Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-11132 State: PUBLISHED Published: 2017-08-01T14:00:00 Last Updated: 2024-08-05T17:57:57.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/90
CVE ID: CVE-2017-11133 State: PUBLISHED Published: 2017-08-01T14:00:00 Last Updated: 2024-08-05T17:57:57.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with CryptoJS.lib.WordArray.random() in newer versions, which uses math.random() internally. This is not cryptographically strong. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/9
y strong. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/90
CVE ID: CVE-2017-11134 State: PUBLISHED Published: 2017-08-01T14:00:00 Last Updated: 2024-08-05T17:57:57.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/90
CVE ID: CVE-2017-11135 State: PUBLISHED Published: 2017-08-01T14:00:00 Last Updated: 2024-08-05T17:57:57.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be interpreted as a vulnerability in customer-controlled software, in the sense that the StashCat client side has no secure way to signal that it is ending a session and that data should be deleted. Additional Analyst Notes: - CVE Program C
ure way to signal that it is ending a session and that data should be deleted. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/90
CVE ID: CVE-2017-11136 State: PUBLISHED Published: 2017-08-01T14:00:00 Last Updated: 2024-08-05T17:57:58.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backend, too. Moreover, the key to decrypt the private key is composed of the first 32 bytes of the SHA-512 hash of the user password. But this hash is stored on the backend, too. Therefore, everyone with access to the backend database can
user password. But this hash is stored on the backend, too. Therefore, everyone with access to the backend database can read the transmitted secret for symmetric encryption, hence can read the communication. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/90
CVE ID: CVE-2017-11139 State: PUBLISHED Published: 2017-07-10T03:00:00 Last Updated: 2024-08-05T17:57:58.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c. Additional Analyst Notes: - CVE Program Container: References: - http://hg.code.sf.net/p/graphicsmagick/code/rev/4d0baa77245b - http://www.securityfocus.com/bid/99504 - https://www.debian.org/security/2018/dsa-4321
CVE ID: CVE-2017-11140 State: PUBLISHED Published: 2017-07-10T03:00:00 Last Updated: 2024-08-05T17:57:57.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files. Additional Analyst Notes: - CVE Program Container: References: - http://hg.code.sf.net/p/graphicsmagick/code/rev/b4139088b49a - http://www.securityfocus.com/bid/99503 - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://
://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://usn.ubuntu.com/4206-1/
CVE ID: CVE-2017-11141 State: PUBLISHED Published: 2017-07-10T03:00:00 Last Updated: 2024-08-05T17:57:57.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadMATImage function in coders\mat.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted MAT file, related to incorrect ordering of a SetImageExtent call. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99506 - https://github.com/ImageMagick/ImageMagick/issues/469
CVE ID: CVE-2017-11142 State: PUBLISHED Published: 2017-07-10T14:00:00 Last Updated: 2024-08-05T17:57:57.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php/php-src/commit/0f8cf3b8497dc45c010c44ed9e96518e11e19fc3 - http://openwall.com/lists/oss-security/2017/07/10/6 - https://www.tenable.com/security/tns-2017-12 - https://bugs.php.net/bug.php?id=73807 - https://github.com/php/php-src/commit/a1
/www.tenable.com/security/tns-2017-12 - https://bugs.php.net/bug.php?id=73807 - https://github.com/php/php-src/commit/a15bffd105ac28fd0dd9b596632dbf035238fda3 - http://php.net/ChangeLog-5.php - https://security.netapp.com/advisory/ntap-20180112-0001/ - http://www.securityfocus.com/bid/99601 - https://www.debian.org/security/2018/dsa-4081 - http://php.net/ChangeLog-7.php
CVE ID: CVE-2017-11143 State: PUBLISHED Published: 2017-07-10T14:00:00 Last Updated: 2024-08-05T17:57:57.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/07/10/6 - https://www.tenable.com/security/tns-2017-12 - http://www.securityfocus.com/bid/99553 - https://bugs.php.net/bug.php?id=74145 - https://access.redhat.co
/tns-2017-12 - http://www.securityfocus.com/bid/99553 - https://bugs.php.net/bug.php?id=74145 - https://access.redhat.com/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https://security.netapp.com/advisory/ntap-20180112-0001/ - https://www.debian.org/security/2018/dsa-4081 - https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
