Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-6313 State: PUBLISHED Published: 2017-03-10T02:00:00 Last Updated: 2024-08-05T15:25:48.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/02/21/4 - https://bugzilla.gnome.org/show_bug.cgi?id=779016 - http://www.securityfocus.com/bid/96779 - http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html - http://www.openwall.com/lists/oss-s
securityfocus.com/bid/96779 - http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html - http://www.openwall.com/lists/oss-security/2017/02/26/1 - https://security.gentoo.org/glsa/201709-08 - https://lists.debian.org/debian-lts-announce/2019/12/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJF5ARFOX4BFUK6YCBKGAKBQYECO3AI2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSAZ6UCKKXC5VOWXGWQHOX2ZBLLATIOT/
CVE ID: CVE-2017-6314 State: PUBLISHED Published: 2017-03-10T02:00:00 Last Updated: 2024-08-05T15:25:48.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.gnome.org/show_bug.cgi?id=779020 - http://www.openwall.com/lists/oss-security/2017/02/21/4 - http://www.securityfocus.com/bid/96779 - http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html - http://www.openwall.com/lists/oss-security/2017/02/26/1 - https://security.gentoo.org/glsa/201
hunting-gdk-pixbuf.html - http://www.openwall.com/lists/oss-security/2017/02/26/1 - https://security.gentoo.org/glsa/201709-08 - https://lists.debian.org/debian-lts-announce/2019/12/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJF5ARFOX4BFUK6YCBKGAKBQYECO3AI2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSAZ6UCKKXC5VOWXGWQHOX2ZBLLATIOT/
CVE ID: CVE-2017-6315 State: PUBLISHED Published: 2017-09-19T17:00:00 Last Updated: 2024-08-05T15:25:49.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42726/
CVE ID: CVE-2017-6316 State: PUBLISHED Published: 2017-07-20T04:00:00.000Z Last Updated: 2025-10-21T23:55:36.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1039019 - https://support.citrix.com/article/CTX225990 - https://www.exploit-db.com/exploits/42345/ - http://www.securityfocus.com/bid/99943 -
ort.citrix.com/article/CTX225990 - https://www.exploit-db.com/exploits/42345/ - http://www.securityfocus.com/bid/99943 - https://www.exploit-db.com/exploits/42346/
CVE ID: CVE-2017-6317 State: PUBLISHED Published: 2017-03-15T14:00:00 Last Updated: 2024-08-05T15:25:49.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the add_shader_program function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via vectors involving the sprog variable. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201707-06 - https://lists.freedesktop.org/archives/virglrenderer-devel/2017-February/000145.html - http://www.openwall.com/lists/oss-security/2017/02/24/5 - https://cgit.freedesktop.org/virglrenderer/commit/?id=a
html - http://www.openwall.com/lists/oss-security/2017/02/24/5 - https://cgit.freedesktop.org/virglrenderer/commit/?id=a2f12a1b0f95b13b6f8dc3d05d7b74b4386394e4 - https://bugzilla.redhat.com/show_bug.cgi?id=1426756 - http://www.securityfocus.com/bid/96450
CVE ID: CVE-2017-6318 State: PUBLISHED Published: 2017-03-20T16:00:00 Last Updated: 2024-08-05T15:25:48.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2017-03/msg00016.html - http://www.securityfocus.com/bid/97028 - https://alioth.debian.org/tracker/index.php?func=detail&aid=315576 - https://lists.alioth.debian.org/pipermail/sane-devel/2017-February/035029.html - http://lists.alioth.debian.org/pipermail/sane-devel/2017-February/0350
/pipermail/sane-devel/2017-February/035029.html - http://lists.alioth.debian.org/pipermail/sane-devel/2017-February/035059.html - http://lists.alioth.debian.org/pipermail/sane-devel/2017-February/035054.html - https://usn.ubuntu.com/4470-1/
CVE ID: CVE-2017-6319 State: PUBLISHED Published: 2017-03-02T01:00:00 Last Updated: 2024-08-05T15:25:48.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/commit/ad55822430a03fe075221b543efb434567e9e431 - https://github.com/radare/radare2/issues/6836 - http://www.securityfocus.com/bid/96520
CVE ID: CVE-2017-6320 State: PUBLISHED Published: 2017-07-18T14:00:00 Last Updated: 2024-08-05T15:25:48.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell commands and gain root privileges. The vulnerability stems from unsanitized data being processed in a system call when the delete_assessment command is issued. Additional Analyst Notes: - CVE Program Container: References: - https://campus.barracuda.com/product/loadbalanceradc/art
dditional Analyst Notes: - CVE Program Container: References: - https://campus.barracuda.com/product/loadbalanceradc/article/ADC/ReleaseNotes610003/ - https://www.exploit-db.com/exploits/42333/
CVE ID: CVE-2017-6323 State: PUBLISHED Published: 2018-04-16T18:00:00Z Last Updated: 2024-09-16T23:11:18.134Z Vendors: Symantec Corporation Products: ITMS Problem Types: XXE Description: The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts. Additional Analyst Notes: - CVE Program Container: References: - https://www.sy
er is located, and other system impacts. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170628_00 - http://www.securityfocus.com/bid/98621
