deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-17698
Published: 2017-12-15
Description: Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/passwordmanagerpro/release-notes.html; https://www.manageengine.com/products/passwordmanagerpro/release-notes.html
CVE: CVE-2017-12373
Published: 2017-12-15
Description: A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. Cisco Bug IDs: CSCvg97652.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-203
References: http://www.securityfocus.com/bid/102170; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher; http://www.securityfocus.com/bid/102170
CVE: CVE-2017-17699
Published: 2017-12-15
Description: K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/mmmxny/K7-Antivirus/tree/master/cve3; https://github.com/mmmxny/K7-Antivirus/tree/master/cve3
CVE: CVE-2017-17700
Published: 2017-12-15
Description: K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/mmmxny/K7-Antivirus/tree/master/cve1; https://github.com/mmmxny/K7-Antivirus/tree/master/cve1
CVE: CVE-2017-17701
Published: 2017-12-15
Description: K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/mmmxny/K7-Antivirus/tree/master/cve2; https://github.com/mmmxny/K7-Antivirus/tree/master/cve2
CVE: CVE-2017-14184
Published: 2017-12-15
Description: An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2334 and below versions allows regular users to see each other's VPN authentication credentials due to improperly secured storage locations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102123; https://fortiguard.com/advisory/FG-IR-17-214; http://www.securityfocus.com/bid/102123
CVE: CVE-2017-17712
Published: 2017-12-16
Description: The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f659a03a0ba9289b9aeb9b4470e6fb263d6f483; https://access.redhat.com/errata/RHSA-2018:0502; https://github.com/torvalds/linux/commit/8f659a03a0ba9289b9aeb9b4470e6fb263d6f483
CVE: CVE-2017-10904
Published: 2017-12-16
Description: Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android/; https://jvn.jp/en/jp/JVN67389262/index.html; https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android/
CVE: CVE-2017-10905
Published: 2017-12-16
Description: A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android/; https://jvn.jp/en/jp/JVN27342829/index.html; https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android/
CVE: CVE-2017-11397
Published: 2017-12-16
Description: A service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://fortiguard.com/zeroday/FG-VD-17-079; https://success.trendmicro.com/solution/1118796; https://fortiguard.com/zeroday/FG-VD-17-079
CVE: CVE-2017-14090
Published: 2017-12-16
Description: A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-326
References: https://success.trendmicro.com/solution/1118486; https://www.coresecurity.com/advisories/trend-micro-scanmail-microsoft-exchange-multiple-vulnerabilities; https://success.trendmicro.com/solution/1118486
CVE: CVE-2017-14091
Published: 2017-12-16
Description: A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources - could be exploited to overwrite sensitive files in the ScanMail for Exchange directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://success.trendmicro.com/solution/1118486; https://www.coresecurity.com/advisories/trend-micro-scanmail-microsoft-exchange-multiple-vulnerabilities; https://success.trendmicro.com/solution/1118486
CVE: CVE-2017-14092
Published: 2017-12-16
Description: The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://success.trendmicro.com/solution/1118486; https://www.coresecurity.com/advisories/trend-micro-scanmail-microsoft-exchange-multiple-vulnerabilities; https://success.trendmicro.com/solution/1118486
CVE: CVE-2017-14093
Published: 2017-12-16
Description: The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/solution/1118486; https://www.coresecurity.com/advisories/trend-micro-scanmail-microsoft-exchange-multiple-vulnerabilities; https://success.trendmicro.com/solution/1118486
CVE: CVE-2017-3184
Published: 2017-12-16
Description: ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unauthenticated, remote attacker can exploit this vulnerability by directly accessing the http://x.x.x.x/setup/setup_maintain_firmware-default.html page. This will allow an attacker to perform a factory reset on the device, leading to a denial of service condition or the ability to make use of default credentials (CVE-2017-3186).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-798
References: http://www.securityfocus.com/bid/96720/info; https://twitter.com/Hfuhs/status/[PII_REDACTED]21330944; https://twitter.com/hack3rsca/status/[PII_REDACTED]07386368
CVE: CVE-2017-3185
Published: 2017-12-16
Description: ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-598, CWE-200
