Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-16654 State: PUBLISHED Published: 2018-08-06T21:00:00 Last Updated: 2024-08-05T20:27:04.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read() methods of these classes use a path and a locale to determine the language bundle to retrieve. The locale argument value is commonly retrieved from untrusted user input (like a URL parameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack, aka Direc
rameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack, aka Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/pull/24994 - https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths - https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html - https://www.debian.org/security/2018/dsa-4262
CVE ID: CVE-2017-16659 State: PUBLISHED Published: 2017-11-08T05:00:00Z Last Updated: 2024-09-16T20:27:36.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Gentoo mail-filter/assp package 1.9.8.13030 and earlier allows local users to gain privileges by leveraging access to the assp user account to install a Trojan horse /usr/share/assp/assp.pl script. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.gentoo.org/629442
CVE ID: CVE-2017-16660 State: PUBLISHED Published: 2017-11-08T05:00:00Z Last Updated: 2024-09-16T17:03:51.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/issues/1066
CVE ID: CVE-2017-16661 State: PUBLISHED Published: 2017-11-08T05:00:00Z Last Updated: 2024-09-16T19:04:14.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/issues/1066
CVE ID: CVE-2017-16663 State: PUBLISHED Published: 2017-11-08T06:00:00 Last Updated: 2024-08-05T20:27:04.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: In sam2p 0.49.4, there are integer overflows (with resultant heap-based buffer overflows) in input-bmp.ci in the function ReadImage, because "width * height" multiplications occur unsafely. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pts/sam2p/issues/16 - https://lists.debian.org/debian-lts-announce/2017/11/msg00031.html
CVE ID: CVE-2017-16664 State: PUBLISHED Published: 2017-11-21T14:00:00 Last Updated: 2024-08-05T20:27:04.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4047 - https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html - https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framewor
debian-lts-announce/2017/12/msg00015.html - https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/
CVE ID: CVE-2017-16665 State: PUBLISHED Published: 2017-11-08T17:00:00Z Last Updated: 2024-09-17T00:26:54.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting (XSS) attack via the service parameter to the /soap URI, triggering an invalid attempt to generate WSDL. Additional Analyst Notes: - CVE Program Container: References: - https://talk.remobjects.com/t/reflected-cross-site-scripting-xss-vulnerability/14662
CVE ID: CVE-2017-16666 State: PUBLISHED Published: 2018-01-05T16:00:00 Last Updated: 2024-08-05T20:27:04.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file. NOTE: this issue can be exploited without authentication by leveraging the user registration feature. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145639/Xplico-Remote-Code-Execution.html - http://blog.securityonion.net/2017/11/security-advisory-for-xplico-120.html - https://www.xplico.org/archives/1538 - https://pentest.blog
ityonion.net/2017/11/security-advisory-for-xplico-120.html - https://www.xplico.org/archives/1538 - https://pentest.blog/advisory-xplico-unauthenticated-remote-code-execution-cve-2017-16666/ - https://www.exploit-db.com/exploits/43430/ - http://www.rapid7.com/db/modules/exploit/linux/http/xplico_exec
CVE ID: CVE-2017-16667 State: PUBLISHED Published: 2017-11-08T18:00:00 Last Updated: 2024-08-05T20:27:04.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bit-team/backintime/commit/cef81d0da93ff601252607df3db1a48f7f6f01b3 - http
m Container: References: - https://github.com/bit-team/backintime/commit/cef81d0da93ff601252607df3db1a48f7f6f01b3 - https://security.gentoo.org/glsa/201801-06 - https://github.com/bit-team/backintime/issues/834 - https://github.com/bit-team/backintime/releases/tag/v1.1.24
CVE ID: CVE-2017-16669 State: PUBLISHED Published: 2017-11-09T00:00:00 Last Updated: 2024-08-05T20:27:04.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: coders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the AcquireCacheNexus function in magick/pixel_cache.c. Additional Analyst Notes: - CVE Program Container: References: - http://hg.code.sf.net/p/graphicsmagick/code/rev/1b9e64a8901e - http://hg.code.sf.net/p/graphicsmagick/code/rev/2b7c826d36af - http://www.securityfocus.com/bid/101795 - http://hg.code.sf.net/p/gra
de.sf.net/p/graphicsmagick/code/rev/2b7c826d36af - http://www.securityfocus.com/bid/101795 - http://hg.code.sf.net/p/graphicsmagick/code/rev/fcd3ed3394f6 - https://lists.debian.org/debian-lts-announce/2017/11/msg00013.html - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/135bdcb88b8d - https://sourceforge.net/p/graphicsmagick/bugs/450/ - http://hg.code.sf.net/p/graphicsmagick/code/rev/75245a215fff - http://hg.code.sf.net/p/graphicsmagick/code/rev/2a21cda3145b - http://hg.code.sf.net/p/graphicsmagick/code/rev/3dc7b4e3779d - http://hg.code.sf.net/p/graphicsmagick/code/rev/e8086
