alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2017-5659 (published 2017-04-17)
Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: apache
Affected products: traffic_server
CVE-2017-5660 (published 2018-02-27)
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: apache, debian
Affected products: debian_linux, traffic_server
CVE-2017-5661 (published 2017-04-18)
In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-611
Affected vendors: apache
Affected products: formatting_objects_processor
CVE-2017-5662 (published 2017-04-18)
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-611
Affected vendors: apache
Affected products: batik
CVE-2017-5663 (published 2017-12-14)
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to the query.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: apache
Affected products: fineract
CVE-2017-5664 (published 2017-06-06)
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-755
Affected vendors: apache
Affected products: tomcat
CVE-2017-5665 (published 2017-03-01)
The splt_cue_export_to_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: libmp3splt_project
Affected products: libmp3splt
CVE-2017-5666 (published 2017-03-01)
The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (invalid free and crash) via a crafted file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: mp3splt_project
Affected products: mp3splt
CVE-2017-5667 (published 2017-03-16)
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: debian, qemu
Affected products: debian_linux, qemu
CVE-2017-5668 (published 2017-03-14)
bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-10189.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: bitlbee
Affected products: bitlbee, bitlbee-libpurple
CVE-2017-5669 (published 2017-02-24)
The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: canonical, debian, linux
Affected products: debian_linux, linux_kernel, ubuntu_linux
CVE-2017-5670 (published 2017-04-04)
Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate attackers to obtain sensitive information by reading raw disk blocks.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: riverbed
Affected products: rios
CVE-2017-5671 (published 2017-03-29)
Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriting the /etc/shadow file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: honeywell
Affected products: intermec_pc23, intermec_pc23_firmware, intermec_pc42, intermec_pc42_firmware, intermec_pc43, intermec_pc43_firmware, intermec_pd43, intermec_pd43_firmware, intermec_pm23, intermec_pm23_firmware, intermec_pm42, intermec_pm42_firmware, intermec_pm43, intermec_pm43_firmware
CVE-2017-5672 (published 2017-04-11)
Kony Enterprise Mobile Management (EMM) before 4.2.5.2 has the vulnerability of disclosing the private key in clear-text when changing the parameters of the request.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-200
Affected vendors: kony
Affected products: enterprise_mobile_management
CVE-2017-5673 (published 2017-03-22)
In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject (aka topic subject) accepts JavaScript, leading to XSS. Six files are affected: crypsis/layouts/message/item/default.php, crypsis/layouts/message/item/top/default.php, crypsis/layouts/message/item/bottom/default.php, crypsisb3/layouts/message/item/default.php, crypsisb3/layouts/message/item/top/default.php, and crypsisb3/layouts/message/item/bottom/default.php. This is fixed in 5.0.5.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: kunena
Affected products: kunena
CVE-2017-5674 (published 2017-03-13)
A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-200
Affected vendors: embedthis
Affected products: goahead
CVE-2017-5675 (published 2017-03-13)
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will be executed with root privileges.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: embedthis
Affected products: goahead
CVE-2017-5677 (published 2017-02-06)
PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root cause is an incorrect regular expression.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: pear
Affected products: html_ajax
CVE-2017-5681 (published 2017-03-07)
The RSA-CRT implementation in the Intel QuickAssist Technology (QAT) Engine for OpenSSL versions prior to 0.5.19 may allow remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: quickassist_technology_engine
CVE-2017-5682 (published 2017-02-28)
Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives, Intel Math Kernel Library, Intel Data Analytics Acceleration Library, and Intel Threading Building Blocks before 2017 Update 2 allows an attacker to launch a process with escalated privileges.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: advisor, cryptography_for_intel_integrated_performance_primitives, data_analytics_acceleration_library, inspector, integrated_performance_primitives, math_kernel_library, mpi_library, parallel_studio_xe, system_studio, threading_building_blocks, trace_analyzer_and_collector, vtune_amplifier
CVE-2017-5683 (published 2017-04-04)
Privilege escalation in IntelHAXM.sys driver in the Intel Hardware Accelerated Execution Manager before version 6.0.6 allows a local user to gain system level access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: hardware_accelerated_execution_manager
CVE-2017-5684 (published 2017-04-03)
The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system to gain access to personal information.