References: http://www.securityfocus.com/bid/96720/info; https://twitter.com/Hfuhs/status/[PII_REDACTED]21330944; https://twitter.com/hack3rsca/status/[PII_REDACTED]07386368
CVE: CVE-2017-3186
Published: 2017-12-16
Description: ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take complete control of a device using default admin credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-798
References: http://www.securityfocus.com/bid/96720/info; https://twitter.com/Hfuhs/status/[PII_REDACTED]21330944; https://twitter.com/hack3rsca/status/[PII_REDACTED]07386368
CVE: CVE-2017-3190
Published: 2017-12-16
Description: Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/96719; https://www.kb.cert.org/vuls/id/247016; https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/
CVE: CVE-2017-3191
Published: 2017-12-16
Description: D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages such as tools_admin.asp without credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294, CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/123293; https://www.kb.cert.org/vuls/id/553503; https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/
CVE: CVE-2017-3192
Published: 2017-12-16
Description: D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/123292; https://www.kb.cert.org/vuls/id/553503; https://www.scmagazine.com/d-link-dir-130-and-dir-330-routers-vulnerable/article/644553/
CVE: CVE-2017-3193
Published: 2017-12-16
Description: Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability in the web administration interface HNAP service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/96747; https://tools.cisco.com/security/center/viewAlert.x?alertId=52967; https://twitter.com/NCCGroupInfosec/status/[PII_REDACTED]77723649
CVE: CVE-2017-3194
Published: 2017-12-16
Description: Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-200
References: http://www.securityfocus.com/bid/97158; https://exchange.xforce.ibmcloud.com/collection/XFTAS-Daily-Threat-Assessment-for-March-29-2017-0d704f6eb8163d995bbaf57bbf35a018; https://www.kb.cert.org/vuls/id/342303
CVE: CVE-2017-3195
Published: 2017-12-16
Description: Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: http://kb.commvault.com/article/SEC0013; http://redr2e.com/commvault-edge-cve-2017-3195/; http://www.securityfocus.com/bid/96941
CVE: CVE-2017-3196
Published: 2017-12-16
Description: PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outside of its typical bounds on the driver's receipt of network packets. Local attackers can exploit this issue to execute arbitrary code with SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://blog.rewolf.pl/blog/?p=1778; http://www.securityfocus.com/bid/96993/discuss; https://www.itsecuritynews.info/vuln-printing-communications-association-rawether-cve-2017-3196-local-privilege-escalation-vulnerability/
CVE: CVE-2017-14134
Published: 2017-12-16
Description: A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 (Customer Hosted) via the emailAddress parameter to passwordreset/PasswordReset.do, aka Open Bug Bounty ID OBB-286688.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openbugbounty.org/reports/286688/; https://www.openbugbounty.org/reports/286688/
CVE: CVE-2017-17715
Published: 2017-12-16
Description: The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1470; https://bugs.chromium.org/p/project-zero/issues/detail?id=1470
CVE: CVE-2017-17713
Published: 2017-12-16
Description: Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon parameter, the /register org parameter, the /register query parameter, the /register region parameter, the /register regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parameter, or the /tping id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/boxug/trape/commit/628149159ba25adbfc29a3ae1d4b10c7eb936dd3; https://www.seekurity.com/blog/general/cve-2017-17713-and-cve-2017-17714-multiple-sql-injections-and-xss-vulnerabilities-found-in-the-hackers-tracking-tool-trape-boxug/; https://www.youtube.com/watch?v=RWw1UTeZee8
CVE: CVE-2017-17714
Published: 2017-12-16
Description: Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon parameter, the /register org parameter, the /register query parameter, the /register region parameter, the /register regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parameter, or the /tping id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/boxug/trape/commit/628149159ba25adbfc29a3ae1d4b10c7eb936dd3; https://www.seekurity.com/blog/general/cve-2017-17713-and-cve-2017-17714-multiple-sql-injections-and-xss-vulnerabilities-found-in-the-hackers-tracking-tool-trape-boxug/; https://www.youtube.com/watch?v=Txp6IwR24jY
CVE: CVE-2017-16950
Published: 2017-12-17
