deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2115
Published: 2017-04-28
Description: Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: http://jvn.jp/en/jp/JVN17535578/index.html; http://www.securityfocus.com/bid/97717; https://support.cybozu.com/ja-jp/article/9737
CVE: CVE-2017-2116
Published: 2017-04-28
Description: Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN17535578/index.html; http://www.securityfocus.com/bid/97717; https://support.cybozu.com/ja-jp/article/9736
CVE: CVE-2017-2117
Published: 2017-04-28
Description: Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN63474730/index.html; http://www.securityfocus.com/bid/96466; https://forums.cubecart.com/topic/52188-cubecart-615-released/
CVE: CVE-2017-2118
Published: 2017-04-28
Description: Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN73083905/index.html; http://www.securityfocus.com/bid/96467; https://forum.wbce.org/viewtopic.php?id=977
CVE: CVE-2017-2119
Published: 2017-04-28
Description: Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN73083905/index.html; http://www.securityfocus.com/bid/96467; https://forum.wbce.org/viewtopic.php?id=977
CVE: CVE-2017-2120
Published: 2017-04-28
Description: SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN73083905/index.html; http://www.securityfocus.com/bid/96467; https://forum.wbce.org/viewtopic.php?id=977
CVE: CVE-2017-2123
Published: 2017-04-28
Description: Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via language.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN49408248/index.html; http://www.securityfocus.com/bid/96613; https://onethird.net/en/p1277.html
CVE: CVE-2017-2124
Published: 2017-04-28
Description: Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via contact.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN13003724/index.html; http://www.securityfocus.com/bid/98604; https://onethird.net/en/p1277.html
CVE: CVE-2017-2125
Published: 2017-04-28
Description: Privilege escalation vulnerability in CentreCOM AR260S V2 remote authenticated attackers to gain privileges via the guest account.
CVSS Score: 8.8 (HIGH)
References: http://jvn.jp/en/jp/JVN55121369/index.html; http://www.allied-telesis.co.jp/support/list/faq/vuls/20170330aen.html; http://www.securityfocus.com/bid/97249
CVE: CVE-2017-2127
Published: 2017-04-28
Description: Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN55294532/index.html; http://www.securityfocus.com/bid/97118; http://jvn.jp/en/jp/JVN55294532/index.html
CVE: CVE-2017-2128
Published: 2017-04-28
Description: Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN11448789/index.html; http://www.securityfocus.com/bid/96923; http://jvn.jp/en/jp/JVN11448789/index.html
CVE: CVE-2017-2130
Published: 2017-04-28
Description: Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN93699304/index.html; http://www.securebrain.co.jp/about/news/2017/03/170316.html; http://www.securityfocus.com/bid/97113
CVE: CVE-2017-2134
Published: 2017-04-28
Description: Cross-site scripting vulnerability in ASSETBASE 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN82019695/index.html; http://www.securityfocus.com/bid/97708; http://jvn.jp/en/jp/JVN82019695/index.html
CVE: CVE-2017-2135
Published: 2017-04-28
Description: Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN17633442/index.html; http://www.securityfocus.com/bid/98610; https://wp-statistics.com/change-log/
CVE: CVE-2017-2136
Published: 2017-04-28
Description: Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN62392065/index.html; http://www.securityfocus.com/bid/97289; https://wp-statistics.com/change-log/
CVE: CVE-2017-2137
Published: 2017-04-28
Description: ProSAFE Plus Configuration Utility prior to 2.3.29 allows remote attackers to bypass access restriction and change configurations of the switch via SOAP requests.