b - http://hg.code.sf.net/p/graphicsmagick/code/rev/3dc7b4e3779d - http://hg.code.sf.net/p/graphicsmagick/code/rev/e8086faa52d0 - https://usn.ubuntu.com/4248-1/
CVE ID: CVE-2017-16670 State: PUBLISHED Published: 2018-02-19T19:00:00 Last Updated: 2024-08-05T20:27:04.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/146339/SoapUI-5.3.0-Code-Execution.html
CVE ID: CVE-2017-16671 State: PUBLISHED Published: 2017-11-09T00:00:00 Last Updated: 2024-08-05T20:35:19.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer. Additional Analyst Notes: - CVE Program Container: References: - http://www.
7, which was only about the Party A buffer. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101760 - http://downloads.digium.com/pub/security/AST-2017-010.html - https://security.gentoo.org/glsa/201811-11 - https://www.debian.org/security/2017/dsa-4076 - https://issues.asterisk.org/jira/browse/ASTERISK-27337
CVE ID: CVE-2017-16672 State: PUBLISHED Published: 2017-11-09T00:00:00 Last Updated: 2024-08-05T20:35:19.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.digium.com/pub/security/AST-2017-011
. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.digium.com/pub/security/AST-2017-011.html - http://www.securityfocus.com/bid/101765 - https://issues.asterisk.org/jira/browse/ASTERISK-27345 - https://security.gentoo.org/glsa/201811-11 - https://www.debian.org/security/2017/dsa-4076
CVE ID: CVE-2017-16673 State: PUBLISHED Published: 2017-11-09T04:00:00Z Last Updated: 2024-09-16T20:37:56.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Datto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an attacker to impersonate a Datto Backup Appliance to "pair" with the agent and issue requests to this agent, if the attacker can reach the agent on TCP port 25566 or 25568, and send unspecified "specific information" by which the agent identifies a network device that is "appearing to be a valid Datto." Additional Analyst Notes: - CVE Program Container: References: - https://www.datto.com/partner-security-update-nov2017
CVE ID: CVE-2017-16674 State: PUBLISHED Published: 2017-11-09T04:00:00Z Last Updated: 2024-09-17T03:58:37.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent (DWA) 1.0.5.0 and earlier. In other words, an attacker could combine this "primary/secondary" attack with the CVE-2017-16673 "rogue pairing" attack to achieve unauthenticated access to all agent machines running these older DWA versions. Additional Analyst
ng" attack to achieve unauthenticated access to all agent machines running these older DWA versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.datto.com/partner-security-update-nov2017
CVE ID: CVE-2017-16678 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-17T00:11:33.677Z Vendors: SAP Products: SAP NetWeaver Knowledge Management Configuration Service Problem Types: Server Side Request Forgery (SSRF) Description: Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2457562 - https://blogs.sap.com/2017/12/1
CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2457562 - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - http://www.securityfocus.com/bid/102149
CVE ID: CVE-2017-16679 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T17:03:13.412Z Vendors: SAP Products: SAP Startup Service Problem Types: URL Redirection Description: URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52, that allows an attacker to redirect users to a malicious site. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - http://www.securityfocus.com/bid/102157 - https://launchpad.support.sap.com/#/notes/2
ecurity-patch-day-december-2017/ - http://www.securityfocus.com/bid/102157 - https://launchpad.support.sap.com/#/notes/2520995
CVE ID: CVE-2017-16680 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T18:59:59.098Z Vendors: SAP Products: SAP HANA extended application services Problem Types: Audit Log Injections Description: Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are missing user input validation which could allow unprivileged attackers to forge audit log lines. Hence the interpretation of audit log files could be hindered or misdirected. 2) User Account and Authentication writes audit logs into syslog and additionally writes the same audit entries into a log file. Entries in the log
cation writes audit logs into syslog and additionally writes the same audit entries into a log file. Entries in the log file miss escaping. Hence the interpretation of audit log files could be hindered or misdirected, while the entries in syslog are correct. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102138 - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.com/#/notes/2522510
CVE ID: CVE-2017-16681 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T17:48:18.515Z Vendors: SAP Products: SAP Business Intelligence Promotion Management Application. Problem Types: Cross-Site Scripting (XSS) Description: Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as user controlled inputs are not sufficiently encoded. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102142 - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.com/#/notes/2523913
