Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-1000155 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to profile pictures being accessed without any access control checks consequently allowing any of a user's uploaded profile pictures to be viewable by anyone, whether or not they were currently selected as the "default" or used in any pages. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1600069
CVE ID: CVE-2017-1000156 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1609200
CVE ID: CVE-2017-1000157 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the event_log table during the user creation process if full event logging was turned on. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1692749
CVE ID: CVE-2017-1000158 State: PUBLISHED Published: 2017-11-17T00:00:00 Last Updated: 2024-08-05T21:53:07.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution) Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html - https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html - https://bugs.python.org/issue30657 - http://www.securitytracker.com/id/1039890 - https://lists.debian.org/debian-lts-a
- https://bugs.python.org/issue30657 - http://www.securitytracker.com/id/1039890 - https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html - https://www.debian.org/security/2018/dsa-4307 - https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html - https://security.gentoo.org/glsa/201805-02 - https://security.netapp.com/advisory/ntap-20230216-0001/
CVE ID: CVE-2017-1000159 State: PUBLISHED Published: 2017-11-27T15:00:00 Last Updated: 2024-08-05T21:53:07.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201804-15 - https://lists.debian.org/debian-lts-announce/2017/12/msg00006.html - https://bugzilla.gnome.org/show_bug.cgi?id=784947 - https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html - https://www.debian.org/security/2020/dsa-4624 - https
tps://lists.debian.org/debian-lts-announce/2019/08/msg00014.html - https://www.debian.org/security/2020/dsa-4624 - https://seclists.org/bugtraq/2020/Feb/18
CVE ID: CVE-2017-1000160 State: PUBLISHED Published: 2017-11-17T05:00:00Z Last Updated: 2024-09-17T01:26:26.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection Additional Analyst Notes: - CVE Program Container: References: - https://docs.expressionengine.com/latest/about/changelog.html#version-3-4-3
CVE ID: CVE-2017-1000161 State: REJECTED Published: 2017-11-17T19:00:00Z Last Updated: 2024-09-17T04:03:41.724Z Description: No description available.
CVE ID: CVE-2017-1000162 State: REJECTED Published: 2017-08-21T00:00:00Z Last Updated: 2024-09-16T23:01:15.351Z Description: No description available.
CVE ID: CVE-2017-1000163 State: PUBLISHED Published: 2017-11-17T21:00:00Z Last Updated: 2024-09-17T03:59:53.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks. Additional Analyst Notes: - CVE Program Container: References: - https://elixirforum.com/t/security-releases-for-phoenix/4143
CVE ID: CVE-2017-1000164 State: PUBLISHED Published: 2017-11-17T05:00:00Z Last Updated: 2024-09-17T00:41:00.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation Additional Analyst Notes: - CVE Program Container: References: - https://forge.tine20.org/view.php?id=13228
CVE ID: CVE-2017-1000165 State: REJECTED Published: 2017-08-21T00:00:00Z Last Updated: 2024-09-17T04:14:45.435Z Description: No description available.
CVE ID: CVE-2017-1000166 State: REJECTED Published: 2017-08-21T00:00:00Z Last Updated: 2024-09-17T00:26:48.381Z Description: No description available.
CVE ID: CVE-2017-1000167 State: REJECTED Published: 2017-08-21T00:00:00Z Last Updated: 2024-09-17T02:47:48.105Z Description: No description available.
CVE ID: CVE-2017-1000168 State: PUBLISHED Published: 2017-11-17T18:00:00Z Last Updated: 2024-09-16T23:31:52.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dnaq/sodiumoxide/issues/154
CVE ID: CVE-2017-1000169 State: PUBLISHED Published: 2017-11-17T18:00:00Z Last Updated: 2024-09-16T23:41:41.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lead to the complete takeover of the server hosting QuickerBB. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halojoy/QuickerBB/issues/10
CVE ID: CVE-2017-1000170 State: PUBLISHED Published: 2017-11-17T18:00:00 Last Updated: 2024-08-05T21:53:07.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: jqueryFileTree 2.1.5 and older Directory Traversal Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jqueryfiletree/jqueryfiletree/issues/66 - http://packetstormsecurity.com/files/161900/WordPress-Delightful-Downloads-Jquery-File-Tree-1.6.6-Path-Traversal.html
CVE ID: CVE-2017-1000171 State: PUBLISHED Published: 2017-11-03T18:00:00 Last Updated: 2024-08-05T21:53:07.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MaharaProject/mahara-mobile/issues/33
CVE ID: CVE-2017-1000172 State: PUBLISHED Published: 2017-11-17T03:00:00Z Last Updated: 2024-09-16T20:17:10.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. An example of a Heap-Use-After-Free after the 'sublexer' pointer has been freed. Line 542 of gravity_lexer.c. 'lexer' is being used to access a variable but 'lexer' has already been freed, creating a Heap Use-After-Free condition. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marcobambini/gravity/issues/144
CVE ID: CVE-2017-1000173 State: PUBLISHED Published: 2017-11-17T03:00:00Z Last Updated: 2024-09-16T23:05:33.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. By creating a large loop whiling pushing data to a buffer, we can break out of the bounds checking of that buffer. When list.join is called on the data it will read past a buffer resulting in a Heap-Buffer-Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marcobambini/gravity/issues/172
CVE ID: CVE-2017-1000174 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-16T18:29:21.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools, an address access exception was found in swfdump swf_GetBits(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/21
CVE ID: CVE-2017-1000175 State: REJECTED Published: 2017-08-20T22:00:00Z Last Updated: 2024-09-16T16:42:49.230Z Description: No description available.