CVE ID: CVE-2017-6324 State: PUBLISHED Published: 2017-06-26T21:00:00 Last Updated: 2024-08-05T15:25:49.171Z Vendors: Symantec Corporation Products: Messaging Gateway Problem Types: Disarm Bypass Description: The Symantec Messaging Gateway, when processing a specific email attachment, can allow a malformed or corrupted Word file with a potentially malicious macro through despite the administrator having the 'disarm' functionality enabled. This constitutes a 'bypass' of the disarm functionality resident to the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038785 - http://www.securityfocus.com/bid/98889 - https://www.symantec.c
eferences: - http://www.securitytracker.com/id/1038785 - http://www.securityfocus.com/bid/98889 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170621_00
CVE ID: CVE-2017-6325 State: PUBLISHED Published: 2017-06-26T21:00:00 Last Updated: 2024-08-05T15:25:49.167Z Vendors: Symantec Corporation Products: Messaging Gateway Problem Types: Local File Inclusion Description: The Symantec Messaging Gateway can encounter a file inclusion vulnerability, which is a type of vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. This file inclusion vulnerability subverts how an application loads code for execution. Suc
ile is executed at run time. This file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038785 - http://www.securityfocus.com/bid/98890 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170621_00
CVE ID: CVE-2017-6326 State: PUBLISHED Published: 2017-06-26T21:00:00 Last Updated: 2024-08-05T15:25:49.127Z Vendors: Symantec Corporation Products: Messaging Gateway Problem Types: Remote Code Execution Description: The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038785 - https://www.exploit-db.com/exploits/42251/ - http://www.securityfocus.com/bid/98893 - https://www.symantec.com/security_response/securityupdates/det
xploits/42251/ - http://www.securityfocus.com/bid/98893 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170621_00
CVE ID: CVE-2017-6327 State: PUBLISHED Published: 2017-08-11T20:00:00.000Z Last Updated: 2025-10-21T23:55:35.541Z Vendors: Symantec Corporation Products: Messaging Gateway Problem Types: Code Execution Description: The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://seclists.org/fulldisclosur
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://seclists.org/fulldisclosure/2017/Aug/28 - https://www.exploit-db.com/exploits/42519/ - http://www.securityfocus.com/bid/100135 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00
CVE ID: CVE-2017-6328 State: PUBLISHED Published: 2017-08-11T20:00:00Z Last Updated: 2024-09-16T22:19:46.147Z Vendors: Symantec Corporation Products: Messaging Gateway Problem Types: CSRF Description: The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bi
as in a user's browser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100136 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00
CVE ID: CVE-2017-6329 State: PUBLISHED Published: 2017-08-21T20:00:00Z Last Updated: 2024-09-16T17:59:48.626Z Vendors: Symantec Corporation Products: VIP Access for Desktop Problem Types: DLL Pre-Loading Description: Symantec VIP Access for Desktop prior to 2.2.4 can be susceptible to a DLL Pre-Loading vulnerability. These types of issues occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, the application will generally follow a specific search path to locate the DLL. The exploitation of the vulnerability manifests as a simple file write (or potentially an over-write) which result
DLL. The exploitation of the vulnerability manifests as a simple file write (or potentially an over-write) which results in a foreign executable running under the context of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170821_00 - http://www.securityfocus.com/bid/100200
CVE ID: CVE-2017-6330 State: PUBLISHED Published: 2017-09-13T14:00:00Z Last Updated: 2024-09-16T22:14:37.284Z Vendors: Symantec Corporation Products: Symantec Encryption Desktop Problem Types: Denial of Service (DoS) Description: Symantec Encryption Desktop before SED 10.4.1MP2 can allow remote attackers to cause a denial of service (resource consumption) via crafted web requests." Additional Analyst Notes: - CVE Program Container: References: - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170907_00 - http://www.securityfocus.com/bid/100552
CVE ID: CVE-2017-6331 State: PUBLISHED Published: 2017-11-06T23:00:00Z Last Updated: 2024-09-16T19:15:59.592Z Vendors: Symantec Corporation Products: Symantec Endpoint Protection Problem Types: Tamper-protection bypass Description: Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real time protection for the application that is run on servers and clients. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43134/ - http://www.securityfocus.com/bid/101502 - http://www.securitytracker.com/id/1039775 - https://www.symantec.com/security_response
ww.securityfocus.com/bid/101502 - http://www.securitytracker.com/id/1039775 - https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171106_00
