deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8736
Published: 2017-09-13
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to obtain specific information used in the parent domain, due to Microsoft browser parent domain verification in certain functionality, aka "Microsoft Browser Information Disclosure Vulnerability".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100743; http://www.securitytracker.com/id/1039342; http://www.securitytracker.com/id/1039343
CVE: CVE-2017-8737
Published: 2017-09-13
Description: Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Windows PDF Library handles objects in memory, aka "Windows PDF Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8728.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100749; http://www.securitytracker.com/id/1039327; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8737
CVE: CVE-2017-8738
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100759; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8738
CVE: CVE-2017-8739
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100761; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8739
CVE: CVE-2017-8740
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100763; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8740
CVE: CVE-2017-8741
Published: 2017-09-13
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100764; http://www.securitytracker.com/id/1039342; http://www.securitytracker.com/id/1039343
CVE: CVE-2017-8742
Published: 2017-09-13
Description: A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Service Pack 2, Microsoft PowerPoint 2013 Service Pack 1, Microsoft PowerPoint 2013 RT Service Pack 1, Microsoft PowerPoint 2016, Microsoft PowerPoint Viewer 2007, Microsoft SharePoint Server 2013 Service Pack 1, Microsoft SharePoint Enterprise Server 2016, Microsoft Office Web Apps 2010 Service Pack 2, and Microsoft Office Compatibility Pack Service Pack 3 when they fail to properly handle objects in memory, aka "PowerPoint Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8743.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100741; http://www.securitytracker.com/id/1039323; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8742
CVE: CVE-2017-8743
Published: 2017-09-13
Description: A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016, and Office Online Server when they fail to properly handle objects in memory, aka "PowerPoint Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8742.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100746; http://www.securitytracker.com/id/1039323; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8743
CVE: CVE-2017-8744
Published: 2017-09-13
Description: A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, and Microsoft Excel 2016 when they fail to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8630, CVE-2017-8632, and CVE-2017-8731.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100748; http://www.securitytracker.com/id/1039315; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8744
CVE: CVE-2017-8745
Published: 2017-09-13
Description: An elevation of privilege vulnerability exists in Microsoft SharePoint Foundation 2013 Service Pack 1 when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Cross Site Scripting Vulnerability".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100753; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8745; http://www.securityfocus.com/bid/100753
CVE: CVE-2017-8746
Published: 2017-09-13
Description: Windows Device Guard in Windows 10 1607, 1703, and Windows Server 2016 allows A security feature bypass vulnerability due to how PowerShell exposes functions and processes user supplied code, aka "Device Guard Security Feature Bypass Vulnerability".
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/100760; http://www.securitytracker.com/id/1039340; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8746
CVE: CVE-2017-8747
Published: 2017-09-13
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Internet Explorer accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8749.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100765; http://www.securitytracker.com/id/1039328; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8747
CVE: CVE-2017-8748
Published: 2017-09-13
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100766; http://www.securitytracker.com/id/1039342; http://www.securitytracker.com/id/1039343
CVE: CVE-2017-8749
Published: 2017-09-13
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Internet Explorer accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8747.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100770; http://www.securitytracker.com/id/1039328; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8749
CVE: CVE-2017-8750
Published: 2017-09-13
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability".
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100771; http://www.securitytracker.com/id/1039342; http://www.securitytracker.com/id/1039343
CVE: CVE-2017-8751
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8731, CVE-2017-8734, and CVE-2017-11766.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039326; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8751; https://www.exploit-db.com/exploits/43151/
CVE: CVE-2017-8752
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100775; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8752
CVE: CVE-2017-8753
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100776; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8753
CVE: CVE-2017-8754
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page containing malicious content, due to the way that the Edge Content Security Policy (CSP) validates certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-8723.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100779; http://www.securitytracker.com/id/1039326; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8754
CVE: CVE-2017-8755
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100778; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8755
CVE: CVE-2017-8756
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100718; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8756
CVE: CVE-2017-8757
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way Microsoft Edge handles objects in memory, aka "Microsoft Edge Remote Code Execution Vulnerability".
