Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- http://www.securityfocus.com/bid/102201 - http://www.securitytracker.com/id/1040009 - https://www.debian.org/security/2017/dsa-4076 - https://issues.asterisk.org/jira/browse/ASTERISK-27382
CVE ID: CVE-2017-17665 State: PUBLISHED Published: 2017-12-13T20:00:00 Last Updated: 2024-08-05T20:59:17.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/4073
CVE ID: CVE-2017-17668 State: PUBLISHED Published: 2018-03-20T14:00:00 Last Updated: 2024-08-05T20:59:17.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://www.ncr.com/sites/default/files/ncr_security_alert_-_2018-04_v3.pdf
CVE ID: CVE-2017-17669 State: PUBLISHED Published: 2017-12-13T00:00:00 Last Updated: 2024-08-05T20:59:17.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/187 - https://usn.ubuntu.com/3852-1/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE ID: CVE-2017-17670 State: PUBLISHED Published: 2017-12-15T09:00:00 Last Updated: 2024-08-05T20:59:17.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102214 - http://www.securitytracker.com/id/1040938 - https://www.debian.org/security/2018/dsa-4203 - http://openwall.com/lists/oss-security/2017/12/15/1
CVE ID: CVE-2017-17671 State: PUBLISHED Published: 2017-12-14T00:00:00 Last Updated: 2024-08-05T20:59:17.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file. Additional Analyst Notes: - CVE Program
request with enough instances of ".." to reach an Apache HTTP Server log file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.securiteam.com/index.php/archives/3569
CVE ID: CVE-2017-17672 State: PUBLISHED Published: 2017-12-14T00:00:00 Last Updated: 2024-08-05T20:59:17.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43362/ - https://blogs.securiteam.c
st Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43362/ - https://blogs.securiteam.com/index.php/archives/3573
CVE ID: CVE-2017-17674 State: PUBLISHED Published: 2021-05-19T13:10:53 Last Updated: 2024-08-05T20:59:17.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE). Additional Analyst Notes: - CVE Program Container: References: - http://bmc.com - http://remedy.com - https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html - https://secli
mc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html - https://seclists.org/fulldisclosure/2017/Oct/52
CVE ID: CVE-2017-17675 State: PUBLISHED Published: 2021-05-19T13:11:13 Last Updated: 2024-08-05T20:59:17.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data. Additional Analyst Notes: - CVE Program Container: References: - http://bmc.com - http://remedy.com - https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html - https://seclists.org/fulldisclosure/2017/Oct/52
CVE ID: CVE-2017-17677 State: PUBLISHED Published: 2021-05-19T13:11:22 Last Updated: 2024-08-05T20:59:17.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code. Additional Analyst Notes: - CVE Program Container: References: - http://bmc.com - http://remedy.com - https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html - https://seclists.org/fulldisclosure/2017/Oct/52
CVE ID: CVE-2017-17678 State: PUBLISHED Published: 2021-05-19T13:11:01 Last Updated: 2024-08-05T20:59:17.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility. Additional Analyst Notes: - CVE Program Container: References: - http://bmc.com - http://remedy.com - https://docs.bmc.com/docs/ars91/en/9-1-00-fixes-available-for-remedy-ar-system-security-vulnerabilities-800555806.html - https://seclists.org/fulldisclosure/2017/Oct/52
CVE ID: CVE-2017-17680 State: PUBLISHED Published: 2017-12-14T06:00:00 Last Updated: 2024-08-05T20:59:17.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of service via a crafted xpm image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/873 - http://www.securityfocus.com/bid/102203 - https://usn.ubuntu.com/3681-1/
CVE ID: CVE-2017-17681 State: PUBLISHED Published: 2017-12-14T06:00:00 Last Updated: 2024-08-05T20:59:17.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted psd image file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/869 - https://usn.ubuntu.com/3681-1/ - http://www.securityfocus.com/bid/102206 - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2017-17682 State: PUBLISHED Published: 2017-12-14T06:00:00 Last Updated: 2024-08-05T20:59:17.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted wpg image file that triggers a ReadWPGImage call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/870 - https://usn.ubuntu.com/3681-1/ - https://lists.debian.org/debian-lts-announce/2018/01/msg00000.html - http://www.securityfocus.com/bid/102202 - https://lists.de
