deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2302
Published: 2017-05-30
Description: On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D55, 12.1X47 prior to 12.1X47-D45, 12.3R13 prior to 12.3R13, 12.3X48 prior to 12.3X48-D35, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D40, 14.1X55 prior to 14.1X55-D35, 14.2 prior to 14.2R6, 15.1 prior to 15.1F2 or 15.1R1, 15.1X49 prior to 15.1X49-D20 where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network based attacker can cause the Junos OS rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/95394; http://www.securitytracker.com/id/1037595; https://kb.juniper.net/JSA10771
CVE: CVE-2017-2303
Published: 2017-05-30
Description: On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D50, 12.1X47 prior to 12.1X47-D40, 12.3 prior to 12.3R13, 12.3X48 prior to 12.3X48-D30, 13.2X51 prior to 13.2X51-D40, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D35, 14.1X55 prior to 14.1X55-D35, 14.2 prior to 14.2R5, 15.1 prior to 15.1F6 or 15.1R3, 15.1X49 prior to 15.1X49-D30 or 15.1X49-D40, 15.1X53 prior to 15.1X53-D35, and where RIP is enabled, certain RIP advertisements received by the router may cause the RPD daemon to crash resulting in a denial of service condition.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/95408; http://www.securitytracker.com/id/1037594; https://kb.juniper.net/JSA10772
CVE: CVE-2017-2304
Published: 2017-05-30
Description: Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15.1 prior to 15.1R2, do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is also known as 'Etherleak'
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95403; http://www.securitytracker.com/id/1037593; https://kb.juniper.net/JSA10773
CVE: CVE-2017-2305
Published: 2017-05-30
Description: On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/98759; https://kb.juniper.net/JSA10770; http://www.securityfocus.com/bid/98759
CVE: CVE-2017-2306
Published: 2017-05-30
Description: On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/98772; https://kb.juniper.net/JSA10770; http://www.securityfocus.com/bid/98772
CVE: CVE-2017-2307
Published: 2017-05-30
Description: A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98749; https://kb.juniper.net/JSA10770; http://www.securityfocus.com/bid/98749
CVE: CVE-2017-2308
Published: 2017-05-30
Description: An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/98755; https://kb.juniper.net/JSA10770; http://www.securityfocus.com/bid/98755
CVE: CVE-2017-2309
Published: 2017-05-30
Description: On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98750; https://kb.juniper.net/JSA10770; http://www.securityfocus.com/bid/98750
CVE: CVE-2017-2310
Published: 2017-05-30
Description: A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/98751; https://kb.juniper.net/JSA10770; http://www.securityfocus.com/bid/98751
CVE: CVE-2017-2311
Published: 2017-05-30
Description: On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/98748; https://kb.juniper.net/JSA10770; http://www.securityfocus.com/bid/98748
CVE: CVE-2017-7494
Published: 2017-05-30
Description: Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://www.debian.org/security/2017/dsa-3860; http://www.securityfocus.com/bid/98636; http://www.securitytracker.com/id/1038552
CVE: CVE-2017-7502
Published: 2017-05-30
Description: Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: http://www.debian.org/security/2017/dsa-3872; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/98744
CVE: CVE-2017-7511
Published: 2017-05-30
Description: poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cgit.freedesktop.org/poppler/poppler/commit/?id=5c9b08a875b07853be6c44e43ff5f7f059df666a; https://security.gentoo.org/glsa/201801-17; https://cgit.freedesktop.org/poppler/poppler/commit/?id=5c9b08a875b07853be6c44e43ff5f7f059df666a
CVE: CVE-2017-8402
Published: 2017-05-31
Description: PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://sourceforge.net/p/pivot-weblog/code/4489/; https://sourceforge.net/p/pivot-weblog/code/4489/
CVE: CVE-2017-8782
Published: 2017-05-31
Description: The readString function in util/read.c and util/old/read.c in libming 0.4.8 allows remote attackers to cause a denial of service via a large file that is mishandled by listswf, listaction, etc. This occurs because of an integer overflow that leads to a memory allocation error.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://seclists.org/fulldisclosure/2017/May/106; http://www.securityfocus.com/bid/98793; http://seclists.org/fulldisclosure/2017/May/106
CVE: CVE-2017-9304
Published: 2017-05-31
Description: libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/VirusTotal/yara/commit/925bcf3c3b0a28b5b78e25d9efda5c0bf27ae699; https://github.com/VirusTotal/yara/issues/674; https://github.com/VirusTotal/yara/commit/925bcf3c3b0a28b5b78e25d9efda5c0bf27ae699
CVE: CVE-2017-9305
Published: 2017-05-31
Description: lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tikiorg/tiki/commit/6c016e8f066d2f404b18eaa1af7fa0c7a9651ccd; https://www.cdxy.me/?p=763; https://github.com/tikiorg/tiki/commit/6c016e8f066d2f404b18eaa1af7fa0c7a9651ccd
