Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
isclosure is required for exploitation. Additional Analyst Notes: - CVE Program Container: References: - http://zeroday.insecurity.zone/exploits/ipb_owned.txt - https://twitter.com/insecurity/status/862154908895780864 - https://twitter.com/sxcurity/status/862284967715381248
CVE ID: CVE-2017-8900 State: PUBLISHED Published: 2017-05-12T06:54:00 Last Updated: 2024-08-05T16:48:22.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98554 - https://www.ubuntu.com/usn/usn-3285-1/ - https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html - https://launchpad.net/bugs/1663157
CVE ID: CVE-2017-8903 State: PUBLISHED Published: 2017-05-11T19:00:00 Last Updated: 2024-08-05T16:48:22.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201705-11 - http://www.securitytracker.com/id/1038386 - https://xenbits.xen.org/xsa/advisory-213.html - http://www.securityfocus.com/bid/98426 - https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/
CVE ID: CVE-2017-8904 State: PUBLISHED Published: 2017-05-11T19:00:00 Last Updated: 2024-08-05T16:48:22.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201705-11 - http://www.securityfocus.com/bid/98428 - https://xenbits.xen.org/xsa/advisory-214.html - https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/ - http://www.securitytracker.com
4.html - https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/ - http://www.securitytracker.com/id/1038387
CVE ID: CVE-2017-8905 State: PUBLISHED Published: 2017-05-11T19:00:00 Last Updated: 2024-08-05T16:48:22.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201705-11 - http://www.securitytracker.com/id/1038388 - https://xenbits.xen.org/xsa/advisory-215.html - http://www.securityfocus.com/bid/98436 - https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/
CVE ID: CVE-2017-8906 State: PUBLISHED Published: 2017-05-11T20:00:00Z Last Updated: 2024-09-16T23:52:03.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/multicoreware/x265/issues/345/integer-underflow-in-x265-source-common
CVE ID: CVE-2017-8907 State: PUBLISHED Published: 2017-06-14T20:00:00 Last Updated: 2024-10-16T13:45:59.898Z Vendors: Atlassian Products: Atlassian Bamboo Problem Types: Incorrect Permission Check Description: Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled
create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-06-14-907283498.html - http://www.securityfocus.com/bid/99090
CVE ID: CVE-2017-8908 State: PUBLISHED Published: 2017-05-12T06:54:00 Last Updated: 2024-08-05T16:48:22.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mark_line_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PostScript document. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=697810 - http://www.securityfocus.com/bid/98427
CVE ID: CVE-2017-8911 State: PUBLISHED Published: 2017-05-12T06:54:00 Last Updated: 2024-08-05T16:48:22.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/verdammelt/tnef/issues/23 - http://www.debian.org/security/2017/dsa-3869 - https://security.gentoo.org/glsa/201708-02
CVE ID: CVE-2017-8912 State: PUBLISHED Published: 2017-05-12T06:54:00 Last Updated: 2024-08-05T16:48:22.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41997/ - https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/
CVE ID: CVE-2017-8913 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-05T16:48:22.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/advisories/erpscan-17-007-sap-netweaver-java-7-5-xxe-visual-composer-vc70runtime/ - https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-repo
aver-java-7-5-xxe-visual-composer-vc70runtime/ - https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/
CVE ID: CVE-2017-8914 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-05T16:48:22.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96206 - https://erpscan.io/advisories/erpscan-17-009-sap-hana-sinopia-default-user-creation-policy-insecure/ - https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/
CVE ID: CVE-2017-8915 State: PUBLISHED Published: 2017-05-23T03:56:00 Last Updated: 2024-08-05T16:48:22.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to cause a denial of service (assertion failure and service crash) by pushing a package with a filename containing a $ (dollar sign) or % (percent) character, aka SAP Security Note 2407694. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96206 - https://erpscan.io/advisories/erpscan-17-008-sap-hana-xs-sinopia-dos/ - https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-february-2017/
CVE ID: CVE-2017-8916 State: PUBLISHED Published: 2018-01-31T16:00:00 Last Updated: 2024-08-05T16:48:22.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisecurity.org/cis-security-updates/incorrect-access-control-cve-2017-8916/
CVE ID: CVE-2017-8917 State: PUBLISHED Published: 2017-05-17T23:00:00 Last Updated: 2024-08-05T16:48:22.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98515 - https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html - https://www.exploit-db.com/exploits/44358/ - http://www.securitytracker.com/id/1038522 - https://www.exploit-db.com/exploits/42033/
CVE ID: CVE-2017-8918 State: PUBLISHED Published: 2017-09-12T18:00:00 Last Updated: 2024-08-05T16:48:22.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file. Additional Analyst Notes: - CVE Program Container: References: - https://thenopsled.com/Exploit-DB%20Writeup.txt
CVE ID: CVE-2017-8919 State: PUBLISHED Published: 2017-07-25T18:00:00 Last Updated: 2024-08-05T16:48:22.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated users to obtain sensitive password information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99957 - https://kb.netapp.com/support/s/article/ka51A0000008Spy/NTAP-20170718-0001
CVE ID: CVE-2017-8920 State: PUBLISHED Published: 2017-06-06T16:00:00 Last Updated: 2024-08-05T16:48:22.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS. Additional Analyst Notes: - CVE Program Container: References: - http://cgiirc.org/ - https://github.com/dgl/cgiirc/commit/46dd48442204207b52c16065ad67d294194afd8d