/lists.debian.org/debian-lts-announce/2018/01/msg00000.html - http://www.securityfocus.com/bid/102202 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-17683 State: PUBLISHED Published: 2017-12-14T06:00:00Z Last Updated: 2024-09-16T20:26:20.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/Panda-Antivirus/Panda_Security_Antivirus_0xb3702c44
CVE ID: CVE-2017-17684 State: PUBLISHED Published: 2017-12-14T06:00:00Z Last Updated: 2024-09-16T20:06:26.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0keoyo/Driver-Loaded-PoC/tree/master/Panda-Antivirus/Panda_Security_Antivirus_0xb3702c04_
CVE ID: CVE-2017-17688 State: PUBLISHED Published: 2018-05-16T19:00:00 Last Updated: 2024-08-05T20:59:17.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification Additional Analyst Notes: - CVE Program Container: References: - https://protonmail.com/blog/pgp-vulnerability-efail - https://news.ycombinator.com/item?id=17066419 - https:/
erences: - https://protonmail.com/blog/pgp-vulnerability-efail - https://news.ycombinator.com/item?id=17066419 - https://www.patreon.com/posts/cybersecurity-15-18814817 - http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html - http://www.securityfocus.com/bid/104162 - https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html - https://efail.de - https://twitter.com/matthew_d_green/status/995996706457243648 - https://www.synology.com/support/security/Synology_SA_18_22 - http://www.securitytracker.com/id/1040904
CVE ID: CVE-2017-17689 State: PUBLISHED Published: 2018-05-16T19:00:00 Last Updated: 2024-08-05T20:59:17.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. Additional Analyst Notes: - CVE Program Container: References: - https://news.ycombinator.com/item?id=17066419 - https://pastebin.com/gNCc8aYm - http://www.securityfocus.com/bid/104165 - https://twitter.com/matthew_d_green/status/996371541591019520 - https://efail.de - https://www.synology.com/support/security/Synology_SA_18_22
CVE ID: CVE-2017-17691 State: PUBLISHED Published: 2018-09-07T22:00:00 Last Updated: 2024-08-05T20:59:17.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client instances, which allows remote attackers to obtain sensitive information via a man in the middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2017-031_homematic.txt
CVE ID: CVE-2017-17692 State: PUBLISHED Published: 2017-12-21T19:00:00 Last Updated: 2024-08-05T20:59:17.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43376/ - http://packetstormsecurity.com/files/145510/Samsung-Internet-Browser-SOP-Bypass.html - https://datarift.blogspot.in/p/samsung-interent-browser-sop-bypass-cve.html - https://github.com/rapid7/metasploit-
ml - https://datarift.blogspot.in/p/samsung-interent-browser-sop-bypass-cve.html - https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/samsung_browser_sop_bypass.rb
CVE ID: CVE-2017-17693 State: PUBLISHED Published: 2017-12-15T09:00:00 Last Updated: 2024-08-05T20:59:17.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Techno-Portfolio-Management-Panel.md
CVE ID: CVE-2017-17694 State: PUBLISHED Published: 2017-12-15T09:00:00 Last Updated: 2024-08-05T20:59:17.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Techno-Portfolio-Management-Panel.md
CVE ID: CVE-2017-17695 State: PUBLISHED Published: 2017-12-15T09:00:00 Last Updated: 2024-08-05T20:59:17.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Techno-Portfolio-Management-Panel.md
CVE ID: CVE-2017-17696 State: PUBLISHED Published: 2017-12-15T09:00:00 Last Updated: 2024-08-05T20:59:17.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Techno-Portfolio-Management-Panel.md
CVE ID: CVE-2017-17697 State: PUBLISHED Published: 2017-12-15T09:00:00 Last Updated: 2024-08-05T20:59:17.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vmware/harbor/issues/3755
CVE ID: CVE-2017-17698 State: PUBLISHED Published: 2017-12-15T19:00:00Z Last Updated: 2024-09-16T16:22:29.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/passwordmanagerpro/release-notes.html
CVE ID: CVE-2017-17699 State: PUBLISHED Published: 2017-12-15T20:00:00 Last Updated: 2024-08-05T20:59:17.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mmmxny/K7-Antivirus/tree/master/cve3