CVE: CVE-2017-9306
Published: 2017-05-31
Description: inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cdxy.me/?p=763; https://www.cdxy.me/?p=763
CVE: CVE-2017-9307
Published: 2017-05-31
Description: SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port scans and access intranet servers via a crafted file parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/s3131212/allendisk/issues/20; https://github.com/s3131212/allendisk/issues/20
CVE: CVE-2016-10373
Published: 2017-05-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10214.  Reason: This candidate is a reservation duplicate of CVE-2016-10214.  Notes: All CVE users should reference CVE-2016-10214 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-4897
Published: 2017-05-31
Description: VMware Horizon DaaS before 7.0.0 contains a vulnerability that exists due to insufficient validation of data. An attacker may exploit this issue by tricking DaaS client users into connecting to a malicious server and sharing all their drives and devices. Successful exploitation of this vulnerability requires a victim to download a specially crafted RDP file through DaaS client by clicking on a malicious link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96559; http://www.securitytracker.com/id/1037951; http://www.vmware.com/security/advisories/VMSA-2017-0002.html
CVE: CVE-2017-5688
Published: 2017-05-31
Description: There is an escalation of privilege vulnerability in the Intel Solid State Drive Toolbox versions before 3.4.5 which allow a local administrative attacker to load and execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
References: http://www.securityfocus.com/bid/98771; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00074&languageid=en-fr; http://www.securityfocus.com/bid/98771
CVE: CVE-2017-9331
Published: 2017-06-01
Description: The Agenda component in Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Utils/RecordBrowser/RecordBrowserCommon_0.php, which allows remote attackers to inject arbitrary web script or HTML via a crafted meeting description parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Telaxus/EPESI/commit/dda3e5f3843e80fe9ed36115f4fe72c06a3a41bc; https://github.com/Telaxus/EPESI/issues/193; https://github.com/Telaxus/EPESI/commit/dda3e5f3843e80fe9ed36115f4fe72c06a3a41bc
CVE: CVE-2017-9334
Published: 2017-06-01
Description: An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to cause a denial of service by passing an improper list to an application that calls "length" on it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.nongnu.org/archive/html/chicken-announce/2017-05/msg00000.html; http://lists.nongnu.org/archive/html/chicken-hackers/2017-05/msg00099.html; http://lists.nongnu.org/archive/html/chicken-announce/2017-05/msg00000.html
CVE: CVE-2017-9336
Published: 2017-06-01
Description: The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lncken.cn/?p=258; http://lncken.cn/?p=258
CVE: CVE-2017-9337
Published: 2017-06-01
Description: The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lncken.cn/?p=279; http://lncken.cn/?p=279
CVE: CVE-2017-3127
Published: 2017-06-01
Description: A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98048; http://www.securitytracker.com/id/1038367; https://fortiguard.com/psirt/FG-IR-17-017
CVE: CVE-2015-0936
Published: 2017-06-01
Description: Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-320
References: http://packetstormsecurity.com/files/131259/Ceragon-FibeAir-IP-10-SSH-Private-Key-Exposure.html; http://packetstormsecurity.com/files/131260/Ceragon-FibeAir-IP-10-SSH-Private-Key-Exposure.html; http://seclists.org/fulldisclosure/2015/Apr/3
CVE: CVE-2015-5473
Published: 2017-06-01
Description: Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary files via unspecified parameters to (1) upload/updateDriver or (2) upload/addDriver or to execute arbitrary code with SYSTEM privileges via unspecified parameters to (3) uploadCloning.html, (4) fileupload.html, (5) uploadFirmware.html, or (6) upload/driver.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.securityfocus.com/bid/75912; http://www.zerodayinitiative.com/advisories/ZDI-15-296; http://www.zerodayinitiative.com/advisories/ZDI-15-297
CVE: CVE-2015-6531
Published: 2017-06-01
Description: Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafted firmware image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/76862; https://www.tenable.com/security/research/tra-2015-02; http://www.securityfocus.com/bid/76862
CVE: CVE-2017-6512
Published: 2017-06-01
Description: Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://cpansearch.perl.org/src/JKEENAN/File-Path-2.13/Changes; http://security.cucumberlinux.com/security/details.php?id=153; http://www.debian.org/security/2017/dsa-3873
CVE: CVE-2017-7384
Published: 2017-06-01
Description: Cross-site scripting (XSS) vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bits3c.blogspot.dk/2017/05/cve-2017-7384-reflected-xss-in-flippdf.html; https://bits3c.blogspot.dk/2017/05/cve-2017-7384-reflected-xss-in-flippdf.html
