deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6561
Published: 2017-03-09
Description: XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=[XSS] attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96940; https://packetstormsecurity.com/files/141507/Agora-Project-3.2.2-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/96940
CVE: CVE-2017-6562
Published: 2017-03-09
Description: XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild=[XSS] attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96940; https://packetstormsecurity.com/files/141507/Agora-Project-3.2.2-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/96940
CVE: CVE-2017-6570
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign-list.php with the GET Parameter: id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6571
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign.php with the GET Parameter: id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6572
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/add_member.php with the GET Parameter: filter_list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6573
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit-list.php with the GET Parameter: id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6574
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: filter_list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6575
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/edit_member.php with the GET Parameter: member_id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6576
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/campaign-delete.php with the GET Parameter: id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6577
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: list_id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6578
Published: 2017-03-09
Description: A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: subscriber_email.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96783; https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; http://www.securityfocus.com/bid/96783
CVE: CVE-2017-6432
Published: 2017-03-09
Description: An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of fully privileged new users, in addition to capture of sensitive information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: https://nullku7.github.io/stuff/exploit/dahua/2017/03/09/dahua-nvr-authbypass.html; https://twitter.com/null_ku7/status/[PII_REDACTED]51240193; https://nullku7.github.io/stuff/exploit/dahua/2017/03/09/dahua-nvr-authbypass.html
CVE: CVE-2017-6526
Published: 2017-03-09
Description: An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/96823; https://www.exploit-db.com/exploits/41578/; https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/
CVE: CVE-2017-6527
Published: 2017-03-09
Description: An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/96823; https://www.exploit-db.com/exploits/41578/; https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/
CVE: CVE-2017-6528
Published: 2017-03-09
Description: An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file).
CVSS Score: 8.1 (HIGH)
CWE: CWE-522
References: http://www.securityfocus.com/bid/96823; https://www.exploit-db.com/exploits/41578/; https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/
CVE: CVE-2017-6529
Published: 2017-03-09
Description: An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: http://www.securityfocus.com/bid/96823; https://www.exploit-db.com/exploits/41578/; https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/
CVE: CVE-2017-6589
Published: 2017-03-09
Description: EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bad.code.blog/2017/03/09/epiceditor-cross-site-scripting/; https://bad.code.blog/2017/03/09/epiceditor-cross-site-scripting/
CVE: CVE-2017-6590
Published: 2017-03-09
Description: An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue at the default Ubuntu login screen to access local files and execute arbitrary commands as the lightdm user. The exploitation requires physical access to the locked computer and the Wi-Fi must be turned on. An access point that lets you use a certificate to login is required as well, but it's easy to create one. Then, it's possible to open a nautilus window and browse directories. One also can open some applications such as Firefox, which is useful for downloading malicious binaries.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: http://www.securitytracker.com/id/1037977; https://bugs.launchpad.net/ubuntu/+source/network-manager-applet/+bug/1668321; https://security.gentoo.org/glsa/201707-09
CVE: CVE-2017-6591
Published: 2017-03-09
Description: There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://morningchen.com/2017/03/09/Cross-site-scripting-vulnerability-in-django-epiceditor/; http://www.securityfocus.com/bid/96946; http://morningchen.com/2017/03/09/Cross-site-scripting-vulnerability-in-django-epiceditor/
CVE: CVE-2017-6797
Published: 2017-03-10
Description: A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.mantisbt.org/bugs/view.php?id=22486; http://www.openwall.com/lists/oss-security/2017/03/10/1; http://www.securityfocus.com/bid/96818
