Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-9809 State: PUBLISHED Published: 2019-05-22T18:54:58 Last Updated: 2024-08-05T17:18:02.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html
CVE ID: CVE-2017-9810 State: PUBLISHED Published: 2017-07-17T21:00:00 Last Updated: 2024-08-05T17:18:01.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jun/33 - http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html -
- http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html - http://www.securityfocus.com/bid/99330 - http://www.securitytracker.com/id/1038798 - https://www.exploit-db.com/exploits/42269/ - https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities
CVE ID: CVE-2017-9811 State: PUBLISHED Published: 2017-07-17T21:00:00 Last Updated: 2024-08-05T17:18:01.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jun/33 - http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html - http://www.securityfocus.co
y.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html - http://www.securityfocus.com/bid/99330 - http://www.securitytracker.com/id/1038798 - https://www.exploit-db.com/exploits/42269/ - https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities
CVE ID: CVE-2017-9812 State: PUBLISHED Published: 2017-07-17T21:00:00 Last Updated: 2024-08-05T17:18:02.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jun/33 - http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html - http://www.securityfocus.com/bid/99330 - http://ww
ersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html - http://www.securityfocus.com/bid/99330 - http://www.securitytracker.com/id/1038798 - https://www.exploit-db.com/exploits/42269/ - https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities
CVE ID: CVE-2017-9813 State: PUBLISHED Published: 2017-07-17T21:00:00 Last Updated: 2024-08-05T17:18:02.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jun/33 - http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html - http://www.securityfocus.com/bid/99330 - http://www.securitytracker.com/id/1038798 - h
97-XSS-CSRF-Code-Execution.html - http://www.securityfocus.com/bid/99330 - http://www.securitytracker.com/id/1038798 - https://www.exploit-db.com/exploits/42269/ - https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities
CVE ID: CVE-2017-9814 State: PUBLISHED Published: 2017-07-14T05:00:00 Last Updated: 2024-08-05T17:18:01.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freedesktop.org/show_bug.cgi?id=101547 - https://security.gentoo.org/glsa/201904-01 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00042.html - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.
042.html - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE ID: CVE-2017-9815 State: PUBLISHED Published: 2017-06-22T15:00:00 Last Updated: 2024-08-05T17:18:01.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in libtiff/tif_dirread.c mishandles a malloc operation, which allows attackers to cause a denial of service (memory leak within the function _TIFFmalloc in tif_unix.c) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3602-1/ - http://www.securityfocus.com/bid/99235 - http://bugzilla.maptools.org/show_bug.cgi?id=2682 - http://somevulnsofadlab.blogspot.jp/2017/06/libtiffmemory-leak-in-tiffmalloc.html
CVE ID: CVE-2017-9816 State: PUBLISHED Published: 2017-08-18T16:00:00 Last Updated: 2024-08-05T17:18:02.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Paessler PRTG Network Monitor before 17.2.32.2279 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.paessler.com/prtg/history/stable
CVE ID: CVE-2017-9818 State: PUBLISHED Published: 2018-08-24T21:00:00 Last Updated: 2024-08-05T17:18:01.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: The National Payments Corporation of India BHIM application 1.3 for Android relies on a four-digit passcode, which makes it easier for attackers to obtain access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/BHIM-App-PreliminaryReport.pdf
CVE ID: CVE-2017-9819 State: PUBLISHED Published: 2018-08-24T21:00:00 Last Updated: 2024-08-05T17:18:02.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: The National Payments Corporation of India BHIM application 1.3 for Android does not properly restrict use of the OTP feature, which makes it easier for attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/BHIM-App-PreliminaryReport.pdf