CVSS Score: 3.7 (LOW)
References: http://jvn.jp/en/jp/JVN08740778/index.html; https://kb.netgear.com/000038443/Security-Advisory-for-Insecure-SOAP-Access-in-ProSAFE-Plus-Configuration-Utility-PSV-2017-1997; http://jvn.jp/en/jp/JVN08740778/index.html
CVE: CVE-2017-2139
Published: 2017-04-28
Description: CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to bypass access restriction to obtain customer information via orders.pre.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: http://jvn.jp/en/jp/JVN14396697/index.html; http://tips.cs-cart.jp/fix-jvn-14396697.html; http://jvn.jp/en/jp/JVN14396697/index.html
CVE: CVE-2017-2140
Published: 2017-04-28
Description: Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://jvn.jp/en/jp/JVN64451600/index.html; http://tablacus.hatenablog.com/entry/2017/04/05/200424; http://jvn.jp/en/jp/JVN64451600/index.html
CVE: CVE-2017-2141
Published: 2017-04-28
Description: WN-G300R3 firmware 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN81024552/index.html; http://www.iodata.jp/support/information/2017/wn-g300r3/; http://jvn.jp/en/jp/JVN81024552/index.html
CVE: CVE-2017-2142
Published: 2017-04-28
Description: Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN81024552/index.html; http://www.iodata.jp/support/information/2017/wn-g300r3/; http://jvn.jp/en/jp/JVN81024552/index.html
CVE: CVE-2017-2143
Published: 2017-04-28
Description: CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: http://jvn.jp/en/jp/JVN25598952/index.html; http://tips.cs-cart.jp/fix-jvn-25598952.html; http://jvn.jp/en/jp/JVN25598952/index.html
CVE: CVE-2017-2147
Published: 2017-04-28
Description: Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN77253951/index.html; http://www.securityfocus.com/bid/97711; https://wp-statistics.com/change-log/
CVE: CVE-2017-2148
Published: 2017-04-28
Description: Cross-site scripting vulnerability in WN-AC1167GR firmware version 1.04 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN01537659/index.html; http://www.iodata.jp/support/information/2017/wn-ac1167gr/; http://www.securityfocus.com/bid/97714
CVE: CVE-2017-2149
Published: 2017-04-28
Description: Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool V1.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software V3.0.2 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WE series<W-03>) V3.00.01, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WD/WC series<W-02>) V2.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WB/WL series) V1.00.04 and earlier, SDHC Memory Card with embedded TransferJet functionality Configuration Software V1.02 and earlier, SDHC Memory Card with embedded TransferJet functionality Software Update tool V1.00.06 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN05340816/index.html; http://www.securityfocus.com/bid/97697; http://www.toshiba-personalstorage.net/news/20170414.htm
CVE: CVE-2017-2150
Published: 2017-04-28
Description: Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN18739672/index.html; http://wpbookingcalendar.com/changelog/; http://jvn.jp/en/jp/JVN18739672/index.html
CVE: CVE-2017-2151
Published: 2017-04-28
Description: Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN54762089/index.html; http://wpbookingcalendar.com/changelog/; http://jvn.jp/en/jp/JVN54762089/index.html
CVE: CVE-2017-2152
Published: 2017-04-28
Description: WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN48790793/index.html; https://jvn.jp/en/jp/JVN48790793/index.html
CVE: CVE-2017-2153
Published: 2017-04-28
Description: SEIL/x86 Fuji 1.70 to 5.62, SEIL/BPV4 5.00 to 5.62, SEIL/X1 1.30 to 5.62, SEIL/X2 1.30 to 5.62, SEIL/B1 1.00 to 5.62 allows remote attackers to cause a denial of service via specially crafted IPv4 UDP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN86171513/index.html; http://www.seil.jp/support/security/a01783.html; http://jvn.jp/en/jp/JVN86171513/index.html
CVE: CVE-2017-2154
Published: 2017-04-28
Description: Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium, Hanako Police 5, JUST Police 3, Hanako 2017 trial version allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN54268888/index.html; https://www.justsystems.com/jp/info/js17002.html; https://jvn.jp/en/jp/JVN54268888/index.html
CVE: CVE-2017-2155
Published: 2017-04-28
Description: Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN93931029/index.html; http://www.icon-co.jp/news/20170420/index.html; http://jvn.jp/en/jp/JVN93931029/index.html
CVE: CVE-2017-2156
Published: 2017-04-28
Description: Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/98040; https://jvn.jp/en/jp/JVN71572107/index.html; https://vivaldi.com/security/vulnerability-disclosure-vivaldi-installer-for-windows-could-run-arbitrary-downloaded-code-jvn71572107/
CVE: CVE-2017-1141
Published: 2017-04-28
Description: IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121907.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22002620; http://www.securityfocus.com/bid/98161; http://www.ibm.com/support/docview.wss?uid=swg22002620
CVE: CVE-2017-1194
Published: 2017-04-28
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 123669.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg22001226; http://www.securityfocus.com/bid/98142; http://www.securitytracker.com/id/1038378
CVE: CVE-2017-1298
Published: 2017-04-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-8106.  Reason: This candidate is a reservation duplicate of CVE-2016-8106.  Notes: All CVE users should reference CVE-2016-8106 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-8584
Published: 2017-04-28