CVE: CVE-2017-4960
Published: 2017-03-10
Description: An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/96780; https://www.cloudfoundry.org/cve-2017-4960/; http://www.securityfocus.com/bid/96780
CVE: CVE-2017-6465
Published: 2017-03-10
Description: Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP server it is connecting to; however, it doesn't check the response's length, leading to a buffer overflow situation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/141456/FTPShell-Client-6.53-Buffer-Overflow.html; http://www.securityfocus.com/bid/96570; https://www.exploit-db.com/exploits/41511/
CVE: CVE-2015-2330
Published: 2017-03-10
Description: Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2015/03/17/11; http://www.openwall.com/lists/oss-security/2015/03/18/4; https://bugs.webkit.org/show_bug.cgi?id=142244
CVE: CVE-2017-5872
Published: 2017-03-10
Description: The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1.2 service, allows remote attackers to cause a denial of service (network connectivity disruption) via a client hello with a signature_algorithms extension above those defined in RFC 5246, which triggers a full memory dump.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96782; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=42; http://www.securityfocus.com/bid/96782
CVE: CVE-2017-6311
Published: 2017-03-10
Description: gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html; http://www.openwall.com/lists/oss-security/2017/02/21/4; http://www.openwall.com/lists/oss-security/2017/02/26/1
CVE: CVE-2017-6312
Published: 2017-03-10
Description: Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out-of-bounds read, related to compiler optimizations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html; http://www.openwall.com/lists/oss-security/2017/02/21/4; http://www.openwall.com/lists/oss-security/2017/02/26/1
CVE: CVE-2017-6313
Published: 2017-03-10
Description: Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-191
References: http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html; http://www.openwall.com/lists/oss-security/2017/02/21/4; http://www.openwall.com/lists/oss-security/2017/02/26/1
CVE: CVE-2017-6314
Published: 2017-03-10
Description: The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html; http://www.openwall.com/lists/oss-security/2017/02/21/4; http://www.openwall.com/lists/oss-security/2017/02/26/1
CVE: CVE-2017-6355
Published: 2017-03-10
Description: Integer overflow in the vrend_create_shader function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (process crash) via crafted pkt_length and offlen values, which trigger an out-of-bounds access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2017/02/27/3; http://www.securityfocus.com/bid/96460; https://cgit.freedesktop.org/virglrenderer/commit/?id=93761787b29f37fa627dea9082cdfc1a1ec608d6
CVE: CVE-2016-8714
Published: 2017-03-10
Description: An exploitable buffer overflow vulnerability exists in the LoadEncoding functionality of the R programming language version 3.3.0. A specially crafted R script can cause a buffer overflow resulting in a memory corruption. An attacker can send a malicious R script to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://www.debian.org/security/2017/dsa-3813; http://www.securityfocus.com/bid/96785; http://www.talosintelligence.com/reports/TALOS-2016-0227/
CVE: CVE-2017-2785
Published: 2017-03-10
Description: An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in remote code execution. This client is always listening, has root privileges, and requires no user interaction to exploit.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96742; http://www.talosintelligence.com/reports/TALOS-2017-0280/; http://www.securityfocus.com/bid/96742
CVE: CVE-2017-2786
Published: 2017-03-10
Description: A denial of service vulnerability exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to an out of bounds read causing a crash and a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96736; http://www.talosintelligence.com/reports/TALOS-2017-0281/; http://www.securityfocus.com/bid/96736
CVE: CVE-2017-2787
Published: 2017-03-10
Description: A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in potential remote code execution. This client is always listening, has root privileges, and requires no user interaction to exploit.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96738; http://www.talosintelligence.com/reports/TALOS-2017-0282/; http://www.securityfocus.com/bid/96738
CVE: CVE-2017-2788
Published: 2017-03-10
Description: A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in potential remote code execution. This client is always listening, has root privileges, and requires no user interaction to exploit.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96742; http://www.talosintelligence.com/reports/TALOS-2017-0283/; http://www.securityfocus.com/bid/96742
CVE: CVE-2017-5859
Published: 2017-03-10
Description: On Cambium Networks cnPilot R200/201 devices before 4.3, there is a vulnerability involving the certificate of the device and its RSA keys, aka RBN-183.
