deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-7540
Published: 2017-04-20
Description: coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an image to rgf format.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-19
References: http://www.openwall.com/lists/oss-security/2016/09/22/2; http://www.securityfocus.com/bid/93228; https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1594060
CVE: CVE-2016-8721
Published: 2017-04-20
Description: An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware 1.1. Specially crafted web form input can cause an OS Command Injection resulting in complete compromise of the vulnerable device. An attacker can exploit this vulnerability remotely.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: http://www.talosintelligence.com/reports/TALOS-2016-0235/; http://www.talosintelligence.com/reports/TALOS-2016-0235/
CVE: CVE-2017-2784
Published: 2017-04-20
Description: An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://www.talosintelligence.com/reports/TALOS-2017-0274/; https://security.gentoo.org/glsa/201706-18; https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01
CVE: CVE-2017-2806
Published: 2017-04-20
Description: An exploitable arbitrary read exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted XLS document can lead to a arbitrary read resulting in memory disclosure. The vulnerability was confirmed on versions 11.3.0.2228 and 11.3.0.2400
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: http://www.talosintelligence.com/reports/TALOS-2017-0302/; http://www.talosintelligence.com/reports/TALOS-2017-0302/
CVE: CVE-2017-5183
Published: 2017-04-20
Description: NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.novell.com/support/kb/doc.php?id=7018509; https://www.novell.com/support/kb/doc.php?id=7018509
CVE: CVE-2017-5156
Published: 2017-04-20
Description: A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/; http://www.securityfocus.com/bid/97256; https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01
CVE: CVE-2017-5158
Published: 2017-04-20
Description: An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/; http://www.securityfocus.com/bid/97256; https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01
CVE: CVE-2017-5160
Published: 2017-04-20
Description: An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The software will connect via Transport Layer Security without verifying the peer's SSL certificate properly.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/; http://www.securityfocus.com/bid/97256; https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01
CVE: CVE-2015-8285
Published: 2017-04-20
Description: The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97996; https://www.exploit-db.com/exploits/39475/; http://www.securityfocus.com/bid/97996
CVE: CVE-2016-1161
Published: 2017-04-20
Description: Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500).
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/vu/JVNVU95113461/; http://www.securityfocus.com/bid/91531; https://www.excellium-services.com/cert-xlm-advisory/cve-2016-1161/
CVE: CVE-2016-3729
Published: 2017-04-20
Description: The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/05/17/4; http://www.securitytracker.com/id/1035902; https://bugzilla.redhat.com/show_bug.cgi?id=1335933
CVE: CVE-2016-3731
Published: 2017-04-20
Description: Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/05/17/4; http://www.securitytracker.com/id/1035902; https://bugzilla.redhat.com/show_bug.cgi?id=1335933
CVE: CVE-2016-3732
Published: 2017-04-20
Description: The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/05/17/4; http://www.securitytracker.com/id/1035902; https://bugzilla.redhat.com/show_bug.cgi?id=1335933
CVE: CVE-2016-3733
Published: 2017-04-20
Description: The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51369; http://www.openwall.com/lists/oss-security/2016/05/17/4; http://www.securitytracker.com/id/1035902
CVE: CVE-2016-3734
Published: 2017-04-20
Description: Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53755; http://www.openwall.com/lists/oss-security/2016/05/17/4; http://www.securityfocus.com/bid/91281
CVE: CVE-2016-5401
Published: 2017-04-20
Description: Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=1357731; https://bugzilla.redhat.com/show_bug.cgi?id=1357731
CVE: CVE-2016-8923
Published: 2017-04-20
Description: IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive information from the profile of a higher privileged user that they should not have access to. IBM X-Force ID: 118536.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22001774; http://www.securityfocus.com/bid/97989; http://www.ibm.com/support/docview.wss?uid=swg22001774
CVE: CVE-2016-9978
Published: 2017-04-20
Description: IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. IBM X-Force ID: 120254.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22001782; http://www.securityfocus.com/bid/97990; http://www.ibm.com/support/docview.wss?uid=swg22001782
CVE: CVE-2016-9979
Published: 2017-04-20
Description: IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120255.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001780; http://www.securityfocus.com/bid/97993; http://www.ibm.com/support/docview.wss?uid=swg22001780
CVE: CVE-2016-9980
Published: 2017-04-20
Description: IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120256.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001779; http://www.securityfocus.com/bid/98005; http://www.ibm.com/support/docview.wss?uid=swg22001779
CVE: CVE-2017-1122
Published: 2017-04-20
Description: IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary commands which would be executed as root. IBM X-Force ID: 121174.
