem Types: SQL Injection Vulnerability Description: EMC AppSync (all versions prior to 3.5) contains a SQL injection vulnerability that could potentially be exploited by malicious users to compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100683 - http://seclists.org/fulldisclosure/2017/Sep/14
CVE ID: CVE-2017-8016 State: PUBLISHED Published: 2017-10-11T19:00:00 Last Updated: 2024-08-05T16:19:29.489Z Vendors: n/a Products: RSA Archer GRC Platform versions prior to 6.2.0.5 Problem Types: Stored Cross Site Scripting Description: RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039518 - http://seclists.org/fulldisclosure/2017/Oct/12
CVE ID: CVE-2017-8017 State: PUBLISHED Published: 2017-10-11T19:00:00 Last Updated: 2024-08-05T16:19:29.489Z Vendors: n/a Products: EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4.1.x, 9.4.2.x Problem Types: Reflected Cross-Site Scripting Vulnerability Description: EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x is affected by a reflected cross-site scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Oct/11 - http://www.securitytracker.com/id/1039517 - http://www.securityfocus.com/bid/10
eclists.org/fulldisclosure/2017/Oct/11 - http://www.securitytracker.com/id/1039517 - http://www.securityfocus.com/bid/101194
CVE ID: CVE-2017-8018 State: PUBLISHED Published: 2017-10-02T05:00:00 Last Updated: 2024-08-05T16:19:29.635Z Vendors: n/a Products: EMC AppSync host plug-in versions 3.5 and below (Windows platform only) Problem Types: Denial of Service Description: EMC AppSync host plug-in versions 3.5 and below (Windows platform only) includes a denial of service (DoS) vulnerability that could potentially be exploited by malicious users to compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/75 - http://www.securityfocus.com/bid/101016
CVE ID: CVE-2017-8019 State: PUBLISHED Published: 2017-11-28T07:00:00 Last Updated: 2024-08-05T16:19:29.717Z Vendors: n/a Products: EMC ScaleIO EMC ScaleIO 2.0.1.x version family (2.0.1.3, 2.0.1.2, 2.0.1.1, 2.0.1) Problem Types: Denial of Service Description: An issue was discovered in EMC ScaleIO 2.0.1.x. A vulnerability in message parsers (MDM, SDS, and LIA) could potentially allow an unauthenticated remote attacker to send specifically crafted packets to stop ScaleIO services and cause a denial of service situation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101991 - http://seclists.org/fulldisclosure/2017/Nov/35
CVE ID: CVE-2017-8020 State: PUBLISHED Published: 2017-11-28T07:00:00 Last Updated: 2024-08-05T16:19:29.635Z Vendors: n/a Products: EMC ScaleIO EMC ScaleIO 2.0.1.x version family (2.0.1.3, 2.0.1.2, 2.0.1.1, 2.0.1) Problem Types: Service Buffer Overflow Description: An issue was discovered in EMC ScaleIO 2.0.1.x. A buffer overflow vulnerability in the SDBG service may potentially allow a remote unauthenticated attacker to execute arbitrary commands with root privileges on an affected server. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Nov/35 - http://www.securityfocus.com/bid/101995
CVE ID: CVE-2017-8021 State: PUBLISHED Published: 2017-10-02T05:00:00 Last Updated: 2024-08-05T16:19:29.587Z Vendors: n/a Products: EMC Elastic Cloud Storage all versions prior to 3.1 Problem Types: Undocumented Account Vulnerability Description: EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by malicious users to compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Sep/74 - http://www.securityfocus.com/bid/101018
CVE ID: CVE-2017-8022 State: PUBLISHED Published: 2017-10-18T15:00:00 Last Updated: 2024-08-05T16:19:29.648Z Vendors: n/a Products: EMC NetWorker prior to 8.2.4.9, 9.0.x (all supported versions), prior to 9.1.1.3, prior to 9.2.0.4 Problem Types: Buffer Overflow Vulnerability Description: An issue was discovered in EMC NetWorker (prior to 8.2.4.9, all supported 9.0.x versions, prior to 9.1.1.3, prior to 9.2.0.4). The Server service (nsrd) is affected by a buffer overflow vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on vulnerable installations of the software, or cause a denial of service, depending on the target system's