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-276
Affected vendors: intel
Affected products: stk2mv64cc, stk2mv64cc_bios
CVE-2017-5685 (published 2017-04-03)
The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system to gain access to personal information.
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-276
Affected vendors: intel
Affected products: nuc6i7kyk, nuc6i7kyk_bios
CVE-2017-5686 (published 2017-04-03)
The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system to gain access to personal information.
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-276
Affected vendors: intel
Affected products: nuc6i3syh_bios, nuc6i3syk, nuc6i3syk_bios, nuc6i5syh
CVE-2017-5688 (published 2017-05-31)
There is an escalation of privilege vulnerability in the Intel Solid State Drive Toolbox versions before 3.4.5 which allow a local administrative attacker to load and execute arbitrary code.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: solid_state_drive_toolbox
CVE-2017-5689 (published 2017-05-02)
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: hpe, intel, siemens
Affected products: active_management_technology_firmware, proliant_ml10_gen9_server, proliant_ml10_gen9_server_firmware, simatic_field_pg_m3, simatic_field_pg_m3_firmware, simatic_field_pg_m4, simatic_field_pg_m4_firmware, simatic_field_pg_m5, simatic_field_pg_m5_firmware, simatic_ipc427d, simatic_ipc427d_firmware, simatic_ipc427e, simatic_ipc427e_firmware, simatic_ipc477d, simatic_ipc477d_firmware, simatic_ipc477e, simatic_ipc477e_firmware, simatic_ipc547d, simatic_ipc547d_firmware, simatic_ipc547e, simatic_ipc547e_firmware, simatic_ipc547g, simatic_ipc547g_firmware, simatic_ipc627c, simatic_ipc627c_firmware
Added to CISA KEV catalog: 2022-01-28
KEV required action: Apply updates per vendor instructions.
CVE-2017-5691 (published 2017-07-26)
Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Affected vendors: intel
Affected products: lr1304spcfg1, lr1304spcfg1_bios, lr1304spcfg1r, lr1304spcfg1r_bios, nuc6i3syk, nuc6i3syk_bios, nuc6i5syk, nuc6i5syk_bios, nuc6i7kyk, nuc6i7kyk_bios, nuc7i3bnk, nuc7i3bnk_bios, nuc7i5bnk, nuc7i5bnk_bios, nuc7i7bnh, nuc7i7bnh_bios, r1208sposhor, r1208sposhor_bios, r1208sposhorr, r1208sposhorr_bios, r1304sposhbn, r1304sposhbn_bios, r1304sposhbnr, r1304sposhbnr_bios, r1304sposhor
CVE-2017-5692 (published 2018-08-01)
Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local users to perform a denial of service attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: intel
Affected products: graphics_driver
CVE-2017-5693 (published 2018-07-31)
Firmware in the Intel Puma 5, 6, and 7 Series might experience resource depletion or timeout, which allows a network attacker to create a denial of service via crafted network traffic.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: intel
Affected products: puma, puma_firmware
CVE-2017-5694 (published 2017-08-09)
Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P, PSF109P allows local users to cause a denial of service via unspecified vectors.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: ssd_pro_6000p, ssd_pro_6000p_firmware
CVE-2017-5695 (published 2017-08-09)
Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware versions LSBG200, LSF031C, LSF036C, LBF010C, LSBG100, LSF031C, LSF036C, LBF010C, LSF031P, LSF036P, LBF010P, LSF031P, LSF036P, LBF010P, LSMG200, LSF031E, LSF036E, LSMG100, LSF031E, LSF036E, LSDG200, LSF031D, LSF036D allows local users to cause a denial of service via unspecified vectors.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: ssd_540s_2.5\", ssd_540s_2.5\"_firmware, ssd_540s_m.2, ssd_540s_series_m.2_firmware, ssd_dc_s3100, ssd_dc_s3100_firmware, ssd_e_5400s_2.5\", ssd_e_5400s_2.5\"_firmware, ssd_e_5400s_m.2, ssd_e_5400s_m.2_firmware, ssd_pro_5400s_2.5\", ssd_pro_5400s_2.5\"_firmware, ssd_pro_5400s_m.2, ssd_pro_5400s_m.2_firmware
CVE-2017-5696 (published 2018-01-18)
Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-426
Affected vendors: intel
Affected products: graphics_driver
CVE-2017-5697 (published 2017-06-14)
Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 11.6.25.1129 potentially allowing a remote attacker to hijack users web clicks via attacker's crafted web page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-1021
Affected vendors: intel
Affected products: active_management_technology_firmware
CVE-2017-5698 (published 2017-09-05)
Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollback will not prevent upgrading to firmware version 11.6.x.1xxx which is vulnerable to CVE-2017-5689 and can be performed by a local user with administrative privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: intel
