deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-15973
Published: 2017-10-29
Description: Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/144443/Sokial-Social-Network-Script-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/43086/; https://packetstormsecurity.com/files/144443/Sokial-Social-Network-Script-1.0-SQL-Injection.html
CVE: CVE-2017-15974
Published: 2017-10-29
Description: tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/144444/tPanel-2009-SQL-Injection.html; https://www.exploit-db.com/exploits/43085/; https://packetstormsecurity.com/files/144444/tPanel-2009-SQL-Injection.html
CVE: CVE-2017-15975
Published: 2017-10-29
Description: Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/144445/Vastal-I-Tech-Dating-Zone-0.9.9-SQL-Injection.html; https://www.exploit-db.com/exploits/43084/; https://packetstormsecurity.com/files/144445/Vastal-I-Tech-Dating-Zone-0.9.9-SQL-Injection.html
CVE: CVE-2017-15976
Published: 2017-10-29
Description: ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/144446/ZeeBuddy-2x-SQL-Injection.html; https://www.exploit-db.com/exploits/43083/; https://packetstormsecurity.com/files/144446/ZeeBuddy-2x-SQL-Injection.html
CVE: CVE-2017-15994
Published: 2017-10-29
Description: rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-354
References: https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=7b8a4ecd6ff9cdf4e5d3850ebf822f1e989255b3; https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=9a480deec4d20277d8e20bc55515ef0640ca1e55; https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=c252546ceeb0925eb8a4061315e3ff0a8c55b48b
CVE: CVE-2017-15996
Published: 2017-10-29
Description: elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101608; https://security.gentoo.org/glsa/201801-01; https://sourceware.org/bugzilla/show_bug.cgi?id=22361
CVE: CVE-2017-15997
Published: 2017-10-29
Description: In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-327
References: https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html; https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html
CVE: CVE-2017-15998
Published: 2017-10-29
Description: In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html; https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html
CVE: CVE-2017-15999
Published: 2017-10-29
Description: In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash value is required.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html; https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html
CVE: CVE-2017-16000
Published: 2017-10-29
Description: SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jsj730sos/cve/blob/master/Eonweb_module_capacity_per_label_index.php-SQL%20injection%20vulnerability; https://github.com/jsj730sos/cve/blob/master/Eonweb_module_capacity_per_label_index.php-SQL%20injection%20vulnerability
CVE: CVE-2017-16227
Published: 2017-10-29
Description: The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://download.savannah.gnu.org/releases/quagga/quagga-1.2.2.changelog.txt; http://www.debian.org/security/2017/dsa-4011; https://bugs.debian.org/879474
CVE: CVE-2017-16228
Published: 2017-10-29
Description: Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2[PII_REDACTED], and CVE-2[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
References: https://tracker.debian.org/news/882440; https://www.dulwich.io/code/dulwich/; https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
CVE: CVE-2012-5357
Published: 2017-10-30
Description: Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm; https://technet.microsoft.com/library/security/msvr12-016; https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/
CVE: CVE-2012-5358
Published: 2017-10-30
Description: The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or possibly have unspecified other impact via crafted XSL data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm; https://technet.microsoft.com/library/security/msvr12-016; https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/
CVE: CVE-2013-4246
Published: 2017-10-30
Description: libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service or obtain sensitive information by editing packed revision properties.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/101620; https://subversion.apache.org/security/CVE-2013-4246-advisory.txt; http://www.securityfocus.com/bid/101620
CVE: CVE-2014-3526
Published: 2017-10-30
Description: Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html; https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html
CVE: CVE-2014-3624
Published: 2017-10-30
Description: Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://mail-archives.apache.org/mod_mbox/www-announce/201411.mbox/%3C[PII_REDACTED]1749.2E3561043F%40minotaur.apache.org%3E; http://www.securityfocus.com/bid/101630; https://issues.apache.org/jira/browse/TS-2677
CVE: CVE-2015-0224
Published: 2017-10-30
Description: qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178606.html; http://mail-archives.apache.org/mod_mbox/www-announce/201501.mbox/%3C54C60[PII_REDACTED]%40apache.org%3E; http://packetstormsecurity.com/files/130105/Apache-Qpid-0.30-Crash.html
CVE: CVE-2015-0226
Published: 2017-10-30
Description: Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://rhn.redhat.com/errata/RHSA-2015-0846.html; http://rhn.redhat.com/errata/RHSA-2015-0847.html; http://rhn.redhat.com/errata/RHSA-2015-0848.html
CVE: CVE-2015-3249
Published: 2017-10-30
Description: The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201507.mbox/%3CCABF6JR37mWzDmXDqRQwRUXiojBZrhidndnsY1ZgmcZv-o7-a+g%40mail.gmail.com%3E; http://www.securityfocus.com/bid/101631; https://yahoo-security.tumblr.com/post/[PII_REDACTED]0/apache-traffic-server-http2-fuzzing
CVE: CVE-2015-7549
Published: 2017-10-30
Description: The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure to define the .write method.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-476
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=43b11a91dd861a946b231b89b754285; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175380.html; http://www.debian.org/security/2016/dsa-3471
CVE: CVE-2016-3090
Published: 2017-10-30
Description: The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/85131; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://struts.apache.org/docs/s2-027.html
CVE: CVE-2017-12460
Published: 2017-10-30