CVE ID: CVE-2017-11144 State: PUBLISHED Published: 2017-07-10T14:00:00 Last Updated: 2024-08-05T17:57:58.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission. Additional Analyst Notes: - CVE Program Container: References: - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6 - http://openwall.com/lists/oss
ttp://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6 - http://openwall.com/lists/oss-security/2017/07/10/6 - https://www.tenable.com/security/tns-2017-12 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e - https://access.redhat.com/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https://security.netapp.com/advisory/ntap-20180112-0001/ - https://www.debian.org/security/2018/dsa-4081 - https://www.debian.org/security/2018/dsa-4080 - http://php.net/ChangeLog-7.php - https://bugs.php.net/bug.php?id=74651
CVE ID: CVE-2017-11145 State: PUBLISHED Published: 2017-07-10T14:00:00 Last Updated: 2024-08-05T17:57:57.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.c
d77ac90d3bdf31ce2a5251ad92e9e75 gist. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/07/10/6 - https://bugs.php.net/bug.php?id=74819 - https://www.tenable.com/security/tns-2017-12 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e8b7698f5ee757ce2c8bd10a192a491a498f891c - http://www.securityfocus.com/bid/99550 - https://access.redhat.com/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https://security.netapp.com/advisory/ntap-20180112-0001/ - https://www.debian.org/security/2018/dsa-4081 - https://www.debian.org/security/2018/dsa-4080 - http://php.net/ChangeLog-7.php - https://gist.github.com/anonymous/bd77ac90d3bdf31ce2
ebian.org/security/2018/dsa-4080 - http://php.net/ChangeLog-7.php - https://gist.github.com/anonymous/bd77ac90d3bdf31ce2a5251ad92e9e75
CVE ID: CVE-2017-11146 State: REJECTED Published: 2017-07-10T14:00:00 Last Updated: 2017-07-23T19:57:01 Description: No description available.
CVE ID: CVE-2017-11147 State: PUBLISHED Published: 2017-07-10T14:00:00 Last Updated: 2024-08-05T17:57:57.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2017/07/10/6 - https://www.tenable.com/security/tns-2017-12 - https://access.redhat.com/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https
able.com/security/tns-2017-12 - https://access.redhat.com/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https://security.netapp.com/advisory/ntap-20180112-0001/ - http://php.net/ChangeLog-7.php - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451 - http://www.securityfocus.com/bid/99607 - https://bugs.php.net/bug.php?id=73773
CVE ID: CVE-2017-11148 State: PUBLISHED Published: 2017-08-11T19:00:00Z Last Updated: 2024-09-17T02:47:56.296Z Vendors: Synology Products: Synology Chat Problem Types: CWE-918 Description: Server-side request forgery (SSRF) vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100310 - https://www.synology.com/en-global/support/security/Synology_SA_17_38_Chat
CVE ID: CVE-2017-11149 State: PUBLISHED Published: 2017-08-14T19:00:00Z Last Updated: 2024-09-16T20:41:46.192Z Vendors: Synology Products: Synology Download Station Problem Types: CWE-918 Description: Server-side request forgery (SSRF) vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station
CVE ID: CVE-2017-11150 State: PUBLISHED Published: 2017-08-14T19:00:00Z Last Updated: 2024-09-17T01:27:01.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability in Document.php in Synology Office 2.2.0-1502 and 2.2.1-1506 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the crafted file name of RTF documents. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_26_Office
CVE ID: CVE-2017-11151 State: PUBLISHED Published: 2017-08-08T15:00:00Z Last Updated: 2024-09-16T16:52:46.111Z Vendors: Synology Products: Synology Photo Station Problem Types: CWE-287 Description: A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_34_PhotoStation - https://www.exploit-db.com/exploits/42434/
CVE ID: CVE-2017-11152 State: PUBLISHED Published: 2017-08-08T15:00:00Z Last Updated: 2024-09-16T20:41:43.273Z Vendors: Synology Products: Synology Photo Station Problem Types: CWE-22 Description: Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_34_PhotoStation - https://www.exploit-db.com/exploits/42434/