Affected products: active_management_technology_firmware, manageability_engine_firmware, small_business_technology_firmware
CVE-2017-5699 (published 2018-01-18)
Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: minnowboard_3, minnowboard_3_firmware
CVE-2017-5700 (published 2017-10-11)
Insufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to bypass Administrator and User passwords via access to password storage.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: intel
Affected products: nuc7i3bnh, nuc7i3bnh_firmware, nuc7i3bnk, nuc7i3bnk_firmware, nuc7i5bnh, nuc7i5bnh_firmware, nuc7i5bnk, nuc7i5bnk_firmware, nuc7i7bnh, nuc7i7bnh_firmware
CVE-2017-5701 (published 2017-10-11)
Insecure platform configuration in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows an attacker with physical presence to run arbitrary code via unauthorized firmware modification during BIOS Recovery.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: intel
Affected products: nuc7i3bnh, nuc7i3bnh_firmware, nuc7i3bnk, nuc7i3bnk_firmware, nuc7i5bnh, nuc7i5bnh_firmware, nuc7i5bnk, nuc7i5bnk_firmware, nuc7i7bnh, nuc7i7bnh_firmware
CVE-2017-5703 (published 2018-04-03)
Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: intel
Affected products: atom_c2308, atom_c2316, atom_c2338, atom_c2350, atom_c2358, atom_c2508, atom_c2516, atom_c2518, atom_c2530, atom_c2538, atom_c2550, atom_c2558, atom_c2718, atom_c2730, atom_c2738, atom_c2750, atom_c2758, atom_c3308, atom_c3338, atom_c3508, atom_c3538, atom_c3558, atom_c3708, atom_c3750, atom_c3758
CVE-2017-5704 (published 2018-07-10)
Platform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7th Gen Intel Core Processor potentially exposes password information in memory to a local attacker with administrative privileges.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: intel
Affected products: core_i3, core_i5, core_i7
CVE-2017-5705 (published 2017-11-21)
Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: intel
Affected products: manageability_engine_firmware
CVE-2017-5706 (published 2017-11-21)
Multiple buffer overflows in kernel in Intel Server Platform Services Firmware 4.0 allow attacker with local access to the system to execute arbitrary code.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: intel
Affected products: server_platform_services_firmware
CVE-2017-5707 (published 2017-11-21)
Multiple buffer overflows in kernel in Intel Trusted Execution Engine Firmware 3.0 allow attacker with local access to the system to execute arbitrary code.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: intel
Affected products: trusted_execution_engine_firmware
CVE-2017-5708 (published 2017-11-21)
Multiple privilege escalations in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow unauthorized process to access privileged content via unspecified vector.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: manageability_engine_firmware
CVE-2017-5709 (published 2017-11-21)
Multiple privilege escalations in kernel in Intel Server Platform Services Firmware 4.0 allows unauthorized process to access privileged content via unspecified vector.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: server_platform_services_firmware
CVE-2017-5710 (published 2017-11-21)
Multiple privilege escalations in kernel in Intel Trusted Execution Engine Firmware 3.0 allows unauthorized process to access privileged content via unspecified vector.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: trusted_execution_engine_firmware
CVE-2017-5711 (published 2017-11-21)
Multiple buffer overflows in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system to execute arbitrary code with AMT execution privilege.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: asus, intel, siemens
Affected products: active_management_technology_firmware, b150-a, b150-a_firmware, b150-plus, b150-plus_firmware, b150-pro, b150-pro_d3, b150-pro_d3_firmware, b150-pro_firmware, b150_pro_gaming, b150_pro_gaming\/aura, b150_pro_gaming\/aura_firmware, b150_pro_gaming_d3, b150_pro_gaming_d3_firmware, b150_pro_gaming_firmware, b150i_pro_gaming\/aura, b150i_pro_gaming\/aura_firmware, b150i_pro_gaming\/wifi\/aura, b150i_pro_gaming\/wifi\/aura_firmware, b150m-a, b150m-a\/m.2, b150m-a\/m.2_firmware, b150m-a_d3, b150m-a_d3_firmware, b150m-a_firmware
CVE-2017-5712 (published 2017-11-21)
Buffer overflow in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allows attacker with remote Admin access to the system to execute arbitrary code with AMT execution privilege.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: asus, intel, siemens