CVE ID: CVE-2017-8921 State: PUBLISHED Published: 2017-05-12T19:00:00Z Last Updated: 2024-09-16T23:56:50.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956. Additional Analyst Notes: - CVE Program Container: Refe
this one exists because of an incomplete fix for CVE-2016-9956. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/flightgear/flightgear/ci/faf872e7f71ca14c567ac7080561fc785d8d2fd0/
CVE ID: CVE-2017-8923 State: PUBLISHED Published: 2017-05-12T20:00:00 Last Updated: 2024-12-27T16:02:56.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98518 - https://bugs.php.net/bug.php?id=74577
CVE ID: CVE-2017-8924 State: PUBLISHED Published: 2017-05-12T21:00:00 Last Updated: 2024-08-05T16:48:22.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4 - https://github.com/torvalds/linux/commit/654b404f2a222f918af9b0cd18ad469d0c941a8e
/linux/kernel/v4.x/ChangeLog-4.10.4 - https://github.com/torvalds/linux/commit/654b404f2a222f918af9b0cd18ad469d0c941a8e - http://www.securityfocus.com/bid/98451 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=654b404f2a222f918af9b0cd18ad469d0c941a8e - http://www.debian.org/security/2017/dsa-3886
CVE ID: CVE-2017-8925 State: PUBLISHED Published: 2017-05-12T21:00:00 Last Updated: 2024-08-05T16:48:23.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4 - http://www.securityfocus.com/bid/98462 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=30572418b445d85fcfe6c8fe84c947d2606767d8 - https://github.com/torvalds/linux/commit/30572
/torvalds/linux.git/commit/?id=30572418b445d85fcfe6c8fe84c947d2606767d8 - https://github.com/torvalds/linux/commit/30572418b445d85fcfe6c8fe84c947d2606767d8 - http://www.debian.org/security/2017/dsa-3886
CVE ID: CVE-2017-8926 State: PUBLISHED Published: 2017-05-15T18:00:00 Last Updated: 2024-08-05T16:48:22.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42001/
CVE ID: CVE-2017-8927 State: PUBLISHED Published: 2017-05-15T18:00:00 Last Updated: 2024-08-05T16:48:22.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Larson VizEx Reader 9.7.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42002/
CVE ID: CVE-2017-8928 State: PUBLISHED Published: 2017-05-14T22:00:00 Last Updated: 2024-08-05T16:48:22.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42004/ - https://github.com/mailcow/mailcow-dockerized/pull/268/commits/3c937f75ba5853ada175542d5c4849fb95eb64cd
CVE ID: CVE-2017-8929 State: PUBLISHED Published: 2017-05-14T22:00:00Z Last Updated: 2024-09-16T22:36:17.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VirusTotal/yara/issues/658 - https://github.com/VirusTotal/yara/commit/053e67e3ec81cc9268ce30eaf0d6663d8639ed1e
CVE ID: CVE-2017-8930 State: PUBLISHED Published: 2017-05-14T22:00:00Z Last Updated: 2024-09-16T23:16:53.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can (1) create new administrator user accounts and take over the entire application, (2) create regular user accounts, or (3) change configuration parameters such as tax rates and the enable/disable status of PayPal payment modules. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simpleinvoices/simpleinvoices/issues/270
CVE ID: CVE-2017-8931 State: PUBLISHED Published: 2018-10-30T19:00:00 Last Updated: 2024-08-05T16:48:22.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/bitdefender-gravityzone-6-2-1-35-release-notes-1909.html
CVE ID: CVE-2017-8932 State: PUBLISHED Published: 2017-07-06T16:00:00 Last Updated: 2024-08-05T16:48:22.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries. Additional Analyst Notes: - CVE Program Container: Referenc
ttack against static ECDH, as used in popular JWT libraries. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/golang-announce/B5ww0iFt1_Q/TgUFJV14BgAJ - https://github.com/golang/go/commit/9294fa2749ffee7edbbb817a0ef9fe633136fa9c - https://access.redhat.com/errata/RHSA-2017:1859 - http://lists.opensuse.org/opensuse-updates/2017-06/msg00080.html - http://lists.opensuse.org/opensuse-updates/2017-06/msg00079.html - https://bugzilla.redhat.com/show_bug.cgi?id=1455191 - https://github.com/golang/go/issues/20040 - https://go-review.googlesource.com/c/41070/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
googlesource.com/c/41070/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZH4T47ROLZ6YEZBDVXVS2KISTDMXAPS/
CVE ID: CVE-2017-8933 State: PUBLISHED Published: 2017-05-15T14:00:00Z Last Updated: 2024-09-16T18:49:54.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu unavailability). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/862570 - https://git.lxde.org/gitweb/?p=lxde/menu-cache.git%3Ba=commit%3Bh=56f66684592abf257c4004e6e1fff041c64a12ce
CVE ID: CVE-2017-8934 State: PUBLISHED Published: 2017-05-15T14:00:00Z Last Updated: 2024-09-16T19:01:04.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/862571 - https://git.lxde.org/gitweb/?p=lxde/pcmanfm.git%3Ba=commit%3Bh=bc8c3d871e9ecc67c47ff002b68cf049793faf08
CVE ID: CVE-2017-8935 State: PUBLISHED Published: 2017-05-15T18:00:00Z Last Updated: 2024-09-16T19:35:07.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-8936 State: PUBLISHED Published: 2017-05-15T18:00:00Z Last Updated: 2024-09-17T00:46:23.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-8937 State: PUBLISHED Published: 2017-05-15T18:00:00Z Last Updated: 2024-09-16T20:01:30.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-8938 State: PUBLISHED Published: 2017-05-15T18:00:00Z Last Updated: 2024-09-16T23:16:22.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-8939 State: PUBLISHED Published: 2017-05-15T18:00:00Z Last Updated: 2024-09-16T23:15:26.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Warner Bros. ellentube app 3.1.1 through 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
CVE ID: CVE-2017-8940 State: PUBLISHED Published: 2017-05-15T18:00:00Z Last Updated: 2024-09-17T04:13:58.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f