CVE ID: CVE-2017-11153 State: PUBLISHED Published: 2017-08-08T15:00:00Z Last Updated: 2024-09-16T17:47:41.695Z Vendors: Synology Products: Synology Photo Station Problem Types: CWE-502 Description: Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_34_PhotoStation - https://www.exploit-db.com/exploits/42434/
CVE ID: CVE-2017-11154 State: PUBLISHED Published: 2017-08-08T15:00:00Z Last Updated: 2024-09-17T00:26:07.171Z Vendors: Synology Products: Synology Photo Station Problem Types: CWE-434 Description: Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_34_PhotoStation - https://www.exploit-db.com/exploits/42434/
CVE ID: CVE-2017-11155 State: PUBLISHED Published: 2017-08-08T15:00:00Z Last Updated: 2024-09-17T00:46:54.183Z Vendors: Synology Products: Synology Photo Station Problem Types: CWE-205 Description: An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_34_PhotoStation - https://www.exploit-db.com/exploits/42434/
CVE ID: CVE-2017-11156 State: PUBLISHED Published: 2017-08-14T19:00:00Z Last Updated: 2024-09-16T19:36:36.517Z Vendors: Synology Products: Synology Download Station Problem Types: CWE-276 Description: Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_28_Download_Station
CVE ID: CVE-2017-11157 State: PUBLISHED Published: 2017-08-30T20:00:00 Last Updated: 2024-08-05T17:57:58.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_50_Cloud_Station_Backup
CVE ID: CVE-2017-11158 State: PUBLISHED Published: 2017-08-31T13:00:00Z Last Updated: 2024-09-17T02:27:34.692Z Vendors: Synology Products: Cloud Station Drive Problem Types: CWE-427 Description: Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_51_Cloud_Station_Drive
CVE ID: CVE-2017-11159 State: PUBLISHED Published: 2017-08-23T15:00:00Z Last Updated: 2024-09-16T17:54:53.148Z Vendors: Synology Products: Photo Station Uploader Problem Types: CWE-427 Description: Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_45_Photo_Station_Uploader
CVE ID: CVE-2017-11160 State: PUBLISHED Published: 2017-08-18T19:00:00Z Last Updated: 2024-09-17T04:04:57.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple untrusted search path vulnerabilities in installer in Synology Assistant before 6.1-15163 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_44_Synology_Assistant
CVE ID: CVE-2017-11161 State: PUBLISHED Published: 2017-09-08T14:00:00Z Last Updated: 2024-09-16T16:49:11.244Z Vendors: Synology Products: Synology Photo Station Problem Types: CWE-89 Description: Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
CVE ID: CVE-2017-11162 State: PUBLISHED Published: 2017-09-08T14:00:00Z Last Updated: 2024-09-16T23:11:46.672Z Vendors: Synology Products: Synology Photo Station Problem Types: CWE-22 Description: Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
CVE ID: CVE-2017-11163 State: PUBLISHED Published: 2017-07-10T18:00:00 Last Updated: 2024-08-05T17:57:58.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038908 - https://github.com/Cacti/cacti/issues/847
CVE ID: CVE-2017-11164 State: PUBLISHED Published: 2017-07-11T00:00:00 Last Updated: 2024-08-05T17:57:57.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99575 - http://openwall.com/lists/oss-security/2017/07/11/3 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - http://www.openwall.com/lists/oss-security/2023/04/11/1 - http://www.openwall
685ac9b07772%40%3Cdev.mina.apache.org%3E - http://www.openwall.com/lists/oss-security/2023/04/11/1 - http://www.openwall.com/lists/oss-security/2023/04/12/1
CVE ID: CVE-2017-11165 State: PUBLISHED Published: 2017-07-12T12:00:00 Last Updated: 2024-08-05T17:57:58.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42313/ - https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
CVE ID: CVE-2017-11166 State: PUBLISHED Published: 2017-07-10T18:00:00Z Last Updated: 2024-09-16T21:08:17.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/471
CVE ID: CVE-2017-11167 State: PUBLISHED Published: 2017-07-12T13:00:00 Last Updated: 2024-08-05T17:57:58.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo() input value. Additional Analyst Notes: - CVE Program Container: References: - http://www.03sec.com/3169.shtml
CVE ID: CVE-2017-11169 State: PUBLISHED Published: 2017-11-13T09:00:00 Last Updated: 2024-08-05T17:57:57.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege Escalation on iBall iB-WRA300N3GT iB-WRA300N3GT_1.1.1 devices allows remote authenticated users to obtain root privileges by leveraging a guest/user/normal account to submit a modified privilege parameter to /form2userconfig.cgi. Additional Analyst Notes: - CVE Program Container: References: - http://www.uniquish.tech/2017/11/privelege-escalation-in-iball-ib.html