Affected products: active_management_technology_firmware, b150-a, b150-a_firmware, b150-plus, b150-plus_firmware, b150-pro, b150-pro_d3, b150-pro_d3_firmware, b150-pro_firmware, b150_pro_gaming, b150_pro_gaming\/aura, b150_pro_gaming\/aura_firmware, b150_pro_gaming_d3, b150_pro_gaming_d3_firmware, b150_pro_gaming_firmware, b150i_pro_gaming\/aura, b150i_pro_gaming\/aura_firmware, b150i_pro_gaming\/wifi\/aura, b150i_pro_gaming\/wifi\/aura_firmware, b150m-a, b150m-a\/m.2, b150m-a\/m.2_firmware, b150m-a_d3, b150m-a_d3_firmware, b150m-a_firmware
CVE-2017-5715 (published 2018-01-04)
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: arm, canonical, debian, intel, netapp, oracle, siemens
Affected products: atom_c, atom_e, atom_x3, atom_x5-e3930, atom_x5-e3940, atom_x7-e3950, atom_z, celeron_j, celeron_n, communications_diameter_signaling_router, core_i3, core_i5, core_i7, core_m, core_m3, core_m5, core_m7, cortex-a, debian_linux, hci_compute_node, hci_management_node, pentium_j, pentium_n, simatic_winac_rtx_\(f\)_2010, simatic_winac_rtx_\(f\)_firmware
CVE-2017-5717 (published 2017-12-12)
Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileges via local access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-704
Affected vendors: intel
Affected products: graphics_driver
CVE-2017-5719 (published 2017-11-21)
A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a local user.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: deep_learning_training_tool
CVE-2017-5721 (published 2017-10-11)
Insufficient input validation in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to execute arbitrary code via manipulation of memory.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: nuc7i3bnh, nuc7i3bnh_firmware, nuc7i3bnk, nuc7i3bnk_firmware, nuc7i5bnh, nuc7i5bnh_firmware, nuc7i5bnk, nuc7i5bnk_firmware, nuc7i7bnh, nuc7i7bnh_firmware
CVE-2017-5722 (published 2017-10-11)
Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows attackers with local or physical access to bypass enforcement of integrity protections via manipulation of firmware storage.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: intel
Affected products: nuc7i3bnh, nuc7i3bnh_firmware, nuc7i3bnk, nuc7i3bnk_firmware, nuc7i5bnh, nuc7i5bnh_firmware, nuc7i5bnk, nuc7i5bnk_firmware, nuc7i7bnh, nuc7i7bnh_firmware
CVE-2017-5727 (published 2018-02-02)
Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to elevate privileges via local access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: intel
Affected products: graphics_driver
CVE-2017-5729 (published 2017-11-21)
Frame replay vulnerability in Wi-Fi subsystem in Intel Dual-Band and Tri-Band Wireless-AC Products allows remote attacker to replay frames via channel-based man-in-the-middle.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
Affected vendors: intel
Affected products: active_management_technology_firmware, dual_band_wireless-ac_3160, dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_7260, dual_band_wireless-ac_7265, dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, dual_band_wireless-n_7260, dual_band_wireless-n_7265, tri-band_wireless-ac_17265, tri-band_wireless-ac_18260, tri-band_wireless-ac_18265, wireless-ac_9260, wireless-n_7260, wireless-n_7265
CVE-2017-5731 (published 2019-10-28)
Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: tianocore
Affected products: edk2
CVE-2017-5736 (published 2018-03-20)
An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code as administrator.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: intel
Affected products: software_guard_extensions_platform_software_component
CVE-2017-5738 (published 2017-11-16)
Escalation of privilege vulnerability in admin portal for Intel Unite App versions 3.1.32.12, 3.1.41.18 and 3.1.45.26 allows an attacker with network access to cause a denial of service and/or information disclosure.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-200
Affected vendors: intel
Affected products: unite
CVE-2017-5753 (published 2018-01-04)
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: arm, canonical, debian, intel, netapp, opensuse, oracle, pepperl-fuchs, phoenixcontact, siemens, suse, synology, vmware
Affected products: atom_c, atom_e, atom_x3, atom_x5-e3930, atom_x5-e3940, atom_x7-e3950, atom_z, bl2_bpc_1000, bl2_bpc_1000_firmware, bl2_bpc_2000, bl2_bpc_2000_firmware, bl2_bpc_7000, bl2_bpc_7000_firmware, bl2_ppc_1000, bl2_ppc_1000_firmware, bl2_ppc_2000, bl2_ppc_2000_firmware, bl2_ppc_7000, bl2_ppc_7000_firmware, bl_bpc_2000, bl_bpc_2000_firmware, bl_bpc_2001, bl_bpc_2001_firmware, bl_bpc_3000, bl_bpc_3000_firmware
