deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-0890
Published: 2017-05-08
Description: Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/213227; https://nextcloud.com/security/advisory/?id=nc-sa-2017-007; https://hackerone.com/reports/213227
CVE: CVE-2017-0891
Published: 2017-05-08
Description: Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/216812; https://nextcloud.com/security/advisory/?id=nc-sa-2017-008; https://hackerone.com/reports/216812
CVE: CVE-2017-0892
Published: 2017-05-08
Description: Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file.
CVSS Score: 3.5 (LOW)
CWE: CWE-285, CWE-384
References: https://hackerone.com/reports/191979; https://nextcloud.com/security/advisory/?id=nc-sa-2017-009; https://hackerone.com/reports/191979
CVE: CVE-2017-0893
Published: 2017-05-08
Description: Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/222838; https://nextcloud.com/security/advisory/?id=nc-sa-2017-010; https://hackerone.com/reports/222838
CVE: CVE-2017-0894
Published: 2017-05-08
Description: Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://hackerone.com/reports/218876; https://nextcloud.com/security/advisory/?id=nc-sa-2017-011; https://hackerone.com/reports/218876
CVE: CVE-2017-0895
Published: 2017-05-08
Description: Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
CVSS Score: 3.5 (LOW)
CWE: CWE-285, CWE-200
References: https://hackerone.com/reports/203594; https://nextcloud.com/security/advisory/?id=nc-sa-2017-012; https://hackerone.com/reports/203594
CVE: CVE-2017-4982
Published: 2017-05-08
Description: EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://www.securityfocus.com/archive/1/540531/30/0/threaded; http://www.securityfocus.com/bid/98049; https://packetstormsecurity.com/files/cve/CVE-2017-4982
CVE: CVE-2017-8767
Published: 2017-05-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-5526.  Reason: This candidate is a reservation duplicate of CVE-2017-5526.  Notes: All CVE users should reference CVE-2017-5526 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-0290
Published: 2017-05-09
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not properly scan a specially crafted file leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98330; http://www.securitytracker.com/id/1038419; http://www.securitytracker.com/id/1038420
CVE: CVE-2016-0776
Published: 2017-05-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2016-6799
Published: 2017-05-09
Description: Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition to the current log. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/98365; https://lists.apache.org/thread.html/1f3e7b0319d64b455f73616f572acee36fbca31f87f5b2e509c45b69%40%3Cdev.cordova.apache.org%3E; http://www.securityfocus.com/bid/98365
CVE: CVE-2016-9251
Published: 2017-05-09
Description: In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1038414; https://support.f5.com/csp/article/K41107914; http://www.securitytracker.com/id/1038414
CVE: CVE-2016-9253
Published: 2017-05-09
Description: In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1038415; https://support.f5.com/csp/article/K51351360; http://www.securitytracker.com/id/1038415
CVE: CVE-2016-9256
Published: 2017-05-09
Description: In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which this is possible is limited to at most a few seconds after the permission change.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/96464; https://support.f5.com/csp/article/K47284724; http://www.securityfocus.com/bid/96464
CVE: CVE-2016-9257
Published: 2017-05-09
Description: In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1038416; https://support.f5.com/csp/article/K43523962; http://www.securitytracker.com/id/1038416
CVE: CVE-2017-0302
Published: 2017-05-09
Description: In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a traffic disruption if the length of the requested URL is less than 16 characters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-118
References: http://www.securitytracker.com/id/1038408; https://support.f5.com/csp/article/K87141725; http://www.securitytracker.com/id/1038408
CVE: CVE-2017-6137
Published: 2017-05-09
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disruption of service to the Traffic Management Microkernel (TMM) on specific platforms and configurations.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securitytracker.com/id/1038409; https://support.f5.com/csp/article/K82851041; http://www.securitytracker.com/id/1038409
CVE: CVE-2017-3067
Published: 2017-05-09
Description: Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98348; http://www.securitytracker.com/id/1038428; https://helpx.adobe.com/security/products/aem-forms/apsb17-16.html
CVE: CVE-2017-3068
Published: 2017-05-09
Description: Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/98349; http://www.securitytracker.com/id/1038427; https://access.redhat.com/errata/RHSA-2017:1219
CVE: CVE-2017-3069
Published: 2017-05-09
Description: Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BlendMode class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/98349; http://www.securitytracker.com/id/1038427; https://access.redhat.com/errata/RHSA-2017:1219
CVE: CVE-2017-3070
Published: 2017-05-09
Description: Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the ConvolutionFilter class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/98349; http://www.securitytracker.com/id/1038427; https://access.redhat.com/errata/RHSA-2017:1219
CVE: CVE-2017-3071
Published: 2017-05-09
Description: Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when masking display objects. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98347; http://www.securitytracker.com/id/1038427; https://access.redhat.com/errata/RHSA-2017:1219
CVE: CVE-2017-3072
Published: 2017-05-09
Description: Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/98349; http://www.securitytracker.com/id/1038427; https://access.redhat.com/errata/RHSA-2017:1219
CVE: CVE-2017-3073
Published: 2017-05-09
Description: Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98349; http://www.securitytracker.com/id/1038427; https://access.redhat.com/errata/RHSA-2017:1219
CVE: CVE-2017-3074
Published: 2017-05-09
Description: Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Graphics class. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/98349; http://www.securitytracker.com/id/1038427; https://access.redhat.com/errata/RHSA-2017:1219
CVE: CVE-2017-8853
Published: 2017-05-09
Description: Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the file parameter during an act=db action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/FiyoCMS/FiyoCMS/issues/2; https://github.com/FiyoCMS/FiyoCMS/issues/2
CVE: CVE-2017-7967
Published: 2017-05-09