CVE ID: CVE-2017-9820 State: PUBLISHED Published: 2018-08-24T21:00:00 Last Updated: 2024-08-05T17:18:02.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: The National Payments Corporation of India BHIM application 1.3 for Android uses a custom keypad for which the input element is available to the Accessibility service, which makes it easier for attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/BHIM-App-PreliminaryReport.pdf
CVE ID: CVE-2017-9821 State: PUBLISHED Published: 2018-08-24T21:00:00 Last Updated: 2024-08-05T17:18:01.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIMB, IM-NPCIBM, and VK-NPCIBM) for SMS validation, which makes it easier for attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicj3lly/appexploits/blob/master/BHIM-App-PreliminaryReport.pdf
CVE ID: CVE-2017-9822 State: PUBLISHED Published: 2017-07-20T12:00:00.000Z Last Updated: 2025-10-21T23:55:36.233Z Vendors: DotNetNuke Products: DotNetNuke CMS Fixed in 9.1.1 Problem Types: Remote Code Execution via untrusted deserialization of Xml data Description: DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/102213 - http://www.dnnsoftware.com/community/security/security-center - http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Exec
ecurity/security-center - http://packetstormsecurity.com/files/157080/DotNetNuke-Cookie-Deserialization-Remote-Code-Execution.html
CVE ID: CVE-2017-9828 State: PUBLISHED Published: 2017-06-23T22:00:00Z Last Updated: 2024-09-16T19:35:20.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: '/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.cal1.cn/post/An%
he senderemail parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras
CVE ID: CVE-2017-9829 State: PUBLISHED Published: 2017-06-23T22:00:00Z Last Updated: 2024-09-17T01:26:29.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: '/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. Additional Analyst Notes: - CVE Program Container: References: - https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivote
: - CVE Program Container: References: - https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras
CVE ID: CVE-2017-9830 State: PUBLISHED Published: 2017-06-27T18:00:00 Last Updated: 2024-08-05T17:18:01.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiation) it creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients. Additional Analyst Notes: - CVE Program Container: References: - https://blog.radicallyopensecurity.com/CVE-2017-9830.html
CVE ID: CVE-2017-9831 State: PUBLISHED Published: 2017-06-24T00:00:00 Last Updated: 2024-08-05T17:18:01.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability in the ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/libmtp/mailman/message/35735992/ - https://lists.debian.org/debian-lts-announce/2020/04/msg00003.html
CVE ID: CVE-2017-9832 State: PUBLISHED Published: 2017-06-24T00:00:00 Last Updated: 2024-08-05T17:18:01.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL function) of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/libmtp/mailman/message/35729062 - https://lists.debian.org/debian-lts-announce/2020/04/msg00003.html
CVE ID: CVE-2017-9833 State: PUBLISHED Published: 2017-06-24T00:00:00 Last Updated: 2024-08-05T17:18:02.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/raw/rt7LJvyF - https://www.exploit-db.com/exploits/42290/
CVE ID: CVE-2017-9834 State: PUBLISHED Published: 2017-09-07T14:00:00 Last Updated: 2024-08-05T17:18:01.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8897 - https://www.exploit-db.com/exploits/42291/
CVE ID: CVE-2017-9835 State: PUBLISHED Published: 2017-07-26T19:00:00 Last Updated: 2024-08-05T17:18:02.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gs_alloc_ref_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-12 - https://bugs.ghostscript.com/show_bug.cgi?id=697985 - http://www.debian.org/security/2017/d
.gentoo.org/glsa/201811-12 - https://bugs.ghostscript.com/show_bug.cgi?id=697985 - http://www.debian.org/security/2017/dsa-3986 - http://www.securityfocus.com/bid/99991 - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=cfde94be1d4286bc47633c6e6eaf4e659bd78066
CVE ID: CVE-2017-9836 State: PUBLISHED Published: 2017-06-24T15:00:00Z Last Updated: 2024-09-16T17:09:04.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual_name parameter to /admin.php (i.e., creating a virtual album). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/716
CVE ID: CVE-2017-9837 State: REJECTED Published: 2017-06-24T15:00:00 Last Updated: 2017-10-09T14:57:02 Description: No description available.
