deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9821
Published: 2017-03-30
Description: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=0a89a1ccca6e7ee059b73f5cc924513383e8a330
CVE: CVE-2014-9822
Published: 2017-03-30
Description: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted quantum file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=09561d37839dbfa04e017eea[PII_REDACTED]095d8
CVE: CVE-2014-9823
Published: 2017-03-30
Description: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9819.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=09561d37839dbfa04e017eea[PII_REDACTED]095d8
CVE: CVE-2014-9824
Published: 2017-03-30
Description: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9825.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=09561d37839dbfa04e017eea[PII_REDACTED]095d8
CVE: CVE-2014-9825
Published: 2017-03-30
Description: Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9824.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a[PII_REDACTED]bb0b45e276
CVE: CVE-2014-9826
Published: 2017-03-30
Description: ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-388
References: http://www.openwall.com/lists/oss-security/2014/12/24/1; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a[PII_REDACTED]bb0b45e276
CVE: CVE-2017-5184
Published: 2017-03-30
Description: A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow leakage of information (account enumeration).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97262; https://www.netiq.com/support/kb/doc.php?id=7018753; https://www.tenable.com/security/research/tra-2017-15
CVE: CVE-2017-5185
Published: 2017-03-30
Description: A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow remote denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97267; https://www.netiq.com/support/kb/doc.php?id=7018753; https://www.tenable.com/security/research/tra-2017-15
CVE: CVE-2017-6182
Published: 2017-03-30
Description: In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via functions, aka NSWA-1304.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html; http://www.securityfocus.com/bid/97261; https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2
CVE: CVE-2017-6183
Published: 2017-03-30
Description: In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulnerable to remote command injection, aka NSWA-1314.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html; http://www.securityfocus.com/bid/97261; https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2
CVE: CVE-2017-6184
Published: 2017-03-30
Description: In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token parameter, aka NSWA-1303.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html; http://www.securityfocus.com/bid/97261; https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2
CVE: CVE-2017-6412
Published: 2017-03-30
Description: In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html; http://www.securityfocus.com/bid/97261; https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2
CVE: CVE-2017-7253
Published: 2017-03-30
Description: Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to the IP camera with admin credentials so as to obtain full control of the target IP camera. During exploitation, the first JSON object encountered has a "Component error: login challenge!" message. The second JSON object encountered has a result indicating a successful admin login.
CVSS Score: 8.8 (HIGH)
CWE: CWE-922
References: http://www.securityfocus.com/bid/97263; https://gist.github.com/anonymous/16aca69b7dea27cb73ddebb0d9033b02; http://www.securityfocus.com/bid/97263
CVE: CVE-2017-7346
Published: 2017-03-30
Description: The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]0117&w=2; http://www.debian.org/security/2017/dsa-3927; http://www.debian.org/security/2017/dsa-3945
CVE: CVE-2016-9319
Published: 2017-03-31
Description: There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.info-sec.ca/advisories/Trend-Micro-Enterprise-Mobile-Security.html; http://www.securityfocus.com/bid/97272; https://success.trendmicro.com/solution/1116973
CVE: CVE-2017-2647
Published: 2017-03-31
Description: The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81; http://www.securityfocus.com/bid/97258; https://access.redhat.com/errata/RHSA-2017:1842
CVE: CVE-2017-6973
Published: 2017-03-31
Description: A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2017/03/30/4; http://www.mantisbt.org/bugs/view.php?id=22537; http://www.securityfocus.com/bid/97252
CVE: CVE-2017-7241
Published: 2017-03-31
Description: A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2017/03/30/4; http://www.mantisbt.org/bugs/view.php?id=22568; http://www.securityfocus.com/bid/97253