Description: An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10.  An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product.  By uploading a wallpaper with a specially crafted name, an HTML injection can be triggered as special characters are not neutralized before output.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.barco.com/en/Support/software/R33050037; https://www.barco.com/en/support/knowledge-base/KB5169; https://www.barco.com/en/support/software/R33050020
CVE: CVE-2017-15597
Published: 2017-10-30
Description: An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code, however, did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain, the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119, CWE-200
References: http://www.openwall.com/lists/oss-security/2017/10/24/3; http://www.securityfocus.com/bid/101564; http://www.securitytracker.com/id/1039653
CVE: CVE-2017-7411
Published: 2017-10-30
Description: An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into the application scope, allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://karmainsecurity.com/KIS-2017-02; http://packetstormsecurity.com/files/144716/Tuleap-9.6-Second-Order-PHP-Object-Injection.html; http://seclists.org/fulldisclosure/2017/Oct/53
CVE: CVE-2017-9377
Published: 2017-10-30
Description: A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0.10. An attacker with access to the product's web API can exploit this vulnerability to completely compromise the vulnerable device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/101617; https://www.barco.com/en/Support/software/R33050037; https://www.barco.com/en/support/software/R33050020
CVE: CVE-2017-9450
Published: 2017-10-30
Description: The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/99972; https://alas.aws.amazon.com/ALAS-2017-861.html; https://sintonen.fi/advisories/aws-cfn-bootstrap-local-code-execution-as-root.txt
CVE: CVE-2017-15920
Published: 2017-10-30
Description: In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnerability that gets triggered when sending an operation to ioctl 0x80002054. This is due to the input buffer being NULL or the input buffer size being 0 as they are not validated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://packetstormsecurity.com/files/144786/Watchdog-Development-Anti-Malware-Online-Security-Pro-NULL-Pointer-Dereference.html; https://www.exploit-db.com/exploits/43058/; http://packetstormsecurity.com/files/144786/Watchdog-Development-Anti-Malware-Online-Security-Pro-NULL-Pointer-Dereference.html
CVE: CVE-2017-15921
Published: 2017-10-30
Description: In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnerability that gets triggered when sending an operation to ioctl 0x80002010. This is due to the input buffer being NULL or the input buffer size being 0 as they are not validated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://packetstormsecurity.com/files/144786/Watchdog-Development-Anti-Malware-Online-Security-Pro-NULL-Pointer-Dereference.html; https://www.exploit-db.com/exploits/43058/; http://packetstormsecurity.com/files/144786/Watchdog-Development-Anti-Malware-Online-Security-Pro-NULL-Pointer-Dereference.html
CVE: CVE-2009-1197
Published: 2017-10-30
Description: Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://issues.apache.org/jira/browse/JUDDI-220; http://marc.info/?l=juddi-dev&m=[PII_REDACTED]4010&w=2; http://www.securityfocus.com/bid/101625
CVE: CVE-2009-1198
Published: 2017-10-30
Description: Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the dsname parameter to happyjuddi.jsp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://issues.apache.org/jira/browse/JUDDI-221; http://marc.info/?l=juddi-dev&m=[PII_REDACTED]4010&w=2; http://www.securityfocus.com/bid/101623
CVE: CVE-2012-0881
Published: 2017-10-30
Description: Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2014/07/08/11; https://bugzilla.redhat.com/show_bug.cgi?id=787104; https://issues.apache.org/jira/browse/XERCESJ-1685
CVE: CVE-2014-0115
Published: 2017-10-30
Description: Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://issues.apache.org/jira/browse/STORM-269; https://mail-archives.apache.org/mod_mbox/storm-dev/201404.mbox/%3CJIRA.12[PII_REDACTED]964[PII_REDACTED]6[PII_REDACTED]645%40arcas%3E; https://issues.apache.org/jira/browse/STORM-269
CVE: CVE-2017-15888
Published: 2017-10-30
Description: Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inject arbitrary web script or HTML via the NAME parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/en-global/support/security/Synology_SA_17_61_Audio_Station; https://www.synology.com/en-global/support/security/Synology_SA_17_61_Audio_Station
CVE: CVE-2012-4449
Published: 2017-10-30
Description: Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: http://mail-archives.apache.org/mod_mbox/hadoop-general/201210.mbox/%3CCA+z3+9FYdPmzBEaMZ71SUqzRx=eU=o4mSHUsbrpzgR9X_F1c0Q%40mail.gmail.com%3E; https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0; http://mail-archives.apache.org/mod_mbox/hadoop-general/201210.mbox/%3CCA+z3+9FYdPmzBEaMZ71SUqzRx=eU=o4mSHUsbrpzgR9X_F1c0Q%40mail.gmail.com%3E
CVE: CVE-2012-5636
Published: 2017-10-30
Description: Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script> tags in a rendered response.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101644; https://wicket.apache.org/news/2013/03/03/cve-2012-5636.html; http://www.securityfocus.com/bid/101644
CVE: CVE-2013-4366
Published: 2017-10-30
Description: http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://svn.apache.org/r1528614; http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt; http://svn.apache.org/r1528614
CVE: CVE-2014-0072
Published: 2017-10-30
Description: ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://d3adend.org/blog/?p=403; http://seclists.org/fulldisclosure/2014/Mar/29; http://www.securityfocus.com/archive/1/531335/100/0/threaded
CVE: CVE-2014-0073
Published: 2017-10-30
Description: The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://d3adend.org/blog/?p=403; http://seclists.org/fulldisclosure/2014/Mar/30; http://www.securityfocus.com/archive/1/531334/100/0/threaded
CVE: CVE-2017-14919
Published: 2017-10-30
Description: Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101881; https://nodejs.org/en/blog/release/v4.8.5/; https://nodejs.org/en/blog/release/v6.11.5/
CVE: CVE-2017-16230
Published: 2017-10-30
Description: In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/SQYY/CVE/blob/master/Typecho.txt; https://github.com/SQYY/CVE/blob/master/Typecho.txt
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-30
Description: On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/101264; https://access.redhat.com/errata/RHSA-2018:0654; https://access.redhat.com/security/cve/CVE-2[PII_REDACTED]