Description: Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/142227/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-Session-Generation-Authentication-Bypass.html; http://www.securityfocus.com/bid/98333; http://packetstormsecurity.com/files/142227/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-Session-Generation-Authentication-Bypass.html
CVE: CVE-2016-8585
Published: 2017-04-28
Description: admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/142223/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-admin_sys_time.cgi-Remote-Code-Execution.html; http://packetstormsecurity.com/files/142224/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-admin_sys_time.cgi-Remote-Code-Execution.html; http://www.securityfocus.com/bid/98342
CVE: CVE-2016-8586
Published: 2017-04-28
Description: detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/142222/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-detected_potential_files.cgi-Remote-Code-Execution.html; http://www.securityfocus.com/bid/98376; http://packetstormsecurity.com/files/142222/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-detected_potential_files.cgi-Remote-Code-Execution.html
CVE: CVE-2016-8587
Published: 2017-04-28
Description: dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/142221/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-dlp_policy_upload.cgi-Remote-Code-Execution.html; http://www.securityfocus.com/bid/98508; http://packetstormsecurity.com/files/142221/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-dlp_policy_upload.cgi-Remote-Code-Execution.html
CVE: CVE-2016-8588
Published: 2017-04-28
Description: The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/142220/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-hotfix_upload.cgi-Remote-Code-Execution.html; http://packetstormsecurity.com/files/142220/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-hotfix_upload.cgi-Remote-Code-Execution.html
CVE: CVE-2016-8589
Published: 2017-04-28
Description: log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/142219/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_dae.cgi-Remote-Code-Execution.html; http://packetstormsecurity.com/files/142219/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_dae.cgi-Remote-Code-Execution.html
CVE: CVE-2016-8590
Published: 2017-04-28
Description: log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/142218/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_dlp.cgi-Remote-Code-Execution.html; http://packetstormsecurity.com/files/142218/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_dlp.cgi-Remote-Code-Execution.html
CVE: CVE-2016-8591
Published: 2017-04-28
Description: log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/142217/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query.cgi-Remote-Code-Execution.html; http://www.securityfocus.com/bid/98343; http://packetstormsecurity.com/files/142217/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query.cgi-Remote-Code-Execution.html
CVE: CVE-2016-8592
Published: 2017-04-28
Description: log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/142216/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_system.cgi-Remote-Code-Execution.html; http://www.securityfocus.com/bid/98345; http://packetstormsecurity.com/files/142216/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_system.cgi-Remote-Code-Execution.html
CVE: CVE-2016-8593
Published: 2017-04-28
Description: Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/142215/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-upload.cgi-Remote-Code-Execution.html; http://packetstormsecurity.com/files/142215/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-upload.cgi-Remote-Code-Execution.html
CVE: CVE-2017-6250
Published: 2017-04-28
Description: NVIDIA GeForce Experience contains a vulnerability in NVIDIA Web Helper.exe, where untrusted script execution may lead to violation of application execution policy and local code execution.
CVSS Score: 8.8 (HIGH)
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4459; http://www.securityfocus.com/bid/98393; http://nvidia.custhelp.com/app/answers/detail/a_id/4459
CVE: CVE-2017-7644
Published: 2017-04-29
Description: The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain sensitive information by leveraging incorrect permission validation, aka PAN-SA-2017-0013 and PAN-70541.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://security.paloaltonetworks.com/CVE-2017-7644; https://security.paloaltonetworks.com/CVE-2017-7644
CVE: CVE-2017-7945
Published: 2017-04-29
Description: The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests, aka PAN-SA-2017-0014 and PAN-72769.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-209
References: https://security.paloaltonetworks.com/CVE-2017-7945; https://security.paloaltonetworks.com/CVE-2017-7945
CVE: CVE-2017-6553
Published: 2017-04-29
Description: Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://0xdeadface.wordpress.com/2017/04/07/multiple-vulnerabilities-in-quest-privilege-manager-6-0-0-xx-cve-2017-6553-cve-2017-6554/; https://support.oneidentity.com/privilege-manager-for-unix/kb/SOL133824; https://www.exploit-db.com/exploits/42010/
CVE: CVE-2017-7981
Published: 2017-04-29
Description: Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument, and an authenticated Tuleap user can control this value, even with shell metacharacters, as demonstrated by a '<?plugin SyntaxHighlighter syntax="c;id"' line to execute the id command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/xdrr/vulnerability-research/blob/master/webapp/tuleap/2017.04.tuleap-auth-ci.md; https://tuleap.net/file/shownotes.php?release_id=137#/linked-artifacts; https://tuleap.net/plugins/tracker/?aid=10159