CVE: CVE-2017-7309
Published: 2017-03-31
Description: A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2017/03/30/4; http://www.mantisbt.org/bugs/view.php?id=22579; http://www.securityfocus.com/bid/97251
CVE: CVE-2017-7359
Published: 2017-03-31
Description: Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html; http://www.securityfocus.com/bid/97270; http://www.securityfocus.com/bid/97274
CVE: CVE-2017-7360
Published: 2017-03-31
Description: Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html; http://www.securityfocus.com/bid/97264; http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html
CVE: CVE-2017-7361
Published: 2017-03-31
Description: Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html; http://www.securityfocus.com/bid/97274; http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html
CVE: CVE-2017-7362
Published: 2017-03-31
Description: Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html; http://www.securityfocus.com/bid/97268; http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html
CVE: CVE-2017-7363
Published: 2017-03-31
Description: Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html; http://www.securityfocus.com/bid/97259; http://rungga.blogspot.co.id/2017/03/multiple-xss-vulnerability-on-pixie-104.html
CVE: CVE-2008-7313
Published: 2017-03-31
Description: The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands.  NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.27; http://www.openwall.com/lists/oss-security/2014/07/09/11; http://www.openwall.com/lists/oss-security/2014/07/16/10
CVE: CVE-2014-3931
Published: 2017-03-31
Description: fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: http://mrlg.op-sec.us/; http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt; https://hackerone.com/reports/16330
CVE: CVE-2014-5008
Published: 2017-03-31
Description: Snoopy allows remote attackers to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://rhn.redhat.com/errata/RHSA-2017-0211.html; http://rhn.redhat.com/errata/RHSA-2017-0212.html; http://rhn.redhat.com/errata/RHSA-2017-0213.html
CVE: CVE-2014-5009
Published: 2017-03-31
Description: Snoopy allows remote attackers to execute arbitrary commands.  NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://rhn.redhat.com/errata/RHSA-2017-0211.html; http://rhn.redhat.com/errata/RHSA-2017-0212.html; http://rhn.redhat.com/errata/RHSA-2017-0213.html
CVE: CVE-2014-9114
Published: 2017-03-31
Description: Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146229.html; http://lists.opensuse.org/opensuse-updates/2015-01/msg00035.html
CVE: CVE-2015-4624
Published: 2017-03-31
Description: Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/133052/WiFi-Pineapple-Predictable-CSRF-Token.html; http://packetstormsecurity.com/files/139212/Hak5-WiFi-Pineapple-Preconfiguration-Command-Injection-2.html; http://www.securityfocus.com/archive/1/536184/100/500/threaded
CVE: CVE-2016-6209
Published: 2017-03-31
Description: Cross-site scripting (XSS) vulnerability in Nagios.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2016/Jun/20; https://bugzilla.redhat.com/show_bug.cgi?id=1346217; http://seclists.org/fulldisclosure/2016/Jun/20
CVE: CVE-2017-3009
Published: 2017-03-31
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable buffer overflow vulnerability in the JPEG2000 parser. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97302; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html; http://www.securityfocus.com/bid/97302
CVE: CVE-2017-3010
Published: 2017-03-31
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the rendering engine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97306; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html; http://www.securityfocus.com/bid/97306
CVE: CVE-2016-6022
Published: 2017-03-31
Description: IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97173; https://www.ibm.com/support/docview.wss?uid=swg22000784; http://www.securityfocus.com/bid/97173
CVE: CVE-2016-6031
Published: 2017-03-31
Description: IBM Rational Quality Manager 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97169; https://www.ibm.com/support/docview.wss?uid=swg22000784; http://www.securityfocus.com/bid/97169
CVE: CVE-2016-6036
Published: 2017-03-31
Description: IBM Rational Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97172; https://www.ibm.com/support/docview.wss?uid=swg22000784; http://www.securityfocus.com/bid/97172
CVE: CVE-2016-6111
Published: 2017-03-31
Description: IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000833.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg22000833; http://www.securityfocus.com/bid/97244; http://www.ibm.com/support/docview.wss?uid=swg22000833