bitrary code on vulnerable installations of the software, or cause a denial of service, depending on the target system's platform. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039583 - http://seclists.org/fulldisclosure/2017/Oct/35
CVE ID: CVE-2017-8023 State: PUBLISHED Published: 2019-04-01T20:54:47.193333Z Last Updated: 2024-09-16T17:19:13.577Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: Networker Problem Types: Remote Code Execution Vulnerability Description: EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when oldauth authentication method is used. An unauthenticated remote attacker could send arbitrary commands via RPC service to be executed on the host system with the privileges of the nsrexecd service, which runs with administrative privileges. Addi
executed on the host system with the privileges of the nsrexecd service, which runs with administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Mar/50 - http://www.securityfocus.com/bid/107712
CVE ID: CVE-2017-8024 State: PUBLISHED Published: 2017-10-18T09:00:00 Last Updated: 2024-08-05T16:19:29.769Z Vendors: n/a Products: EMC Isilon OneFS EMC Isilon OneFS versions prior to 8.1.0.1, EMC Isilon OneFS versions prior to 8.0.1.2, EMC Isilon OneFS versions prior to 8.0.0.6, EMC Isilon OneFS 7.2.1.x Problem Types: Reflected Cross Site Scripting Vulnerability Description: EMC Isilon OneFS (versions prior to 8.1.0.1, versions prior to 8.0.1.2, versions prior to 8.0.0.6, version 7.2.1.x) is impacted by a reflected cross-site scripting vulnerability that may potentially be exploited by malicious users to compromise the affected system. Additional Analyst Notes: - CVE Program Container: Refe
exploited by malicious users to compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Oct/34
CVE ID: CVE-2017-8025 State: PUBLISHED Published: 2017-10-11T19:00:00 Last Updated: 2024-08-05T16:19:29.675Z Vendors: n/a Products: RSA Archer GRC Platform prior to 6.2.0.5 Problem Types: Arbitrary File Upload Vulnerability Description: RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101195 - http://www.securitytracker.com/id/1039518 - http://seclists.org/fulldisclosure/2017/Oct/12
CVE ID: CVE-2017-8026 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-01-03T14:57:01 Description: No description available.
CVE ID: CVE-2017-8027 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-01-03T14:57:01 Description: No description available.
CVE ID: CVE-2017-8028 State: PUBLISHED Published: 2017-11-27T10:00:00 Last Updated: 2024-08-05T16:19:29.484Z Vendors: n/a Products: Spring-LDAP Spring-LDAP versions 1.3.0 2.3.1 Problem Types: authentication with arbitrary password Description: In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation
an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0319 - https://www.debian.org/security/2017/dsa-4046 - https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://pivotal.io/security/cve-2017-8028
CVE ID: CVE-2017-8029 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-01-03T14:57:01 Description: No description available.
CVE ID: CVE-2017-8030 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-01-03T14:57:01 Description: No description available.
CVE ID: CVE-2017-8031 State: PUBLISHED Published: 2017-11-27T10:00:00 Last Updated: 2024-08-05T16:19:29.544Z Vendors: n/a Products: cf-release and UAA cf-release: All versions prior to v279, UAA: 30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1 Problem Types: Denial of Service Description: An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque
cular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8031/ - http://www.securityfocus.com/bid/101967
CVE ID: CVE-2017-8032 State: PUBLISHED Published: 2017-07-10T20:00:00 Last Updated: 2024-08-05T16:19:29.855Z Vendors: n/a Products: Cloud Foundry Problem Types: Admin Privilege Escalation Description: In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider.