CVE ID: CVE-2017-1000176 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-17T01:35:58.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools, a memcpy buffer overflow was found in swfc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/23
CVE ID: CVE-2017-1000177 State: REJECTED Published: 2017-08-20T22:00:00Z Last Updated: 2024-09-16T18:56:04.114Z Description: No description available.
CVE ID: CVE-2017-1000178 State: REJECTED Published: 2017-08-20T22:00:00Z Last Updated: 2024-09-16T17:23:00.830Z Description: No description available.
CVE ID: CVE-2017-1000179 State: REJECTED Published: 2017-08-20T22:00:00Z Last Updated: 2024-09-16T19:51:27.207Z Description: No description available.
CVE ID: CVE-2017-1000180 State: REJECTED Published: 2017-08-20T22:00:00Z Last Updated: 2024-09-17T01:56:20.823Z Description: No description available.
CVE ID: CVE-2017-1000181 State: REJECTED Published: 2017-08-20T22:00:00Z Last Updated: 2024-09-16T20:59:05.335Z Description: No description available.
CVE ID: CVE-2017-1000182 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-17T03:34:01.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools, a memory leak was found in wav2swf. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/30
CVE ID: CVE-2017-1000183 State: REJECTED Published: 2017-08-20T22:00:00Z Last Updated: 2024-09-16T20:17:17.909Z Description: No description available.
CVE ID: CVE-2017-1000184 State: REJECTED Published: 2017-08-20T22:00:00Z Last Updated: 2024-09-17T03:53:52.678Z Description: No description available.
CVE ID: CVE-2017-1000185 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-17T01:41:32.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools, a memcpy buffer overflow was found in gif2swf. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/33
CVE ID: CVE-2017-1000186 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-16T17:47:54.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools, a stack overflow was found in pdf2swf. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/34
CVE ID: CVE-2017-1000187 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-16T19:25:57.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SWFTools, an address access exception was found in pdf2swf. FoFiTrueType::writeTTF() Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthiaskramm/swftools/issues/36
CVE ID: CVE-2017-1000188 State: PUBLISHED Published: 2017-11-17T03:00:00 Last Updated: 2024-08-05T21:53:07.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mde/ejs/commit/49264e0037e313a0a3e033450b5c184112516d8f - http://www.securityfocus.com/bid/101889
CVE ID: CVE-2017-1000189 State: PUBLISHED Published: 2017-11-17T03:00:00 Last Updated: 2024-08-05T21:53:07.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile() Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101893 - https://github.com/mde/ejs/commit/49264e0037e313a0a3e033450b5c184112516d8f
CVE ID: CVE-2017-1000190 State: PUBLISHED Published: 2017-11-17T21:00:00 Last Updated: 2024-08-05T21:53:07.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ngallagher/simplexml/issues/18 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/8c4ef27e2c0218f29e785990dc919266855aea137c958f10d242cb36%40%3Cdev.lucene.apache.org%3E - https://lists.apache.org/thr
ml/8c4ef27e2c0218f29e785990dc919266855aea137c958f10d242cb36%40%3Cdev.lucene.apache.org%3E - https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
CVE ID: CVE-2017-1000191 State: PUBLISHED Published: 2017-11-17T17:00:00Z Last Updated: 2024-09-16T22:19:50.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting in a DOS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NICMx/Jool/issues/232
CVE ID: CVE-2017-1000192 State: PUBLISHED Published: 2017-11-17T17:00:00Z Last Updated: 2024-09-16T20:36:28.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nuxsmin/sysPass/releases/tag/2.1.8.17042901
CVE ID: CVE-2017-1000193 State: PUBLISHED Published: 2017-11-17T02:00:00Z Last Updated: 2024-09-16T23:21:45.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-66d6dfe5e11488e1afefcb69b8bdaabfR31
CVE ID: CVE-2017-1000194 State: PUBLISHED Published: 2017-11-17T02:00:00Z Last Updated: 2024-09-16T19:56:07.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R224
CVE ID: CVE-2017-1000195 State: PUBLISHED Published: 2017-11-17T02:00:00Z Last Updated: 2024-09-16T19:31:01.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R317
CVE ID: CVE-2017-1000196 State: PUBLISHED Published: 2017-11-17T02:00:00Z Last Updated: 2024-09-16T23:02:07.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R49