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100721; http://www.securitytracker.com/id/1039326; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8757
CVE: CVE-2017-8758
Published: 2017-09-13
Description: Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100723; http://www.securitytracker.com/id/1039320; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8758
CVE: CVE-2017-8759
Published: 2017-09-13
Description: Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/100742; http://www.securitytracker.com/id/1039324; https://github.com/GitHubAssessments/CVE_Assessments_01_2020
CVE: CVE-2017-14401
Published: 2017-09-13
Description: The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT UPDATE" section.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.sstrunk.com/cve/module_admin_user_add_modify_user.html; http://www.sstrunk.com/cve/module_admin_user_add_modify_user.html
CVE: CVE-2017-14402
Published: 2017-09-13
Description: The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.sstrunk.com/cve/eonweb_include_function.html; http://www.sstrunk.com/cve/eonweb_include_function.html
CVE: CVE-2017-14403
Published: 2017-09-13
Description: The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.sstrunk.com/cve/eonweb_module_admin_group_search.html; http://www.sstrunk.com/cve/eonweb_module_admin_group_search.html
CVE: CVE-2017-14404
Published: 2017-09-13
Description: The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/select_tool.php, as demonstrated by a tool_list=php://filter/ substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.sstrunk.com/cve/eonweb_module_tool_all_select_tool.html; http://www.sstrunk.com/cve/eonweb_module_tool_all_select_tool.html
CVE: CVE-2017-14405
Published: 2017-09-13
Description: The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter to module/admin_device/index.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://www.sstrunk.com/cve/eonweb_module_admin_device_index.html; http://www.sstrunk.com/cve/eonweb_module_admin_device_index.html
CVE: CVE-2017-14406
Published: 2017-09-13
Description: A NULL pointer dereference was discovered in sync_buffer in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/09/08/mp3gain-null-pointer-dereference-in-sync_buffer-mpglibdblinterface-c/; https://blogs.gentoo.org/ago/2017/09/08/mp3gain-null-pointer-dereference-in-sync_buffer-mpglibdblinterface-c/
CVE: CVE-2017-14407
Published: 2017-09-13
Description: A stack-based buffer over-read was discovered in filterYule in gain_analysis.c in MP3Gain version 1.5.2. The vulnerability causes an application crash, which leads to remote denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/09/08/mp3gain-stack-based-buffer-overflow-in-filteryule-gain_analysis-c/; https://blogs.gentoo.org/ago/2017/09/08/mp3gain-stack-based-buffer-overflow-in-filteryule-gain_analysis-c/
CVE: CVE-2017-14408
Published: 2017-09-13
Description: A stack-based buffer over-read was discovered in dct36 in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an application crash, which leads to remote denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/09/08/mp3gain-stack-based-buffer-overflow-in-dct36-mpglibdbllayer3-c/; https://blogs.gentoo.org/ago/2017/09/08/mp3gain-stack-based-buffer-overflow-in-dct36-mpglibdbllayer3-c/
CVE: CVE-2017-14409
Published: 2017-09-13
Description: A buffer overflow was discovered in III_dequantize_sample in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://blogs.gentoo.org/ago/2017/09/08/mp3gain-global-buffer-overflow-in-iii_dequantize_sample-mpglibdbllayer3-c/; https://blogs.gentoo.org/ago/2017/09/08/mp3gain-global-buffer-overflow-in-iii_dequantize_sample-mpglibdbllayer3-c/
CVE: CVE-2017-14410
Published: 2017-09-13
Description: A buffer over-read was discovered in III_i_stereo in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an application crash, which leads to remote denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/09/08/mp3gain-global-buffer-overflow-in-iii_i_stereo-mpglibdbllayer3-c/; https://blogs.gentoo.org/ago/2017/09/08/mp3gain-global-buffer-overflow-in-iii_i_stereo-mpglibdbllayer3-c/
CVE: CVE-2017-14411
Published: 2017-09-13
Description: A stack-based buffer overflow was discovered in copy_mp in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an out-of-bounds write, which leads to remote denial of service or possibly code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://blogs.gentoo.org/ago/2017/09/08/mp3gain-stack-based-buffer-overflow-in-copy_mp-mpglibdblinterface-c/; https://blogs.gentoo.org/ago/2017/09/08/mp3gain-stack-based-buffer-overflow-in-copy_mp-mpglibdblinterface-c/
CVE: CVE-2017-14412
Published: 2017-09-13
Description: An invalid memory write was discovered in copy_mp in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes a denial of service (segmentation fault and application crash) or possibly unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://blogs.gentoo.org/ago/2017/09/08/mp3gain-invalid-memory-write-in-copy_mp-mpglibdblinterface-c/; https://blogs.gentoo.org/ago/2017/09/08/mp3gain-invalid-memory-write-in-copy_mp-mpglibdblinterface-c/
CVE: CVE-2017-11350
Published: 2017-09-13
Description: Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-axesstel.html; https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-axesstel.html
CVE: CVE-2017-11351
Published: 2017-09-13
Description: Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-axesstel.html; https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-axesstel.html
CVE: CVE-2017-13724
Published: 2017-09-13
Description: On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-axesstel.html; https://iscouncil.blogspot.com/2017/08/multiple-vulnerabilities-in-axesstel.html
CVE: CVE-2017-14398
Published: 2017-09-13
Description: rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://twitter.com/FuzzySec/status/[PII_REDACTED]19256832; https://twitter.com/FuzzySec/status/[PII_REDACTED]19256832
CVE: CVE-2017-6007
Published: 2017-09-13
Description: A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to crash the OS via a malformed IOCTL call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7/; https://www.nuitduhack.com/fr/planning/talk_10; https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7/