deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. By creating a large loop whiling pushing data to a buffer, we can break out of the bounds checking of that buffer. When list.join is called on the data it will read past a buffer resulting in a Heap-Buffer-Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/marcobambini/gravity/issues/172; https://github.com/marcobambini/gravity/issues/172
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101889; https://github.com/mde/ejs/commit/49264e0037e313a0a3e033450b5c184112516d8f; http://www.securityfocus.com/bid/101889
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101893; https://github.com/mde/ejs/commit/49264e0037e313a0a3e033450b5c184112516d8f; http://www.securityfocus.com/bid/101893
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101897; https://snyk.io/vuln/npm:ejs:20161128; http://www.securityfocus.com/bid/101897
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170523-0_InvoicePlane_Upload_arbitrary_files_stored_XSS_v10.txt; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170523-0_InvoicePlane_Upload_arbitrary_files_stored_XSS_v10.txt
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170523-0_InvoicePlane_Upload_arbitrary_files_stored_XSS_v10.txt; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170523-0_InvoicePlane_Upload_arbitrary_files_stored_XSS_v10.txt
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-001; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-001
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. This vulnerability can allow an authenticated non-administrator users to view and modify information only accessible to administrators.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-004; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-004
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00000.html; https://lists.debian.org/debian-lts-announce/2017/11/msg00028.html; https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1256
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00000.html; https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1257; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00000.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: I, Librarian version <=4.6 & 4.7 is vulnerable to Directory Enumeration in the jqueryFileTree.php resulting in attacker enumerating directories simply by navigating through the "dir" parameter
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: I, Librarian version <=4.6 & 4.7 is vulnerable to OS Command Injection in batchimport.php resulting the web server being fully compromised.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: I, Librarian version <=4.6 & 4.7 is vulnerable to Reflected Cross-Site Scripting in the temp.php resulting in an attacker being able to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: I, Librarian version <=4.6 & 4.7 is vulnerable to Server-Side Request Forgery in the ajaxsupplement.php resulting in the attacker being able to reset any user's password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txt
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330
References: https://github.com/rohe/pysaml2/issues/417; https://github.com/rohe/pysaml2/issues/417
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.codeigniter.com/userguide3/changelog.html#version-3-1-4; https://www.codeigniter.com/userguide3/changelog.html#version-3-1-4
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e; https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Codiad(full version) is vulnerable to write anything to configure file in the installation resulting upload a webshell.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: http://www.jianshu.com/p/b09d20af2374; http://www.jianshu.com/p/b09d20af2374
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://blog.s9y.org/archives/269-Serendipity-2.0.4-and-2.1-beta2-released.html; https://blog.s9y.org/archives/269-Serendipity-2.0.4-and-2.1-beta2-released.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.securitytracker.com/id/1039890; https://bugs.python.org/issue30657; https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.expressionengine.com/latest/about/changelog.html#version-3-4-3; https://docs.expressionengine.com/latest/about/changelog.html#version-3-4-3
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forge.tine20.org/view.php?id=13228; https://forge.tine20.org/view.php?id=13228
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://raw.githubusercontent.com/modxcms/revolution/v2.5.7-pl/core/docs/changelog.txt; https://raw.githubusercontent.com/modxcms/revolution/v2.5.7-pl/core/docs/changelog.txt
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anything an admin can
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.dxw.com/advisories/reflected-xss-in-relevanssi-premium-when-using-relevanssi_didyoumean-could-allow-unauthenticated-attacker-to-do-almost-anything-an-admin-can/; https://security.dxw.com/advisories/reflected-xss-in-relevanssi-premium-when-using-relevanssi_didyoumean-could-allow-unauthenticated-attacker-to-do-almost-anything-an-admin-can/
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Stop User Enumeration 1.3.8 allows user enumeration via the REST API
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://security.dxw.com/advisories/stop-user-enumeration-rest-api/; https://security.dxw.com/advisories/stop-user-enumeration-rest-api/
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://lists.debian.org/debian-lts-announce/2017/11/msg00030.html; https://security.gentoo.org/glsa/201801-02; https://sourceforge.net/p/optipng/bugs/65/
CVE: CVE-2017-16868
Published: 2017-11-17
Description: In SWFTools 0.9.2, the wav_convert2mono function in lib/wav.c does not properly restrict a multiplication within a malloc call, which allows remote attackers to cause a denial of service (integer overflow and NULL pointer dereference) via a crafted WAV file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/matthiaskramm/swftools/issues/52; https://github.com/matthiaskramm/swftools/issues/52
CVE: CVE-2017-16869
Published: 2017-11-17
Description: p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/upx/upx/issues/146; https://github.com/upx/upx/issues/146