CVE ID: CVE-2017-1000197 State: PUBLISHED Published: 2017-11-17T02:00:00Z Last Updated: 2024-09-16T23:31:29.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-eef90a4e3585febf6489916dc242d0ceR241
CVE ID: CVE-2017-1000198 State: PUBLISHED Published: 2017-11-17T02:00:00 Last Updated: 2024-08-05T21:53:07.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3277 - https://github.com/open-iscsi/tcmu-runner/commit/61bd03e600d2abf309173e9186f4d465bb1b7157
CVE ID: CVE-2017-1000199 State: PUBLISHED Published: 2017-11-17T02:00:00 Last Updated: 2024-08-05T21:53:07.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existence of any file with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3277 - https://github.com/open-iscsi/tcmu-runner/issues/194
CVE ID: CVE-2017-1000200 State: PUBLISHED Published: 2017-11-17T02:00:00 Last Updated: 2024-08-05T21:53:07.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a dbus triggered NULL pointer dereference in the tcmu-runner daemon's on_unregister_handler() function resulting in denial of service Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3277 - https://github.com/open-iscsi/tcmu-runner/pull/200/commits/bb80e9c7a798f035768260ebdadffb6eb0786178
CVE ID: CVE-2017-1000201 State: PUBLISHED Published: 2017-11-17T02:00:00 Last Updated: 2024-08-05T21:53:07.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3277 - https://github.com/open-iscsi/tcmu-runner/pull/200/commits/e2d953050766ac538615a811c64b34358614edce
CVE ID: CVE-2017-1000202 State: REJECTED Published: 2017-08-21T00:00:00Z Last Updated: 2024-09-16T16:53:19.513Z Description: No description available.
CVE ID: CVE-2017-1000203 State: PUBLISHED Published: 2017-11-17T15:00:00Z Last Updated: 2024-09-16T17:18:07.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution Additional Analyst Notes: - CVE Program Container: References: - https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145#diff-6cd6f6c31bac70116b7ca7abdc8e517e
CVE ID: CVE-2017-1000204 State: REJECTED Published: 2017-11-17T20:00:00Z Last Updated: 2024-09-17T04:05:00.785Z Description: No description available.
CVE ID: CVE-2017-1000205 State: REJECTED Published: 2017-08-21T00:00:00Z Last Updated: 2024-09-16T18:49:51.514Z Description: No description available.
CVE ID: CVE-2017-1000206 State: PUBLISHED Published: 2017-11-17T15:00:00Z Last Updated: 2024-09-17T00:35:52.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in potential arbitrary code execution Additional Analyst Notes: - CVE Program Container: References: - https://github.com/samtools/htslib/blob/1.4.1/NEWS
CVE ID: CVE-2017-1000207 State: PUBLISHED Published: 2017-11-27T15:00:00 Last Updated: 2024-08-05T21:53:07.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification. Additional Analyst Notes: - CVE Program Container: References: - https://lgtm.com/blog/swagger_
fted yaml specification. Additional Analyst Notes: - CVE Program Container: References: - https://lgtm.com/blog/swagger_snakeyaml_CVE-2017-1000207_CVE-2017-1000208 - https://github.com/swagger-api/swagger-parser/pull/481
CVE ID: CVE-2017-1000208 State: PUBLISHED Published: 2017-11-17T02:00:00 Last Updated: 2024-08-05T21:53:07.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification. Additional Analyst Notes: - CVE Program Container: References: - https://lgtm.com/blog/swagger_snakeyaml_CVE-2017-1000207_CVE-2017
Analyst Notes: - CVE Program Container: References: - https://lgtm.com/blog/swagger_snakeyaml_CVE-2017-1000207_CVE-2017-1000208 - https://github.com/swagger-api/swagger-parser/releases/tag/v1.0.31
CVE ID: CVE-2017-1000209 State: PUBLISHED Published: 2017-11-17T02:00:00Z Last Updated: 2024-09-16T16:42:44.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TakahikoKawasaki/nv-websocket-client/pull/107
CVE ID: CVE-2017-1000210 State: PUBLISHED Published: 2017-11-17T01:00:00Z Last Updated: 2024-09-16T16:22:48.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: picoTCP (versions 1.7.0 - 1.5.0) is vulnerable to stack buffer overflow resulting in code execution or denial of service attack Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tass-belgium/picotcp/pull/473
CVE ID: CVE-2017-1000211 State: PUBLISHED Published: 2017-11-17T15:00:00 Last Updated: 2024-08-05T21:53:07.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself. Additional Analyst Notes: - CVE Program Container: References: - http://lynx.invisible-island.net/current/CHANGES.html - http://www.securityfocus.com/bid/102180 - https://github.com/ThomasDickey/lynx-snapshots/commit/280a61b300a1614f6037efc0902ff7ecf17146e9 - https://lists.debian.org/debian-lts-announce/2017/11/msg00021.html