CVE: CVE-2017-7999
Published: 2017-06-01
Description: Atlassian Eucalyptus before 4.4.1, when in EDGE mode, allows remote authenticated users with certain privileges to cause a denial of service (E2 service outage) via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://eucalyptus.atlassian.net/wiki/display/advisories/ESA-33; https://eucalyptus.atlassian.net/wiki/display/advisories/ESA-33
CVE: CVE-2017-8386
Published: 2017-06-01
Description: git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html; http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/; http://www.debian.org/security/2017/dsa-3848
CVE: CVE-2017-9060
Published: 2017-06-01
Description: Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=dd248ed7e204ee8a1873914e02b8b526e8f1b80d; http://www.openwall.com/lists/oss-security/2017/05/19/1; http://www.securityfocus.com/bid/98632
CVE: CVE-2016-3073
Published: 2017-06-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-3079.  Reason: This candidate is a reservation duplicate of CVE-2016-3079.  Notes: All CVE users should reference CVE-2016-3079 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-9343
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed in epan/dissectors/packet-msnip.c by validating an IPv4 address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/98797; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1678
CVE: CVE-2017-9344
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. This was addressed in epan/dissectors/packet-btl2cap.c by validating an interval value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: http://www.securityfocus.com/bid/98796; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1539
CVE: CVE-2017-9345
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dns.c by trying to detect self-referencing pointers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/98798; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1206
CVE: CVE-2017-9346
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-slsk.c by making loop bounds more explicit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/98799; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1200
CVE: CVE-2017-9347
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/98800; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1216
CVE: CVE-2017-9348
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-dof.c by validating a size value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98801; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1151
CVE: CVE-2017-9349
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed in epan/dissectors/packet-dcm.c by validating a length value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/98803; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1329
CVE: CVE-2017-9350
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-770
References: http://www.securityfocus.com/bid/98806; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1212
CVE: CVE-2017-9351
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98808; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1153
CVE: CVE-2017-9352
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by ensuring that backwards parsing cannot occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/98804; http://www.securitytracker.com/id/1038612; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13599
CVE: CVE-2017-9353
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98805; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1303
CVE: CVE-2017-9354
Published: 2017-06-02
Description: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98802; http://www.securitytracker.com/id/1038612; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1243
CVE: CVE-2017-9358
Published: 2017-06-02
Description: A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion (by message logging in that loop).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://downloads.asterisk.org/pub/security/AST-2017-004.txt; http://www.securityfocus.com/bid/98573; http://www.securitytracker.com/id/1038531
CVE: CVE-2017-9359
Published: 2017-06-02
Description: The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://downloads.asterisk.org/pub/security/AST-2017-003.txt; http://www.debian.org/security/2017/dsa-3933; http://www.securityfocus.com/bid/98578
CVE: CVE-2017-9360
Published: 2017-06-02
Description: WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://jgj212.blogspot.tw/2017/05/a-sql-injection-vulnerability-in.html; https://jgj212.blogspot.tw/2017/05/a-sql-injection-vulnerability-in.html
CVE: CVE-2017-9361
Published: 2017-06-02
Description: WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jgj212.blogspot.tw/2017/05/a-stored-xss-vulnerability-in.html; https://jgj212.blogspot.tw/2017/05/a-stored-xss-vulnerability-in.html
CVE: CVE-2017-9363
Published: 2017-06-02
Description: Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.soffid.com/security-advisory1-update/; http://www.soffid.com/security-advisory1-update/