CVSS Score: 9.8 (CRITICAL)
References: https://support.cambiumnetworks.com/file/3f88842a39f37b0d4ce5d43e5aa21bf1c4f9f1ca; https://support.cambiumnetworks.com/file/3f88842a39f37b0d4ce5d43e5aa21bf1c4f9f1ca
CVE: CVE-2017-6427
Published: 2017-03-10
Description: A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will cause a crash. An example attack methodology may include a long message-body in a GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96820; https://www.exploit-db.com/exploits/41547/; http://www.securityfocus.com/bid/96820
CVE: CVE-2017-6506
Published: 2017-03-10
Description: In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leading to remote code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka "Service ready") string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/141502/Azure-Data-Expert-Ultimate-2.2.16-Buffer-Overflow.html; http://www.securityfocus.com/bid/96824; https://www.exploit-db.com/exploits/41545/
CVE: CVE-2017-6596
Published: 2017-03-10
Description: partclone.chkimg in partclone 0.2.89 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to launch a 'Denial of Service attack' in the context of the user running the affected application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/insidej/Partclone_HeapOverFlow/blob/master/README.md; https://github.com/insidej/Partclone_HeapOverFlow/blob/master/README.md
CVE: CVE-2017-6798
Published: 2017-03-10
Description: Trend Micro Endpoint Sensor 1.6 before b1290 has a DLL hijacking vulnerability that allows remote attackers to execute arbitrary code, aka Trend Micro Vulnerability Identifier 2015-0208.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/96857; https://success.trendmicro.com/solution/1116827; http://www.securityfocus.com/bid/96857
CVE: CVE-2017-6799
Published: 2017-03-10
Description: A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://mantisbt.org/bugs/view.php?id=22497; http://www.openwall.com/lists/oss-security/2017/03/10/1; http://www.securityfocus.com/bid/96819
CVE: CVE-2017-6800
Published: 2017-03-10
Description: An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3846; https://github.com/Yeraze/ytnef/commit/f98f5d4adc1c4bd4033638f6167c1bb95d642f89; https://github.com/Yeraze/ytnef/issues/28
CVE: CVE-2017-6801
Published: 2017-03-10
Description: An issue was discovered in ytnef before 1.9.2. There is a potential out-of-bounds access with fields of Size 0 in TNEFParse() in libytnef.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3846; https://github.com/Yeraze/ytnef/commit/3cb0f914d6427073f262e1b2b5fd973e3043cdf7; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ/
CVE: CVE-2017-6802
Published: 2017-03-10
Description: An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams, related to DecompressRTF() in libytnef.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3846; https://github.com/Yeraze/ytnef/commit/22f8346c8d4f0020a40d9f258fdb3bfc097359cc; https://github.com/Yeraze/ytnef/issues/34
CVE: CVE-2017-6804
Published: 2017-03-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-5638
Published: 2017-03-11
Description: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755, CWE-755
References: http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html; http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
CVE: CVE-2010-4314
Published: 2017-03-11
Description: Remote attackers can use the iPrint web-browser ActiveX plugin in Novell iPrint Client before 5.42 for Windows XP/Vista/Win7 to execute code by overflowing the "name" parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.novell.com/support/kb/doc.php?id=7006675; https://www.novell.com/support/kb/doc.php?id=7006675
CVE: CVE-2017-6466
Published: 2017-03-11
Description: F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download. Man-in-the-middle attackers can replace the file with their own executable which will be executed under the SYSTEM account. Note that when Software Updater is configured to install updates automatically, it checks if the downloaded file is digitally signed by default, but does not check the author of the signature. When running in manual mode (default), no signature check is performed.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2017/Mar/28; http://www.securityfocus.com/bid/96784; http://seclists.org/fulldisclosure/2017/Mar/28
CVE: CVE-2017-6513
Published: 2017-03-11
Description: The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual machines managed by Virtualizor by accessing a modified URL.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-275
References: http://www.virtualizor.com/blog/?p=1551; https://gist.github.com/sedrubal/a83fa22f1091025a5c1a14aabd711ad7; http://www.virtualizor.com/blog/?p=1551
CVE: CVE-2017-6808
Published: 2017-03-11
Description: paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.faq.php (id parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96939; https://github.com/paintballrefjosh/MaNGOSWebV4/issues/18; http://www.securityfocus.com/bid/96939
CVE: CVE-2017-6809
Published: 2017-03-11
Description: paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.donate.php (id parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96939; https://github.com/paintballrefjosh/MaNGOSWebV4/issues/21; http://www.securityfocus.com/bid/96939