CVSS Score: 7.4 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg21997868; http://www.securityfocus.com/bid/97995; http://www.securitytracker.com/id/1038347
CVE: CVE-2016-6368
Published: 2017-04-20
Description: A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper input validation of the fields in the PGM protocol packet. An attacker could exploit this vulnerability by sending a crafted PGM packet to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped. This vulnerability affects Cisco Firepower System Software that has one or more file action policies configured and is running on any of the following Cisco products: Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services; Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls; Advanced Malware Protection (AMP) for Networks, 7000 Series Appliances; Advanced Malware Protection (AMP) for Networks, 8000 Series Appliances; Firepower 4100 Series Security Appliances; FirePOWER 7000 Series Appliances; FirePOWER 8000 Series Appliances; Firepower 9300 Series Security Appliances; FirePOWER Threat Defense for Integrated Services Routers (ISRs); Industrial Security Appliance 3000; Sourcefire 3D System Appliances; Virtual Next-Generation Intrusion Prevention System (NGIPSv) for VMware. Fixed versions: 5.4.0.10 5.4.1.9 6.0.1.3 6.1.0 6.2.0. Cisco Bug IDs: CSCuz00876.
CVSS Score: 8.6 (HIGH)
CWE: CWE-399, CWE-399
References: http://www.securityfocus.com/bid/97932; http://www.securityfocus.com/bid/98292; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-fpsnort
CVE: CVE-2017-3793
Published: 2017-04-20
Description: A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause Cisco ASA and FTD to drop any further incoming traffic on all interfaces, resulting in a denial of service (DoS) condition. The vulnerability is due to improper limitation of the global out-of-order TCP queue for specific block sizes. An attacker could exploit this vulnerability by sending a large number of unique permitted TCP connections with out-of-order segments. An exploit could allow the attacker to exhaust available blocks in the global out-of-order TCP queue, causing the dropping of any further incoming traffic on all interfaces and resulting in a DoS condition. Cisco Bug IDs: CSCvb46321.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399, CWE-400
References: http://www.securityfocus.com/bid/97923; http://www.securitytracker.com/id/1038329; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-norm
CVE: CVE-2017-3808
Published: 2017-04-20
Description: A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient rate limiting protection. An attacker could exploit this vulnerability by sending the affected device a high rate of SIP messages. An exploit could allow the attacker to cause the device to reload unexpectedly. The device and services will restart automatically. This vulnerability affects Cisco Unified Communications Manager (CallManager) releases prior to the first fixed release; the following list indicates the first minor release that includes the fix for this vulnerability: 10.5.2.14900-16 11.0.1.23900-5 11.5.1.12900-2. Cisco Bug IDs: CSCuz72455.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/97922; http://www.securitytracker.com/id/1038318; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-ucm
CVE: CVE-2017-3860
Published: 2017-04-20
Description: Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted EnergyWise packets to be processed by an affected device. An exploit could allow the attacker to cause a buffer overflow condition or a reload of the affected device, leading to a DoS condition. Cisco IOS Software and Cisco IOS XE Software support EnergyWise for IPv4 communication. Only IPv4 packets destined to a device configured as an EnergyWise domain member can trigger these vulnerabilities. IPv6 packets cannot be used to trigger these vulnerabilities. Cisco Bug ID CSCur29331.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/97935; http://www.securitytracker.com/id/1038313; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-energywise
CVE: CVE-2017-3861
Published: 2017-04-20
Description: Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted EnergyWise packets to be processed by an affected device. An exploit could allow the attacker to cause a buffer overflow condition or a reload of the affected device, leading to a DoS condition. Cisco IOS Software and Cisco IOS XE Software support EnergyWise for IPv4 communication. Only IPv4 packets destined to a device configured as an EnergyWise domain member can trigger these vulnerabilities. IPv6 packets cannot be used to trigger these vulnerabilities. Cisco Bug ID CSCut47751.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/97935; http://www.securitytracker.com/id/1038313; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-energywise
CVE: CVE-2017-3862
Published: 2017-04-20
Description: Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted EnergyWise packets to be processed by an affected device. An exploit could allow the attacker to cause a buffer overflow condition or a reload of the affected device, leading to a DoS condition. Cisco IOS Software and Cisco IOS XE Software support EnergyWise for IPv4 communication. Only IPv4 packets destined to a device configured as an EnergyWise domain member can trigger these vulnerabilities. IPv6 packets cannot be used to trigger these vulnerabilities. Cisco Bug ID CSCuu76493.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/97935; http://www.securitytracker.com/id/1038313; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-energywise
CVE: CVE-2017-3863
Published: 2017-04-20
Description: Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted EnergyWise packets to be processed by an affected device. An exploit could allow the attacker to cause a buffer overflow condition or a reload of the affected device, leading to a DoS condition. Cisco IOS Software and Cisco IOS XE Software support EnergyWise for IPv4 communication. Only IPv4 packets destined to a device configured as an EnergyWise domain member can trigger these vulnerabilities. IPv6 packets cannot be used to trigger these vulnerabilities. Cisco Bug ID CSCut50727.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/97935; http://www.securitytracker.com/id/1038313; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-energywise
CVE: CVE-2017-4969
Published: 2017-04-20
Description: The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotas for tasks.