CVE ID: CVE-2017-6334 State: PUBLISHED Published: 2017-03-06T02:00:00.000Z Last Updated: 2025-10-21T23:55:46.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/96463 - https://www.exploit-db.com/exploits/41459/ - https://www.exploit-db.com/exploits/41472/ - https://www.exploit-db.com/exploits/42257/
CVE ID: CVE-2017-6335 State: PUBLISHED Published: 2017-03-14T14:00:00 Last Updated: 2024-08-05T15:25:49.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1427975 - http://www.openwall.com/lists/oss-security/2017/02/28/2 - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - http://www.securityfocus.com/bid/96544 - http
8/2 - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - http://www.securityfocus.com/bid/96544 - https://sourceforge.net/p/graphicsmagick/code/ci/6156b4c2992d855ece6079653b3b93c3229fc4b8/ - https://usn.ubuntu.com/4206-1/
CVE ID: CVE-2017-6338 State: PUBLISHED Published: 2017-04-05T16:00:00 Last Updated: 2024-08-05T15:25:49.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 allow an authenticated, remote user with low privileges like 'Reports Only' or 'Auditor' to change FTP Access Control Settings, create or modify reports, or upload an HTTPS Decryption Certificate and Private Key. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/1116960 - http://www.securityfocus.com/bid/97482 - https://www.qualys.com/2017/01/12/qsa-2017-01-12/
dmicro.com/solution/1116960 - http://www.securityfocus.com/bid/97482 - https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf
CVE ID: CVE-2017-6339 State: PUBLISHED Published: 2017-04-05T16:00:00 Last Updated: 2024-08-05T15:25:49.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority (CA) and dynamically generates digital certificates that are sent to client browsers to complete a secure passage for HTTPS connections. It also allows administrators to upload their own certificates signed by a root CA. An attacker with low privileges can download the current CA certificate and Private Key (either the def
ed by a root CA. An attacker with low privileges can download the current CA certificate and Private Key (either the default ones or ones uploaded by administrators) and use those to decrypt HTTPS traffic, thus compromising confidentiality. Also, the default Private Key on this appliance is encrypted with a very weak passphrase. If an appliance uses the default Certificate and Private Key provided by Trend Micro, an attacker can simply download these and decrypt the Private Key using the default/weak passphrase. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/1116960 - http://www.securityfocus.com/bid/97492 - https://www.qualys.com/201
- https://success.trendmicro.com/solution/1116960 - http://www.securityfocus.com/bid/97492 - https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf
CVE ID: CVE-2017-6340 State: PUBLISHED Published: 2017-04-05T16:00:00 Last Updated: 2024-08-05T15:25:49.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that allows any authenticated, remote user (even with low privileges like 'Auditor') to create or modify reports, and consequently take advantage of this XSS vulnerability. The JavaScript is executed when victims visit reports or auditlog
consequently take advantage of this XSS vulnerability. The JavaScript is executed when victims visit reports or auditlog pages. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/1116960 - http://www.securityfocus.com/bid/97487 - https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf
CVE ID: CVE-2017-6341 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:25:49.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/null_ku7/status/835649185168838
17. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/null_ku7/status/835649185168838657 - https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html - http://www.securityfocus.com/bid/96456
CVE ID: CVE-2017-6342 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:25:49.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically logs in as admin. This allows sniffing sensitive information identified in CVE-2017-6341 without prior knowledge of the password. This is a different vulnerability than CVE-2013-6117. Additional Analyst Notes: - CVE Program Container: Re
he password. This is a different vulnerability than CVE-2013-6117. Additional Analyst Notes: - CVE Program Container: References: - https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html - http://www.securityfocus.com/bid/96454
CVE ID: CVE-2017-6343 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:25:49.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the corresponding password, a different vulnerability than CVE-2013-6117. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96449 - https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/
ainer: References: - http://www.securityfocus.com/bid/96449 - https://nullku7.github.io/stuff/exposure/dahua/2017/02/24/dahua-nvr.html
CVE ID: CVE-2017-6344 State: PUBLISHED Published: 2017-02-27T07:25:00 Last Updated: 2024-08-05T15:25:49.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document. Additional Analyst Notes: - CVE Program Container: References: - https://www.ambionics.io/blog/grails-pdf-plugin-xxe - http://www.securityfocus.com/bid/96446