deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-8968
Published: 2017-02-15
Description: IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998515.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21998515; http://www.securityfocus.com/bid/96282; http://www.securitytracker.com/id/1037820
CVE: CVE-2016-8972
Published: 2017-02-15
Description: IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the bellmail client. IBM APARs: IV91006, IV91007, IV91008, IV91010, IV91011.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/bellmail_advisory.asc; http://www.securityfocus.com/bid/94979; http://www.securitytracker.com/id/1037480
CVE: CVE-2016-9010
Published: 2017-02-15
Description: IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM Reference #: 1997906.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-254
References: http://www.ibm.com/support/docview.wss?uid=swg21997906; http://www.securityfocus.com/bid/96279; http://www.ibm.com/support/docview.wss?uid=swg21997906
CVE: CVE-2016-9560
Published: 2017-02-15
Description: Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3785; http://www.openwall.com/lists/oss-security/2016/11/20/1; http://www.openwall.com/lists/oss-security/2016/11/23/5
CVE: CVE-2016-9706
Published: 2017-02-15
Description: IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997918.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg21997918; http://www.securityfocus.com/bid/96274; http://www.ibm.com/support/docview.wss?uid=swg21997918
CVE: CVE-2017-5896
Published: 2017-02-15
Description: Heap-based buffer overflow in the fz_subsample_pixmap function in fitz/pixmap.c in MuPDF 1.10a allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://git.ghostscript.com/?p=mupdf.git%3Bh=2c4e5867ee699b1081527bc6c6ea0e99a35a5c27; http://www.debian.org/security/2017/dsa-3797; http://www.openwall.com/lists/oss-security/2017/02/06/3
CVE: CVE-2017-5992
Published: 2017-02-15
Description: Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2017/02/07/5; https://bitbucket.org/openpyxl/openpyxl/commits/3b4905f428e1; https://bitbucket.org/openpyxl/openpyxl/issues/749
CVE: CVE-2017-5997
Published: 2017-02-15
Description: The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service (memory consumption and process crash) via multiple msgserver/group?group= requests with a crafted size of the group parameter, aka SAP Security Note 2358972.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://erpscan.io/advisories/erpscan-16-038-sap-message-server-http-remote-dos/; https://erpscan.io/advisories/erpscan-16-038-sap-message-server-http-remote-dos/
CVE: CVE-2017-3801
Published: 2017-02-15
Description: A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based access control (RBAC) after the Developer Menu is enabled in Cisco UCS Director. An attacker could exploit this vulnerability by enabling Developer Mode for his/her user profile with an end-user profile and then adding new catalogs with arbitrary workflow items to his/her profile. An exploit could allow an attacker to perform any actions defined by these workflow items, including actions affecting other tenants. Cisco Bug IDs: CSCvb64765.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-863
References: http://www.securityfocus.com/bid/96235; http://www.securitytracker.com/id/1037830; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-ucs
CVE: CVE-2016-7392
Published: 2017-02-15
Description: Heap-based buffer overflow in the pstoedit_suffix_table_init function in output-pstoedit.c in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted bmp image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/09/10/3; http://www.openwall.com/lists/oss-security/2016/09/12/7; http://www.securityfocus.com/bid/92907
CVE: CVE-2016-7393
Published: 2017-02-15
Description: Stack-based buffer overflow in the aac_sync function in aac_parser.c in Libav before 11.5 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/09/10/5; http://www.securityfocus.com/bid/92902; https://blogs.gentoo.org/ago/2016/08/20/libav-stack-based-buffer-overflow-in-aac_sync-aac_parser-c/
CVE: CVE-2016-7477
Published: 2017-02-15
Description: The ff_put_pixels8_xy2_mmx function in rnd_template.c in Libav 11.7 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted mp3 file.  NOTE: this issue was originally reported as involving a NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/09/21/6; http://www.securityfocus.com/bid/93042; https://blogs.gentoo.org/ago/2016/09/20/libav-null-pointer-dereference-in-ff_put_pixels8_xy2_mmx-rnd_template-c/
CVE: CVE-2016-7499
Published: 2017-02-15
Description: The sbr_make_f_master function in aacsbr.c in Libav 11.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp3 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.openwall.com/lists/oss-security/2016/09/21/9; http://www.securityfocus.com/bid/93102; https://blogs.gentoo.org/ago/2016/09/21/libav-divide-by-zero-in-sbr_make_f_master-aacsbr-c/
CVE: CVE-2016-8674
Published: 2017-02-15
Description: The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=1e03c06456d997435019fb3526fa2d4be7dbc6ec; http://www.debian.org/security/2017/dsa-3797; http://www.openwall.com/lists/oss-security/2016/10/16/8
CVE: CVE-2016-8675
Published: 2017-02-15
Description: The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file, possibly related to startcode sequences during m4v detection.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/10/16/13; http://www.securityfocus.com/bid/93468; https://blogs.gentoo.org/ago/2016/09/07/libav-null-pointer-dereference-in-get_vlc2_get_bits_h/
CVE: CVE-2016-8676
Published: 2017-02-15
Description: The get_vlc2 function in get_bits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file.  NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/10/16/13; http://www.openwall.com/lists/oss-security/2016/12/04/3; http://www.securityfocus.com/bid/93468
CVE: CVE-2016-8677
Published: 2017-02-15
Description: The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2016-10/msg00107.html; http://www.debian.org/security/2016/dsa-3726; http://www.openwall.com/lists/oss-security/2016/10/16/1
CVE: CVE-2016-8678
Published: 2017-02-15
Description: The IsPixelMonochrome function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.0 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted file.  NOTE: the vendor says "This is a Q64 issue and we do not support Q64."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/10/16/2; http://www.openwall.com/lists/oss-security/2016/12/08/18; http://www.securityfocus.com/bid/93599
CVE: CVE-2016-8679
Published: 2017-02-15
Description: The _dwarf_get_size_of_val function in libdwarf/dwarf_util.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/10/16/3; http://www.securityfocus.com/bid/93601; https://blogs.gentoo.org/ago/2016/10/06/libdwarf-heap-based-buffer-overflow-in-_dwarf_get_size_of_val-dwarf_util-c/