CVSS Score: 6.5 (MEDIUM)
References: https://www.cloudfoundry.org/cve-2017-4969/; https://www.cloudfoundry.org/cve-2017-4969/
CVE: CVE-2017-6607
Published: 2017-04-20
Description: A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response messages. An attacker could exploit this vulnerability by triggering a DNS request from the Cisco ASA Software and replying with a crafted response. A successful exploit could cause the device to reload, resulting in a denial of service (DoS) condition or corruption of the local DNS cache information. Note: Only traffic directed to the affected device can be used to exploit this vulnerability. This vulnerability affects Cisco ASA Software configured in routed or transparent firewall mode and single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. This vulnerability affects Cisco ASA Software running on the following products: Cisco ASA 1000V Cloud Firewall, Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA 5500-X Series Next-Generation Firewalls, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Cisco Adaptive Security Virtual Appliance (ASAv), Cisco Firepower 9300 ASA Security Module, Cisco ISA 3000 Industrial Security Appliance. Fixed versions: 9.1(7.12) 9.2(4.18) 9.4(3.12) 9.5(3.2) 9.6(2.2). Cisco Bug IDs: CSCvb40898.
CVSS Score: 8.7 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/97933; http://www.securitytracker.com/id/1038319; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-dns
CVE: CVE-2017-6608
Published: 2017-04-20
Description: A vulnerability in the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper parsing of crafted SSL or TLS packets. An attacker could exploit this vulnerability by sending a crafted packet to the affected system. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. A valid SSL or TLS session is needed to exploit this vulnerability. This vulnerability affects Cisco ASA Software running on the following products: Cisco ASA 1000V Cloud Firewall, Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA 5500-X Series Next-Generation Firewalls, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Cisco Adaptive Security Virtual Appliance (ASAv), Cisco Firepower 9300 ASA Security Module, Cisco ISA 3000 Industrial Security Appliance. Fixed versions: 8.4(7.31) 9.0(4.39) 9.1(7) 9.2(4.6) 9.3(3.8) 9.4(2) 9.5(2). Cisco Bug IDs: CSCuv48243.
CVSS Score: 8.6 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/97937; http://www.securitytracker.com/id/1038315; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-tls
CVE: CVE-2017-6609
Published: 2017-04-20
Description: A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper parsing of malformed IPsec packets. An attacker could exploit this vulnerability by sending malformed IPsec packets to the affected system. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed firewall mode only and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. An attacker needs to establish a valid IPsec tunnel before exploiting this vulnerability. This vulnerability affects Cisco ASA Software running on the following products: Cisco ASA 1000V Cloud Firewall, Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA 5500-X Series Next-Generation Firewalls, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Cisco Adaptive Security Virtual Appliance (ASAv), Cisco Firepower 9300 ASA Security Module, Cisco ISA 3000 Industrial Security Appliance. Fixed versions: 9.1(7.8) 9.2(4.15) 9.4(4) 9.5(3.2) 9.6(2). Cisco Bug IDs: CSCun16158.
CVSS Score: 7.7 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/97936; http://www.securitytracker.com/id/1038316; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-ipsec