CVE ID: CVE-2017-16682 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T22:39:53.093Z Vendors: SAP Products: SAP NetWeaver Internet Transaction Server (ITS) Problem Types: Code Injection Description: SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102143 - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.supp
tyfocus.com/bid/102143 - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.com/#/notes/2526781
CVE ID: CVE-2017-16683 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T22:20:32.144Z Vendors: SAP Products: SAP Business Objects Platform Problem Types: Denial of Service (DOS) Description: Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a service. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - http://www.securityfocus.com/bid/102146 - https://launchpad.support.sap.com/#/notes/2531656
CVE ID: CVE-2017-16684 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T18:49:41.000Z Vendors: SAP Products: SAP Business Intelligence Promotion Management Application Problem Types: Missing Authentication Check Description: SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that require user identity. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.com/#/notes/2537152 - http://www.securityfocus.com/bid/102147
CVE ID: CVE-2017-16685 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T19:01:36.283Z Vendors: SAP Products: SAP Business Warehouse Universal Data Integration Problem Types: Cross-Site scripting (XSS). Description: Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insufficient encoding of user controlled inputs. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - http://www.securityfocus.com/bid/102148 - https://launchpad.support.sap.com/#/notes/2537545
CVE ID: CVE-2017-16687 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T23:41:51.057Z Vendors: SAP Products: SAP HANA extended application services Problem Types: Information Disclosure Description: The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 and 2.00, can be misused to enumerate valid and invalid user accounts. An unauthenticated user could use the error messages to determine if a given username is valid. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.c
: References: - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.com/#/notes/2549983 - http://www.securityfocus.com/bid/102152
CVE ID: CVE-2017-16689 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-17T03:03:01.674Z Vendors: SAP Products: Trusted RFC connection Problem Types: Additional authentication check in Trusted RFC on same system Description: A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established to a different client or a different user on the same system, although no explicit Trusted/Trusting Relation to the same system has been defined. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102144 - ht
n defined. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102144 - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.com/#/notes/2449757
CVE ID: CVE-2017-16690 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-16T19:50:53.945Z Vendors: SAP Products: SAP Plant Connectivity Problem Types: DLL preload attack Description: A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It is possible that SAPSetup / NwSapSetup.exe loads system DLLs like DWMAPI.dll (located in your Syswow64 / System32 folder) from the folder the executable is in and not from the system location. The desired behavior is that system dlls are only loaded from the system folders. If a dll with the same name as the system dll is located in the same folder as the
only loaded from the system folders. If a dll with the same name as the system dll is located in the same folder as the executable, this dll is loaded and code is executed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102145 - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.com/#/notes/2529480
CVE ID: CVE-2017-16691 State: PUBLISHED Published: 2017-12-12T14:00:00Z Last Updated: 2024-09-17T00:31:20.128Z Vendors: SAP Products: SAP Note Assistant Problem Types: Digital signature verification along with note file extraction Description: SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extr
archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/ - https://launchpad.support.sap.com/#/notes/2546220 - http://www.securityfocus.com/bid/101822
CVE ID: CVE-2017-16709 State: PUBLISHED Published: 2018-07-11T16:00:00 Last Updated: 2024-08-05T20:35:19.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE-2017-16709 - https://www.tenable.com/security/research/tra-2019-20 - http://packetstormsecurity.com/files/154362/AwindInc-SNM
16709 - https://www.tenable.com/security/research/tra-2019-20 - http://packetstormsecurity.com/files/154362/AwindInc-SNMP-Service-Command-Injection.html
CVE ID: CVE-2017-16710 State: PUBLISHED Published: 2018-07-11T16:00:00 Last Updated: 2024-08-05T20:35:19.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE-2017-16710