Description: Cross - site scripting (XSS) vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.urbackup.org/2017/11/30/urbackup-server-2.1.20.html; https://www.urbackup.org/server_changelog.html; https://www.urbackup.org/2017/11/30/urbackup-server-2.1.20.html
CVE: CVE-2017-17716
Published: 2017-12-17
Description: GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://about.gitlab.com/2017/07/22/gitlab-9-4-released/#security---add-ldap-ssl-certificate-verification; https://about.gitlab.com/2017/07/28/gitlab-9-dot-4-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/30420
CVE: CVE-2017-17717
Published: 2017-12-17
Description: Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: http://openwall.com/lists/oss-security/2017/12/17/3; http://openwall.com/lists/oss-security/2017/12/17/3
CVE: CVE-2017-17718
Published: 2017-12-17
Description: The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://openwall.com/lists/oss-security/2017/12/17/10; https://github.com/ruby-ldap/ruby-net-ldap/issues/258; https://github.com/ruby-ldap/ruby-net-ldap/pull/279
CVE: CVE-2017-16997
Published: 2017-12-18
Description: elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/102228; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2018:3092
CVE: CVE-2017-17727
Published: 2017-12-18
Description: DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.seebug.org/vuldb/ssvid-20050; https://www.seebug.org/vuldb/ssvid-20050
CVE: CVE-2017-17730
Published: 2017-12-18
Description: DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://0day5.com/archives/1542/; http://0day5.com/archives/1542/
CVE: CVE-2017-17731
Published: 2017-12-18
Description: DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://0day5.com/archives/1346/; http://0day5.com/archives/1346/
CVE: CVE-2017-17733
Published: 2017-12-18
Description: Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
CVSS Score: 9.8 (CRITICAL)
References: http://www.0day5.com/archives/4383/; http://www.0day5.com/archives/4383/
CVE: CVE-2017-17734
Published: 2017-12-18
Description: CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737; https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa; https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737
CVE: CVE-2017-17735
Published: 2017-12-18
Description: CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737; https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa; https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737
CVE: CVE-2017-17737
Published: 2017-12-18
Description: The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html; https://www.exploit-db.com/exploits/43364/; http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html
CVE: CVE-2017-17738
Published: 2017-12-18
Description: The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html.
CVSS Score: 7.5 (HIGH)
References: http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html; https://www.exploit-db.com/exploits/43364/; http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html
CVE: CVE-2017-17739
Published: 2017-12-18
Description: The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html; https://www.exploit-db.com/exploits/43364/; http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html
CVE: CVE-2017-17740
Published: 2017-12-18
Description: contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html; http://www.openldap.org/its/index.cgi/Incoming?id=8759
CVE: CVE-2017-17741
Published: 2017-12-18
Description: The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102227; https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html; https://usn.ubuntu.com/3617-1/
CVE: CVE-2017-17643
Published: 2017-12-18
Description: FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/145444/FS-Lynda-Clone-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/43335/; https://packetstormsecurity.com/files/145444/FS-Lynda-Clone-1.0-SQL-Injection.html
CVE: CVE-2017-17645
Published: 2017-12-18
Description: Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/145445/Bus-Booking-Script-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/43336/; https://packetstormsecurity.com/files/145445/Bus-Booking-Script-1.0-SQL-Injection.html
CVE: CVE-2017-17649
Published: 2017-12-18
Description: Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://packetstormsecurity.com/files/145438/Readymade-Video-Sharing-Script-3.2-HTML-Injection.html; https://www.exploit-db.com/exploits/43333/; https://packetstormsecurity.com/files/145438/Readymade-Video-Sharing-Script-3.2-HTML-Injection.html
CVE: CVE-2017-17651
Published: 2017-12-18
Description: Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/145439/Paid-To-Read-Script-2.0.5-SQL-Injection.html; https://www.exploit-db.com/exploits/43334/; https://packetstormsecurity.com/files/145439/Paid-To-Read-Script-2.0.5-SQL-Injection.html