CVE ID: CVE-2017-17700 State: PUBLISHED Published: 2017-12-15T20:00:00 Last Updated: 2024-08-05T20:59:17.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mmmxny/K7-Antivirus/tree/master/cve1
CVE ID: CVE-2017-17701 State: PUBLISHED Published: 2017-12-15T20:00:00 Last Updated: 2024-08-05T20:59:17.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mmmxny/K7-Antivirus/tree/master/cve2
CVE ID: CVE-2017-17703 State: PUBLISHED Published: 2018-02-04T01:00:00 Last Updated: 2024-08-05T20:59:17.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.zimbra.com/show_bug.cgi?id=108265 - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE ID: CVE-2017-17704 State: PUBLISHED Published: 2017-12-31T02:00:00 Last Updated: 2024-08-05T20:59:17.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible. Additional Analyst Notes: - CVE Program Co
ges beyond the use of the fixed AES key, so message forgery is also possible. Additional Analyst Notes: - CVE Program Container: References: - https://systemoverlord.com/2017/12/18/cve-2017-17704-broken-cryptography-in-istar-ultra-ip-acm-by-software-house.html
CVE ID: CVE-2017-17707 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T20:59:17.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely identifies a password safe entry. Since "CredentialId" values are implemented as GUIDs, they are hard to guess. However, if for example an entry's owner grants read-only access to a malicious user, the value gets exposed to the malicious use
if for example an entry's owner grants read-only access to a malicious user, the value gets exposed to the malicious user. The same holds true for temporary grants. Additional Analyst Notes: - CVE Program Container: References: - https://www.profundis-labs.com/advisories/CVE-2017-17707.txt
CVE ID: CVE-2017-17708 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T20:59:17.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.profundis-labs.com/advisories/CVE-2017-17708.txt
CVE ID: CVE-2017-17712 State: PUBLISHED Published: 2017-12-16T01:00:00 Last Updated: 2024-08-05T20:59:17.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 - https://usn.ubuntu.com/3582-1/ - https://source.android.com/security/bulletin/pixel/2018-04-01 - https://github.com/torv
https://usn.ubuntu.com/3582-1/ - https://source.android.com/security/bulletin/pixel/2018-04-01 - https://github.com/torvalds/linux/commit/8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 - https://usn.ubuntu.com/3581-1/ - https://usn.ubuntu.com/3581-3/ - https://usn.ubuntu.com/3581-2/ - https://www.debian.org/security/2017/dsa-4073 - https://access.redhat.com/errata/RHSA-2018:0502 - https://usn.ubuntu.com/3582-2/
CVE ID: CVE-2017-17713 State: PUBLISHED Published: 2017-12-16T20:00:00 Last Updated: 2024-08-05T20:59:17.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon parameter, the /register org parameter, the /register query parameter, the /register region parameter, the /register regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parame
/register regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parameter, or the /tping id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=Txp6IwR24jY - https://github.com/boxug/trape/commit/628149159ba25adbfc29a3ae1d4b10c7eb936dd3 - https://www.youtube.com/watch?v=RWw1UTeZee8 - https://www.seekurity.com/blog/general/cve-2017-17713-and-cve-2017-17714-multiple-sql-injections-and-xss-vulnerabilities-found-in-the-hackers-tracking-tool-trape-boxug/ - https://www.youtube.com/watch?v=efmvL235S-8
CVE ID: CVE-2017-17714 State: PUBLISHED Published: 2017-12-16T20:00:00 Last Updated: 2024-08-05T20:59:17.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon parameter, the /register org parameter, the /register query parameter, the /register region parameter, the /register regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parameter, or th
regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parameter, or the /tping id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=Txp6IwR24jY - https://github.com/boxug/trape/commit/628149159ba25adbfc29a3ae1d4b10c7eb936dd3 - https://www.seekurity.com/blog/general/cve-2017-17713-and-cve-2017-17714-multiple-sql-injections-and-xss-vulnerabilities-found-in-the-hackers-tracking-tool-trape-boxug/
CVE ID: CVE-2017-17715 State: PUBLISHED Published: 2017-12-16T19:00:00 Last Updated: 2024-08-05T20:59:17.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1470