CVE-2017-5754 (published 2018-01-04)
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: arm, intel
Affected products: atom_c, atom_e, atom_x3, atom_z, celeron_j, celeron_n, core_i3, core_i5, core_i7, core_m, core_m3, core_m5, core_m7, cortex-a, pentium_j, pentium_n, xeon, xeon_bronze_3104, xeon_bronze_3106, xeon_e-1105c, xeon_e3, xeon_e3_1105c_v2, xeon_e3_1125c, xeon_e3_1125c_v2, xeon_e3_1220
CVE-2017-5780 (published 2018-02-15)
A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: hp
Affected products: matrix_operating_environment
CVE-2017-5781 (published 2018-02-15)
A CSRF vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: hp
Affected products: matrix_operating_environment
CVE-2017-5782 (published 2018-02-15)
A missing HSTS Header vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: hp
Affected products: matrix_operating_environment
CVE-2017-5783 (published 2018-02-15)
A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-20
Affected vendors: hp
Affected products: matrix_operating_environment
CVE-2017-5784 (published 2018-02-15)
A missing HSTS Header vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: hp
Affected products: matrix_operating_environment
CVE-2017-5785 (published 2018-02-15)
A remote information disclosure vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-200
Affected vendors: hp
Affected products: matrix_operating_environment
CVE-2017-5786 (published 2018-02-15)
A local Unauthorized Data Modification vulnerability in HPE OfficeConnect Network Switches version PT.02.01 including PT.01.03 through PT.01.14
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: hp
Affected products: officeconnect_1820_24g_poe\+_\(185w\)_switch_j9983a, officeconnect_1820_24g_poe\+_\(185w\)_switch_j9983a_firmware, officeconnect_1820_24g_switch_j9980a, officeconnect_1820_24g_switch_j9980a_firmware, officeconnect_1820_48g_poe\+_\(370w\)_switch_j9984a, officeconnect_1820_48g_poe\+_\(370w\)_switch_j9984a_firmware, officeconnect_1820_48g_switch_j9981a, officeconnect_1820_48g_switch_j9981a_firmware, officeconnect_1820_8g_poe\+_\(65w\)_switch_j9982a, officeconnect_1820_8g_poe\+_\(65w\)_switch_j9982a_firmware, officeconnect_1820_8g_switch_j9979a, officeconnect_1820_8g_switch_j9979a_firmware
CVE-2017-5787 (published 2018-02-15)
A remote denial of service vulnerability in HPE Version Control Repository Manager (VCRM) in all versions prior to 7.6 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: hp
Affected products: version_control_repository_manager
CVE-2017-5788 (published 2018-02-15)
A Local Disclosure of Sensitive Information vulnerability in HPE NonStop Software Essentials version T0894 T0894H02 through T0894H02^AAI was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: hp
Affected products: nonstop_server, nonstop_server_software
CVE-2017-5789 (published 2017-10-11)
HPE LoadRunner before 12.53 Patch 4 and HPE Performance Center before 12.53 Patch 4 allow remote attackers to execute arbitrary code via unspecified vectors. At least in LoadRunner, this is a libxdrutil.dll mxdr_string heap-based buffer overflow.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: hp
Affected products: loadrunner, performance_center
CVE-2017-5790 (published 2018-02-15)
A remote deserialization of untrusted data vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5791 (published 2017-10-11)
The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: hp
Affected products: intelligent_management_center_plat
CVE-2017-5792 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5793 (published 2018-02-15)
A Remote Arbitrary Code Execution vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5794 (published 2018-02-15)
A Remote Arbitrary File Download vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5795 (published 2018-02-15)
A Local Arbitrary File Download vulnerability in HPE Intelligent Management Center (IMC) version PLAT 7.2 E0403P06 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5796 (published 2018-02-15)
A Remote Cross Site Request Forgery (CSRF) vulnerability in HPE 2620 Series Network Switches version RA.15.05.0006 was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: hp
Affected products: j9623a, j9623a_firmware, j9624a, j9624a_firmware, j9625a, j9625a_firmware, j9626a, j9626a_firmware, j9627a, j9627a_firmware
CVE-2017-5797 (published 2018-02-15)
A Remote Unauthenticated Disclosure of Information vulnerability in HPE Intelligent Management Center (IMC) SOM version v7.3 (E0501) was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5798 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3.x), all versions prior to 4.4.7 RP702 (for OCMP 4.x).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hp
