deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7568
Published: 2017-04-24
Description: SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html; http://seclists.org/fulldisclosure/2016/Feb/44; http://www.securityfocus.com/archive/1/537493/100/0/threaded
CVE: CVE-2015-7569
Published: 2017-04-24
Description: SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary SQL commands via the "pagedir_orderby" parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html; http://seclists.org/fulldisclosure/2016/Feb/44; http://www.securityfocus.com/archive/1/537493/100/0/threaded
CVE: CVE-2015-7570
Published: 2017-04-24
Description: Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports via the dbhost parameter to libs/org/adodb_lite/tests/test_adodb_lite.php, libs/org/adodb_lite/tests/test_datadictionary.php, or libs/org/adodb_lite/tests/test_adodb_lite_sessions.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html; http://seclists.org/fulldisclosure/2016/Feb/44; http://www.securityfocus.com/archive/1/537493/100/0/threaded
CVE: CVE-2015-7572
Published: 2017-04-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0237. Reason: This candidate is a duplicate of CVE-2013-0237. Notes: All CVE users should reference CVE-2013-0237 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-3076
Published: 2017-04-24
Description: Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html; http://www.securityfocus.com/bid/98042; https://bugzilla.redhat.com/show_bug.cgi?id=1321929
CVE: CVE-2016-3114
Published: 2017-04-24
Description: Kallithea before 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2016/05/02/3; http://www.openwall.com/lists/oss-security/2016/05/02/3
CVE: CVE-2016-3691
Published: 2017-04-24
Description: Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2016/05/02/3; http://www.openwall.com/lists/oss-security/2016/05/02/3
CVE: CVE-2016-4313
Published: 2017-04-24
Description: Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://hyp3rlinx.altervista.org/advisories/EXTPLORER-ARCHIVE-PATH-TRAVERSAL.txt; http://packetstormsecurity.com/files/137031/eXtplorer-2.1.9-Path-Traversal.html; http://www.securityfocus.com/archive/1/538386/100/0/threaded
CVE: CVE-2017-2322
Published: 2017-04-24
Description: A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1, may allow an authenticated user to cause widespread denials of service to system services by consuming TCP and UDP ports which are normally reserved for other system services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/97613; https://kb.juniper.net/JSA10783; http://www.securityfocus.com/bid/97613
CVE: CVE-2017-5191
Published: 2017-04-24
Description: An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98093; https://www.novell.com/support/kb/doc.php?id=7018793; http://www.securityfocus.com/bid/98093
CVE: CVE-2017-7723
Published: 2017-04-24
Description: XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/easy-wp-smtp/#developers; https://wordpress.org/plugins/easy-wp-smtp/#developers
CVE: CVE-2017-8098
Published: 2017-04-24
Description: e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2017/Apr/40; https://github.com/e107inc/e107/commit/7a3e3d9fc7e05ce6941b9af1c14010bf2141f1a5; http://seclists.org/fulldisclosure/2017/Apr/40
CVE: CVE-2017-8099
Published: 2017-04-24
Description: There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2017/Apr/41; https://plugins.trac.wordpress.org/browser/whizz/trunk/change_log.txt; http://seclists.org/fulldisclosure/2017/Apr/41
CVE: CVE-2017-8100
Published: 2017-04-24
Description: There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2017/Apr/42; http://www.securityfocus.com/bid/98091; https://wordpress.org/plugins/wp-copysafe-web/#developers
CVE: CVE-2017-8101
Published: 2017-04-24
Description: There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2017/Apr/52; https://github.com/s9y/Serendipity/issues/452; http://seclists.org/fulldisclosure/2017/Apr/52
CVE: CVE-2017-8102
Published: 2017-04-24
Description: Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Apr/44; https://github.com/s9y/Serendipity/issues/456; http://seclists.org/fulldisclosure/2017/Apr/44
CVE: CVE-2017-8103
Published: 2017-04-24
Description: In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Apr/53; https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/; http://seclists.org/fulldisclosure/2017/Apr/53
CVE: CVE-2017-8104
Published: 2017-04-24
Description: In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2017/Apr/55; http://www.securityfocus.com/bid/98045; https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/
CVE: CVE-2017-8105
Published: 2017-04-24
Description: FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48ee431bef8d4d466b40c9cb2d4dbcb7791; http://www.debian.org/security/2017/dsa-3839; http://www.securityfocus.com/bid/99093
CVE: CVE-2010-1776
Published: 2017-04-24
Description: Find My iPhone on iOS 2.0 through 3.1.3 for iPhone 3G and later and iOS 2.1 through 3.1.3 for iPod touch (2nd generation) and later, when Find My iPhone is disabled, allows remote authenticated users with an associated MobileMe account to wipe the device.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-254
References: https://support.apple.com/en-us/HT4225; https://support.apple.com/en-us/HT4225
CVE: CVE-2011-3428
Published: 2017-04-24
Description: Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/en-us/HT5016; https://support.apple.com/en-us/HT5016
CVE: CVE-2011-3438
Published: 2017-04-24
Description: WebKit, as used in Safari 5.0.6, allows remote attackers to cause a denial of service (process crash) or arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://support.apple.com/kb/HT4808; http://support.apple.com/kb/HT4808
CVE: CVE-2016-5016
Published: 2017-04-24
Description: Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/cloudfoundry/cf-release/releases/tag/v240; https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3; https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
CVE: CVE-2016-5551
Published: 2017-04-24
Description: Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: NAS device addition). The supported version that is affected is 4.3. Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris Cluster executes to compromise Solaris Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris Cluster accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
CVSS Score: 2.8 (LOW)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97803; http://www.securitytracker.com/id/1038292