CVE ID: CVE-2017-9838 State: PUBLISHED Published: 2018-04-11T03:00:00 Last Updated: 2024-08-05T17:18:02.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters). Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008
CVE ID: CVE-2017-9839 State: PUBLISHED Published: 2018-04-11T03:00:00 Last Updated: 2024-08-05T17:18:01.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter). Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010
CVE ID: CVE-2017-9840 State: PUBLISHED Published: 2017-06-25T12:00:00 Last Updated: 2024-08-05T17:18:01.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-009
CVE ID: CVE-2017-9841 State: PUBLISHED Published: 2017-06-27T17:00:00.000Z Last Updated: 2025-10-21T23:55:39.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/101798 - http://www.securitytracker.com/id/1039812 - https://securi
ment: References: - http://www.securityfocus.com/bid/101798 - http://www.securitytracker.com/id/1039812 - https://security.gentoo.org/glsa/201711-15 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5 - https://github.com/sebastianbergmann/phpunit/pull/1956 - http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
CVE ID: CVE-2017-9843 State: PUBLISHED Published: 2017-07-12T16:00:00 Last Updated: 2024-08-05T17:18:02.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe, aka SAP Security Note 2406841. Additional Analyst Notes: - CVE Program Container: References: - https://erpscan.io/advisories/erpscan-17-010-sap-netweaver-abap-dispwork-crash-using-cl_java_script/ - http://www.securityfocus.com/bid/96900
CVE ID: CVE-2017-9844 State: PUBLISHED Published: 2017-07-12T16:00:00.000Z Last Updated: 2025-05-01T14:35:03.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96865 -
the service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96865 - https://erpscan.io/advisories/erpscan-17-014-sap-netweaver-java-deserialization-untrusted-user-value-metadatauploader/ - https://me.sap.com/notes/2399804
CVE ID: CVE-2017-9845 State: PUBLISHED Published: 2017-07-12T16:00:00 Last Updated: 2024-08-05T17:18:02.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note 2405918. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96874 - https://erpscan.io/advisories/erpscan-17-015-sap-netweaver-dispwork-anonymous-denial-service/
CVE ID: CVE-2017-9846 State: PUBLISHED Published: 2017-06-24T17:00:00 Last Updated: 2024-08-05T17:18:01.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhonghaozhao/winmail/issues/1 - http://www.magicwinmail.com/changelog.php
CVE ID: CVE-2017-9847 State: PUBLISHED Published: 2017-06-24T17:00:00Z Last Updated: 2024-09-17T00:45:56.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bdecode function in bdecode.cpp in libtorrent 1.1.3 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/arvidn/libtorrent/issues/2099
CVE ID: CVE-2017-9848 State: PUBLISHED Published: 2017-06-24T17:00:00 Last Updated: 2024-08-05T17:18:01.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0 could allow remote attackers to execute arbitrary SQL commands via an XML document containing a crafted ArticleIDs element within a GetArticleHitsArray element. Additional Analyst Notes: - CVE Program Container: References: - http://www.2cto.com/article/201409/338712.html - https://github.com/Akityo/TOPSEC/issues/1 - http://www.huilan.com/zkhl/resource/cms/2015/09/2015091814311792443.pdf
CVE ID: CVE-2017-9851 State: PUBLISHED Published: 2017-08-05T17:00:00 Last Updated: 2024-08-05T17:18:01.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the application can be crashed. NOTE: the vendor reports that the maximum possible damage is a communication failure. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://www.sma.de/en/statement-on-cyber-security.html - https://ho
Vulnrichment: - CVE Program Container: References: - http://www.sma.de/en/statement-on-cyber-security.html - https://horusscenario.com/CVE-information/ - http://www.sma.de/fileadmin/content/global/specials/documents/cyber-security/Whitepaper-Cyber-Security-AEN1732_07.pdf
CVE ID: CVE-2017-9852 State: PUBLISHED Published: 2017-08-05T17:00:00 Last Updated: 2024-08-05T17:18:01.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company (but are sometimes changed). Hidden user accounts have (at least in some cases, though more research is required to test this for all hidden user accounts) a fixed password for all devices; it can never be changed by a user. Other vulnerabi