CVE: CVE-2016-8680
Published: 2017-02-15
Description: The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/10/16/4; http://www.securityfocus.com/bid/93595; https://blogs.gentoo.org/ago/2016/10/04/libdwarf-heap-based-buffer-overflow-in-_dwarf_get_abbrev_for_code-dwarf_util-c/
CVE: CVE-2016-8681
Published: 2017-02-15
Description: The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/10/16/5; http://www.securityfocus.com/bid/93592; https://blogs.gentoo.org/ago/2016/10/06/libdwarf-heap-based-buffer-overflow-in-_dwarf_get_abbrev_for_code-dwarf_util-c-2/
CVE: CVE-2017-0308
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where untrusted input is used for buffer size calculation leading to denial of service or escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0309
Published: 2017-02-15
Description: All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory allocation leading to a denial of service or potential escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0310
Published: 2017-02-15
Description: All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0311
Published: 2017-02-15
Description: NVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler where improper access control may lead to denial of service or possible escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0312
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where user provided input is used as the limit for a loop may lead to denial of service or potential escalation of privileges
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; https://www.exploit-db.com/exploits/41364/; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0313
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI (DxgkDdiSubmitCommandVirtual) where untrusted input is used to reference memory outside of the intended boundary of the buffer leading to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; https://www.exploit-db.com/exploits/41365/; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0314
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI (DxgkDdiSubmitCommandVirtual) where untrusted input is used to reference memory outside of the intended boundary of the buffer leading to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0315
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an attempt to access an invalid object pointer may lead to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0317
Published: 2017-02-15
Description: All versions of NVIDIA GPU and GeForce Experience installer contain a vulnerability where it fails to set proper permissions on the package extraction path thus allowing a non-privileged user to tamper with the extracted files, potentially leading to escalation of privileges via code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0318
Published: 2017-02-15
Description: All versions of NVIDIA Linux GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper validation of an input parameter may cause a denial of service on the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0319
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper handling of values may cause a denial of service on the system.
CVSS Score: 5.5 (MEDIUM)
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0320
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper handling of values may cause a denial of service on the system.
CVSS Score: 5.5 (MEDIUM)
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0321
Published: 2017-02-15
Description: All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0322
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a value passed from a user to the driver is not correctly validated and used as the index to an array, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0323
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-0324
Published: 2017-02-15
Description: All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4398; http://nvidia.custhelp.com/app/answers/detail/a_id/4398
CVE: CVE-2017-6004
Published: 2017-02-16
Description: The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96295; http://www.securitytracker.com/id/1037850; https://access.redhat.com/errata/RHSA-2018:2486
CVE: CVE-2017-6009
Published: 2017-02-16
Description: An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in the "restable.c" source file. This is happening because the "len" parameter for memcpy is not checked for size and thus becomes a negative integer in the process, resulting in a failed memcpy. This affects wrestool.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0837.html; http://www.debian.org/security/2017/dsa-3807; http://www.securityfocus.com/bid/96292
CVE: CVE-2017-6010
Published: 2017-02-16
Description: An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0837.html; http://www.debian.org/security/2017/dsa-3807; http://www.securityfocus.com/bid/96288
CVE: CVE-2017-6011
Published: 2017-02-16
Description: An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" source file. This affects icotool.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://rhn.redhat.com/errata/RHSA-2017-0837.html; http://www.debian.org/security/2017/dsa-3807; http://www.securityfocus.com/bid/96267
CVE: CVE-2016-7293
Published: 2017-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue in a "generally available" software product.  Notes: none
CVE: CVE-2017-6000
Published: 2017-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2016-5919
Published: 2017-02-16
Description: IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM Reference #: 1996868.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=swg21996868; http://www.securitytracker.com/id/1037855; http://www.ibm.com/support/docview.wss?uid=swg21996868
CVE: CVE-2016-6062
Published: 2017-02-16
Description: IBM Resilient v26.0, v26.1, and v26.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference#: 213457065.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94268; https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-resilient-cross-site-scripting-vulnerability-cve-2016-6062/; http://www.securityfocus.com/bid/94268
CVE: CVE-2016-10134
Published: 2017-02-17
Description: SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.debian.org/security/2017/dsa-3802; http://www.openwall.com/lists/oss-security/2017/01/12/4; http://www.openwall.com/lists/oss-security/2017/01/13/4
CVE: CVE-2016-1249
Published: 2017-02-17
Description: The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes; http://www.openwall.com/lists/oss-security/2016/11/16/1; http://www.securityfocus.com/bid/94350
CVE: CVE-2016-4311
Published: 2017-02-17
Description: Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt; http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html; http://www.securityfocus.com/archive/1/539199/100/0/threaded