CVE: CVE-2016-6902
Published: 2017-04-24
Description: lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2016/08/22/17; http://www.securityfocus.com/bid/92591; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834949
CVE: CVE-2016-6903
Published: 2017-04-24
Description: lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2016/08/22/17; http://www.securityfocus.com/bid/92591; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834946
CVE: CVE-2016-6916
Published: 2017-04-24
Description: Integer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA 1.5 allows local users to cause a denial of service (system crash) via unspecified vectors, which triggers a buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://www.securityfocus.com/bid/94667; https://nvidia.custhelp.com/app/answers/detail/a_id/4276/~/security-bulletin%3A-nvidia-shield-contains-multiple-vulnerabilities-in
CVE: CVE-2016-6917
Published: 2017-04-24
Description: Buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA 1.5.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://www.securityfocus.com/bid/94667; https://nvidia.custhelp.com/app/answers/detail/a_id/4276/~/security-bulletin%3A-nvidia-shield-contains-multiple-vulnerabilities-in
CVE: CVE-2017-3230
Published: 2017-04-24
Description: Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported versions that are affected are 11.1.1.9, 12.2.1.1 and 12.2.1.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Fusion Middleware MapViewer accessible data as well as unauthorized read access to a subset of Oracle Fusion Middleware MapViewer accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Fusion Middleware MapViewer. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).
CVSS Score: 8.6 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97746; http://www.securitytracker.com/id/1038291
CVE: CVE-2017-3232
Published: 2017-04-24
Description: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 5.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97806; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3233
Published: 2017-04-24
Description: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Automatic Service Request (ASR) accessible data. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS Score: 7.5 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97799; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3234
Published: 2017-04-24
Description: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via SFT to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in takeover of Automatic Service Request (ASR). CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97794; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3237
Published: 2017-04-24
Description: Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Automatic Service Request (ASR) executes to compromise Automatic Service Request (ASR). Successful attacks of this vulnerability can result in takeover of Automatic Service Request (ASR). CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.8 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97789; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3254
Published: 2017-04-24
Description: Vulnerability in the Oracle Retail Invoice Matching component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 12.0 and 13.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Invoice Matching. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Invoice Matching accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Invoice Matching accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Invoice Matching. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L).
CVSS Score: 7.6 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97756; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3288
Published: 2017-04-24
Description: Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Unit Trust). Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Investor Servicing accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Investor Servicing accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97795; http://www.securitytracker.com/id/1038304
CVE: CVE-2017-3304
Published: 2017-04-24
Description: Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: DD). Supported versions that are affected are 7.2.27 and earlier, 7.3.16 and earlier, 7.4.14 and earlier and 7.5.5 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
CVSS Score: 5.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97815; http://www.securitytracker.com/id/1038287
CVE: CVE-2017-3305
Published: 2017-04-24
Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6.35 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). NOTE: the previous information is from the April 2017 CPU. Oracle has not commented on third-party claims that this issue allows man-in-the-middle attackers to hijack the authentication of users by leveraging incorrect ordering of security parameter verification in a client, aka, "The Riddle".
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://riddle.link/; http://www.debian.org/security/2017/dsa-3834; http://www.openwall.com/lists/oss-security/2017/03/17/3
CVE: CVE-2017-3306
Published: 2017-04-24
Description: Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server). Supported versions that are affected are 3.1.6.8003 and earlier, 3.2.1182 and earlier and 3.3.2.1162 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Enterprise Monitor, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Enterprise Monitor accessible data as well as unauthorized access to critical data or complete access to all MySQL Enterprise Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Enterprise Monitor. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L).
CVSS Score: 8.3 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97724; http://www.securitytracker.com/id/1038287
CVE: CVE-2017-3307
Published: 2017-04-24
Description: Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server). Supported versions that are affected are 3.1.6.8003 and earlier, 3.2.1182 and earlier and 3.3.2.1162 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Enterprise Monitor accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Enterprise Monitor. CVSS 3.0 Base Score 3.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L).
CVSS Score: 3.1 (LOW)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/97844; http://www.securitytracker.com/id/1038287