CVE: CVE-2016-8917
Published: 2017-03-31
Description: IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 2000943.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg22000943; http://www.securityfocus.com/bid/97150; http://www.ibm.com/support/docview.wss?uid=swg22000943
CVE: CVE-2016-8935
Published: 2017-03-31
Description: IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999483.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21999483; http://www.securityfocus.com/bid/97077; http://www.ibm.com/support/docview.wss?uid=swg21999483
CVE: CVE-2016-9707
Published: 2017-03-31
Description: IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000784.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/97171; https://www.ibm.com/support/docview.wss?uid=swg22000784; http://www.securityfocus.com/bid/97171
CVE: CVE-2016-9990
Published: 2017-03-31
Description: IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998824.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21998824; http://www.securityfocus.com/bid/97151; http://www.securitytracker.com/id/1038145
CVE: CVE-2017-1154
Published: 2017-03-31
Description: IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to files in the local environment which should not be viewed by application users. IBM Reference #: 1999892.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21999892; http://www.securityfocus.com/bid/97248; http://www.ibm.com/support/docview.wss?uid=swg21999892
CVE: CVE-2017-1171
Published: 2017-03-31
Description: The IBM TRIRIGA Application Platform 3.3, 3,4, and 3,5 contain a vulnerability that could allow an authenticated user to execute Application actions they do not have access to. IBM Reference #: 2001083.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/97245; https://www.ibm.com/support/docview.wss?uid=swg22001083; http://www.securityfocus.com/bid/97245
CVE: CVE-2017-2775
Published: 2017-03-31
Description: An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled VI file can be used to trigger this vulnerability, exploitation could lead to remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.ni.com/product-documentation/53778/en/; http://www.securityfocus.com/bid/97020; http://www.talosintelligence.com/reports/TALOS-2017-0269/
CVE: CVE-2016-6560
Published: 2017-03-31
Description: illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash.
CVSS Score: 8.6 (HIGH)
CWE: CWE-195, CWE-20
References: https://github.com/illumos/illumos-gate/commit/5aaab1a49679c26dbcb6fb6dc25799950d70cc71; https://www.illumos.org/issues/7488; https://www.openindiana.org/2016/11/01/cve-2016-6560-cve-2016-6561-security-issues-in-illumos/
CVE: CVE-2016-6561
Published: 2017-03-31
Description: illumos smbsrv NULL pointer dereference allows system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: http://www.securityfocus.com/bid/98079; https://github.com/illumos/illumos-gate/commit/6d1c73b5858fefc6161c7d686345f0dc887ea799; https://www.illumos.org/issues/7483
CVE: CVE-2017-7374
Published: 2017-03-31
Description: Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service (NULL pointer dereference) or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be freed prematurely.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1b53cf9815bb4744958d41f3795d5d5a1d365e2d; http://www.securityfocus.com/bid/97308; https://github.com/torvalds/linux/commit/1b53cf9815bb4744958d41f3795d5d5a1d365e2d
CVE: CVE-2016-8032
Published: 2017-03-31
Description: Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local security protection via a crafted input file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/97144; http://www.securitytracker.com/id/1038159; https://kc.mcafee.com/corporate/index?page=content&id=SB10190
CVE: CVE-2017-7386
Published: 2017-04-01
Description: citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98082; https://github.com/citymont/symetrie/issues/3; http://www.securityfocus.com/bid/98082
CVE: CVE-2017-7387
Published: 2017-04-01
Description: TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97309; https://github.com/TheFirstQuestion/HelpMeWatchWho/issues/1; http://www.securityfocus.com/bid/97309
CVE: CVE-2017-7388
Published: 2017-04-01
Description: A Cross-Site Scripting (XSS) was discovered in 'wallacepos v1.4.1'. The vulnerability exists due to insufficient filtration of user-supplied data (token) passed to the 'wallacepos-master/myaccount/resetpassword.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97316; https://github.com/micwallace/wallacepos/issues/84; http://www.securityfocus.com/bid/97316