CVE: CVE-2017-16870
Published: 2017-11-17
Description: The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://github.com/LoRexxar/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity#authenticated-ssrf; https://github.com/LoRexxar/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity#authenticated-ssrf
CVE: CVE-2017-16871
Published: 2017-11-17
Description: The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://github.com/LoRexxar/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity#authenticated--upload-file-and-php-code-execution; https://github.com/LoRexxar/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity#authenticated--upload-file-and-php-code-execution
CVE: CVE-2017-16872
Published: 2017-11-17
Description: An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://trac.pjsip.org/repos/milestone/release-2.7.1; https://trac.pjsip.org/repos/ticket/2056; https://www.debian.org/security/2018/dsa-4170
CVE: CVE-2017-10886
Published: 2017-11-17
Description: Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://tips.cs-cart.jp/fix-jvn-29602086.html; https://jvn.jp/en/jp/JVN29602086/index.html; http://tips.cs-cart.jp/fix-jvn-29602086.html
CVE: CVE-2017-10887
Published: 2017-11-17
Description: Untrusted search path vulnerability in BOOK WALKER for Windows Ver.1.2.9 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://bookwalker.jp/info/message20171113_pc_app/; https://jvn.jp/en/jp/JVN18420340/index.html; https://bookwalker.jp/info/message20171113_pc_app/
CVE: CVE-2017-10888
Published: 2017-11-17
Description: BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://bookwalker.jp/info/message20171113_pc_app/; https://jvn.jp/en/jp/JVN18420340/index.html; https://bookwalker.jp/info/message20171113_pc_app/
CVE: CVE-2017-10889
Published: 2017-11-17
Description: TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-611
References: https://jvn.jp/en/jp/JVN05398317/index.html; https://wordpress.org/plugins/tablepress/#developers; https://jvn.jp/en/jp/JVN05398317/index.html
CVE: CVE-2017-10890
Published: 2017-11-17
Description: Session management issue in RX-V200 firmware versions prior to 09.87.17.09, RX-V100 firmware versions prior to 03.29.17.09, RX-CLV1-P firmware versions prior to 79.17.17.09, RX-CLV2-B firmware versions prior to 89.07.17.09, RX-CLV3-N firmware versions prior to 91.09.17.10 allows an attacker on the same LAN to perform arbitrary operations or access information via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-384
References: https://jvn.jp/en/jp/JVN76382932/index.html; https://jvn.jp/en/jp/JVN76382932/index.html
CVE: CVE-2017-4927
Published: 2017-11-17
Description: VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-90
References: http://www.securityfocus.com/bid/101786; http://www.securitytracker.com/id/1039759; https://www.vmware.com/security/advisories/VMSA-2017-0017.html
CVE: CVE-2017-4928
Published: 2017-11-17
Description: The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352, CWE-918
References: http://www.securityfocus.com/bid/101785; http://www.securitytracker.com/id/1039759; https://www.vmware.com/security/advisories/VMSA-2017-0017.html
CVE: CVE-2017-4929
Published: 2017-11-17
Description: VMware NSX Edge (6.2.x before 6.2.9 and 6.3.x before 6.3.5) contains a moderate Cross-Site Scripting (XSS) issue which may lead to information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101891; http://www.securitytracker.com/id/1039837; https://www.vmware.com/security/advisories/VMSA-2017-0019.html
CVE: CVE-2017-4934
Published: 2017-11-17
Description: VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a heap buffer-overflow vulnerability in VMNAT device. This issue may allow a guest to execute code on the host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101903; http://www.securitytracker.com/id/1039835; https://www.vmware.com/security/advisories/VMSA-2017-0018.html
CVE: CVE-2017-4935
Published: 2017-11-17
Description: VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds write vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View Client.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/101902; http://www.securitytracker.com/id/1039835; http://www.securitytracker.com/id/1039836
CVE: CVE-2017-4936
Published: 2017-11-17
Description: VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/101892; http://www.securitytracker.com/id/1039835; http://www.securitytracker.com/id/1039836
CVE: CVE-2017-4937
Published: 2017-11-17
Description: VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View Client.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/101892; http://www.securitytracker.com/id/1039835; http://www.securitytracker.com/id/1039836
CVE: CVE-2017-4938
Published: 2017-11-17
Description: VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a guest RPC NULL pointer dereference vulnerability. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/101887; http://www.securitytracker.com/id/1039835; https://www.vmware.com/security/advisories/VMSA-2017-0018.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145#diff-6cd6f6c31bac70116b7ca7abdc8e517e; https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145#diff-6cd6f6c31bac70116b7ca7abdc8e517e
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in potential arbitrary code execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/samtools/htslib/blob/1.4.1/NEWS; https://github.com/samtools/htslib/blob/1.4.1/NEWS
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416
References: http://lynx.invisible-island.net/current/CHANGES.html; http://www.securityfocus.com/bid/102180; https://github.com/ThomasDickey/lynx-snapshots/commit/280a61b300a1614f6037efc0902ff7ecf17146e9
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-17
Description: Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/tonini/alchemist-server/issues/14; https://github.com/tonini/alchemist-server/issues/14
CVE: CVE-2017-16875
Published: 2017-11-17
Description: An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations.
CVSS Score: 7.5 (HIGH)
References: https://trac.pjsip.org/repos/milestone/release-2.7.1; https://trac.pjsip.org/repos/ticket/2055; https://www.debian.org/security/2018/dsa-4170