Description: All versions of VAMPSET software produced by Schneider Electric, prior to V2.2.189, are susceptible to a memory corruption vulnerability when a corrupted vf2 file is used. This vulnerability causes the software to halt or not start when trying to open the corrupted file. This vulnerability occurs when fill settings are intentionally malformed and is opened in a standalone state, without connection to a protection relay. This attack is not considered to be remotely exploitable. This vulnerability has no effect on the operation of the protection relay to which VAMPSET is connected. As Windows operating system remains operational and VAMPSET responds, it is able to be shut down through its normal closing protocol.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.schneider-electric.com/en/download/document/SEVD-2017-061-01/; http://www.securityfocus.com/bid/97124; http://www.schneider-electric.com/en/download/document/SEVD-2017-061-01/
CVE: CVE-2017-5527
Published: 2017-05-09
Description: TIBCO Spotfire Server 7.0.X before 7.0.2, 7.5.x before 7.5.1, 7.6.x before 7.6.1, 7.7.x before 7.7.1, and 7.8.x before 7.8.1 and Spotfire Analytics Platform for AWS Marketplace 7.8.0 and earlier contain multiple vulnerabilities which may allow authorized users to perform SQL injection attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/98398; http://www.tibco.com/support/advisories/2017/05/tibco-security-advisory-may-9-2017-tibco-spotfire-server; http://www.securityfocus.com/bid/98398
CVE: CVE-2017-8854
Published: 2017-05-09
Description: wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters, aka a buffer overflow triggered by a malformed temporary DH file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wolfSSL/wolfssl/releases/tag/v3.10.2-stable; https://github.com/wolfSSL/wolfssl/releases/tag/v3.10.2-stable
CVE: CVE-2017-8855
Published: 2017-05-09
Description: wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key.
CVSS Score: 7.5 (HIGH)
References: https://github.com/wolfSSL/wolfssl/releases/tag/v3.11.0-stable; https://github.com/wolfSSL/wolfssl/releases/tag/v3.11.0-stable
CVE: CVE-2017-0341
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input can trigger an access to a pointer that has not been initialized which may lead to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0342
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where incorrect calculation may cause an invalid address access leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-682
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0343
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) where user can trigger a race condition due to lack of synchronization in two functions leading to a denial of service or potential escalation of privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0344
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape may allow users to gain access to arbitrary physical memory, leading to escalation of privileges.
CVSS Score: 7.8 (HIGH)
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0345
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input used as an array size is not correctly validated allows out of bound access in kernel memory and may lead to denial of service or potential escalation of privileges
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0346
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://www.securityfocus.com/bid/98503; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0347
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array, which may lead to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0348
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0349
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is not correctly validated before it is dereferenced for a write operation, may lead to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://www.securityfocus.com/bid/98513; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0350
Published: 2017-05-09
Description: All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used in an offset calculation may lead to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://www.securityfocus.com/bid/98490; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0351
Published: 2017-05-09
Description: All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://www.securityfocus.com/bid/98497; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0352
Published: 2017-05-09
Description: All versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware where incorrect access control may allow CPU access sensitive GPU control registers, leading to an escalation of privileges
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://www.securityfocus.com/bid/98517; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0353
Published: 2017-05-09
Description: All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where due to improper locking on certain conditions may lead to a denial of service
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0354
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where a call to certain function requiring lower IRQL can be made under raised IRQL which may lead to a denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-0355
Published: 2017-05-09
Description: All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where it may access paged memory while holding a spinlock, leading to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4462; http://www.securityfocus.com/bid/98516; http://nvidia.custhelp.com/app/answers/detail/a_id/4462
CVE: CVE-2017-8856
Published: 2017-05-09
Description: In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution using the 'bprd' process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://www.securityfocus.com/bid/98379; https://www.veritas.com/content/support/en_US/security/VTS17-004.html#Issue1; http://www.securityfocus.com/bid/98379
CVE: CVE-2017-8857
Published: 2017-05-09
Description: In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using the 'bprd' process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://www.securityfocus.com/bid/98384; https://www.veritas.com/content/support/en_US/security/VTS17-004.html#Issue2; http://www.securityfocus.com/bid/98384
CVE: CVE-2017-8858
Published: 2017-05-09
Description: In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://www.securityfocus.com/bid/98381; https://www.veritas.com/content/support/en_US/security/VTS17-004.html#Issue3; http://www.securityfocus.com/bid/98381
CVE: CVE-2017-8859
Published: 2017-05-09
Description: In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/98383; https://www.veritas.com/content/support/en_US/security/VTS17-005.html#Issue1; http://www.securityfocus.com/bid/98383
CVE: CVE-2016-10371
Published: 2017-05-10
Description: The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.maptools.org/show_bug.cgi?id=2535; http://bugzilla.maptools.org/show_bug.cgi?id=2612; https://usn.ubuntu.com/3602-1/