Affected products: opencall_media_platform
CVE-2017-5799 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3.x), all versions prior to 4.4.7 RP702 (for OCMP 4.x).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-74
Affected vendors: hp
Affected products: opencall_media_platform
CVE-2017-5800 (published 2018-02-15)
A Remote Cross-Site Scripting (XSS) vulnerability in HPE Operations Bridge Analytics version v3.0 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hp
Affected products: operations_bridge_analytics
CVE-2017-5801 (published 2018-02-15)
A Remote Unauthorized Access to Data vulnerability in HPE Business Process Monitor version v09.2x, v09.30 was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: hp
Affected products: business_process_monitor
CVE-2017-5802 (published 2018-02-15)
A Remote Gain Privileged Access vulnerability in HPE Vertica Analytics Platform version v4.1 and later was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: opentext
Affected products: vertica
CVE-2017-5803 (published 2018-02-15)
A Remote Disclosure of Information vulnerability in HPE NonStop Servers using SSH Service version L series: T0801L02 through T0801L02^ABX; J and H series: T0801H01 through T0801H01^ACA was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: hp
Affected products: nonstop_server, nonstop_server_software
CVE-2017-5804 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.2 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5805 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.2 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5806 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.2 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5807 (published 2018-02-15)
A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: hp
Affected products: data_protector
CVE-2017-5808 (published 2018-02-15)
A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: data_protector
CVE-2017-5809 (published 2018-02-15)
A Remote Arbitrary Code Execution vulnerability in HPE Data Protector version prior to 8.17 and 9.09 was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-275
Affected vendors: hp
Affected products: data_protector
CVE-2017-5810 (published 2018-02-15)
A remote sql injection vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: hp
Affected products: network_automation
CVE-2017-5811 (published 2018-02-15)
A remote code execution vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: hp
Affected products: network_automation
CVE-2017-5812 (published 2018-02-15)
A remote sql information disclosure vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-89
Affected vendors: hp
Affected products: network_automation
CVE-2017-5813 (published 2018-02-15)
A remote unauthenticated access vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Affected vendors: hp
Affected products: network_automation
CVE-2017-5814 (published 2018-02-15)
A remote sql injection authentication bypass in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: hp
Affected products: network_automation
CVE-2017-5815 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5816 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5817 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5818 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5819 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5820 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5821 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5822 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5823 (published 2018-02-15)
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hp
Affected products: intelligent_management_center
CVE-2017-5824 (published 2018-02-15)
An unauthenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hp
Affected products: aruba_clearpass_policy_manager
CVE-2017-5825 (published 2018-02-15)
A privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hp
Affected products: aruba_clearpass_policy_manager
CVE-2017-5826 (published 2018-02-15)
An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hp
Affected products: aruba_clearpass_policy_manager
CVE-2017-5827 (published 2018-02-15)
A reflected cross site scripting vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hp
Affected products: aruba_clearpass_policy_manager
CVE-2017-5828 (published 2018-02-15)
An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-611
Affected vendors: hp
Affected products: aruba_clearpass_policy_manager