to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8032/
CVE ID: CVE-2017-8033 State: PUBLISHED Published: 2017-07-25T04:00:00 Last Updated: 2024-08-05T16:19:29.592Z Vendors: n/a Products: Cloud Controller API CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268 Problem Types: API filesystem traversal vulnerability Description: An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM. Additional Analyst Not
ushing a specially crafted application that can write arbitrary files to the Cloud Controller VM. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8033/
CVE ID: CVE-2017-8034 State: PUBLISHED Published: 2017-07-17T14:00:00 Last Updated: 2024-08-05T16:19:29.540Z Vendors: n/a Products: Cloud Foundry Problem Types: Privilege escalation Description: The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8034/
CVE ID: CVE-2017-8035 State: PUBLISHED Published: 2017-07-25T04:00:00 Last Updated: 2024-08-05T16:19:29.718Z Vendors: n/a Products: Cloud Controller Problem Types: API access to CC VM contents Description: An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8035/
CVE ID: CVE-2017-8036 State: PUBLISHED Published: 2017-07-24T18:00:00 Last Updated: 2024-08-05T16:19:29.758Z Vendors: n/a Products: Cloud Controller API CAPI-release version 1.33.0 only Problem Types: API regression Description: An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only). The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8036/ - http://www.securityfocus.c
t Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8036/ - http://www.securityfocus.com/bid/100002
CVE ID: CVE-2017-8037 State: PUBLISHED Published: 2017-08-21T22:00:00 Last Updated: 2024-08-05T16:19:29.884Z Vendors: n/a Products: Cloud Foundry Problem Types: Information Leak / Disclosure Description: In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure. Additional Analyst Notes: - CVE Program Con
d Controller VM for that installation, aka an Information Leak / Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8037/ - http://www.securityfocus.com/bid/100448
CVE ID: CVE-2017-8038 State: PUBLISHED Published: 2017-11-27T10:00:00 Last Updated: 2024-08-05T16:19:29.539Z Vendors: n/a Products: Credhub Credhub-release version 1.1.0 only Problem Types: Credentials readable Description: In Cloud Foundry Foundation Credhub-release version 1.1.0, access control lists (ACLs) enforce whether an authenticated user can perform an operation on a credential. For installations using ACLs, the ACL was bypassed for the CredHub interpolate endpoint, allowing authenticated applications to view any credential within the CredHub installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/cve-2017-8038/
CVE ID: CVE-2017-8039 State: PUBLISHED Published: 2017-11-27T10:00:00 Last Updated: 2024-08-05T16:19:29.618Z Vendors: n/a Products: Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected Problem Types: Data Binding Expression Vulnerability Description: An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue e
ss form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2017-8039 - http://www.securityfocus.com/bid/100849
CVE ID: CVE-2017-8040 State: PUBLISHED Published: 2017-09-09T01:00:00 Last Updated: 2024-08-05T16:19:29.784Z Vendors: n/a Products: PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3 Problem Types: XXE Vulnerability Description: In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/
ervice broker file system. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2017-8040 - http://www.securityfocus.com/bid/100617
CVE ID: CVE-2017-8041 State: PUBLISHED Published: 2017-09-09T01:00:00 Last Updated: 2024-08-05T16:19:29.823Z Vendors: n/a Products: PCF Single Sign-On for PCF:1.3.x versions prior to 1.3.4, 1.4.x versions prior to 1.4.3 Problem Types: XSS vulnerability Description: In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain Single Sign-On service UI pages by inputting code in the text field for an organization name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100615 - https://pivotal.io/security/cve-2017-8041
CVE ID: CVE-2017-8042 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-01-03T14:57:01 Description: No description available.
CVE ID: CVE-2017-8043 State: REJECTED Published: 2018-01-03T15:00:00 Last Updated: 2018-01-03T14:57:01 Description: No description available.
CVE ID: CVE-2017-8044 State: PUBLISHED Published: 2017-11-27T10:00:00 Last Updated: 2024-08-05T16:19:29.680Z Vendors: n/a Products: Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3 Problem Types: XSS vulnerability Description: In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2017-8044 - http://www.securityfocus.com/bid/100618