deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-15911
Published: 2017-10-26
Description: The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html; https://issues.igniterealtime.org/browse/OF-1417; https://becomepentester.blogspot.ae/2017/10/Cross-Site-Scripting-Openfire-4.1.6-CVE-2017-15911.html
CVE: CVE-2017-15917
Published: 2017-10-26
Description: In Paessler PRTG Network Monitor 17.3.33.2830, it's possible to create a Map as a read-only user, by forging a request and sending it to the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://medium.com/stolabs/security-issue-on-prtg-network-manager-ada65b45d37b; https://medium.com/stolabs/security-issue-on-prtg-network-manager-ada65b45d37b
CVE: CVE-2017-3771
Published: 2017-10-26
Description: System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without completing BIOS/UEFI initialization process.
CVSS Score: 7.5 (HIGH)
References: https://support.lenovo.com/us/en/product_security/LEN-17417; https://support.lenovo.com/us/en/product_security/LEN-17417
CVE: CVE-2017-15919
Published: 2017-10-26
Description: The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/101604; https://wordpress.org/plugins/ultimate-form-builder-lite/#developers; https://wpvulndb.com/vulnerabilities/8935
CVE: CVE-2017-15922
Published: 2017-10-26
Description: In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00008.html; http://www.securityfocus.com/bid/101595; https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
CVE: CVE-2017-5996
Published: 2017-10-26
Description: The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijacking because of weak %SYSTEMDRIVE%\ProgramData permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securitytracker.com/id/1039679; https://www.vsecurity.com/download/advisories/20171026-1.txt; http://www.securitytracker.com/id/1039679
CVE: CVE-2012-1622
Published: 2017-10-26
Description: Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://mail-archives.apache.org/mod_mbox/ofbiz-user/201204.mbox/%3C4F378887-E697-44E7-976C-48B9B7475C4D%40apache.org%3E; http://ofbiz.apache.org/download.html#security; http://mail-archives.apache.org/mod_mbox/ofbiz-user/201204.mbox/%3C4F378887-E697-44E7-976C-48B9B7475C4D%40apache.org%3E
CVE: CVE-2012-4377
Published: 2017-10-26
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/08/31/10; http://www.openwall.com/lists/oss-security/2012/08/31/6; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
CVE: CVE-2012-4378
Published: 2017-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/08/31/10; http://www.openwall.com/lists/oss-security/2012/08/31/6; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
CVE: CVE-2014-2023
Published: 2017-10-26
Description: Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to (1) unsubscribe_forum.php or (2) unsubscribe_topic.php in mobiquo/functions/.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128854/vBulletin-4.x-Tapatalk-Blind-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Oct/57; http://www.exploit-db.com/exploits/35102
CVE: CVE-2017-15366
Published: 2017-10-26
Description: Before Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache) users set up with a single password. This password is left behind in a cleartext log file during client installation on laptops. This password can be used to gain full admin/system access to client devices (if no firewall is present) or the NDoc server itself. Once the password is known to an attacker, local access is not required.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: https://gist.github.com/emptythevoid/84248daccce8737f1cdd5b395cf6f32c; https://gist.github.com/emptythevoid/84248daccce8737f1cdd5b395cf6f32c
CVE: CVE-2017-1220
Published: 2017-10-26
Description: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 123860.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22009673; http://www.securityfocus.com/bid/101571; https://exchange.xforce.ibmcloud.com/vulnerabilities/123860
CVE: CVE-2017-1222
Published: 2017-10-26
Description: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=swg22009673; http://www.securityfocus.com/bid/101571; https://exchange.xforce.ibmcloud.com/vulnerabilities/123862
CVE: CVE-2017-1225
Published: 2017-10-26
Description: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 123904.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22009673; http://www.securityfocus.com/bid/101571; https://exchange.xforce.ibmcloud.com/vulnerabilities/123904
CVE: CVE-2017-1226
Published: 2017-10-26
Description: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) generates an error message in error logs that includes sensitive information about its environment which could be used in further attacks against the system. IBM X-Force ID: 123905.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22009673; http://www.securityfocus.com/bid/101571; https://exchange.xforce.ibmcloud.com/vulnerabilities/123905
CVE: CVE-2017-1228
Published: 2017-10-26
Description: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable the secure cookie attribute. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 123907.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22009673; http://www.securityfocus.com/bid/101571; https://exchange.xforce.ibmcloud.com/vulnerabilities/123907
CVE: CVE-2017-1230
Published: 2017-10-26
Description: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. This weakness may allow attackers to expose sensitive information by guessing tokens or identifiers. IBM X-Force ID: 123909.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22009673; http://www.securityfocus.com/bid/101571; https://exchange.xforce.ibmcloud.com/vulnerabilities/123909
CVE: CVE-2017-1232
Published: 2017-10-26
Description: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 123911.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: http://www.ibm.com/support/docview.wss?uid=swg22009673; http://www.securityfocus.com/bid/101571; https://exchange.xforce.ibmcloud.com/vulnerabilities/123911
CVE: CVE-2017-1521
Published: 2017-10-26
Description: IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129831.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22009673; http://www.securityfocus.com/bid/101571; https://exchange.xforce.ibmcloud.com/vulnerabilities/129831
CVE: CVE-2017-5052
Published: 2017-10-27
Description: An incorrect assumption about block structure in Blink in Google Chrome prior to 57.0.2987.133 for Mac, Windows, and Linux, and 57.0.2987.132 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97220; https://access.redhat.com/errata/RHSA-2017:0860; https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html
CVE: CVE-2017-5053
Published: 2017-10-27
Description: An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97220; http://zerodayinitiative.com/advisories/ZDI-17-462/; https://access.redhat.com/errata/RHSA-2017:0860
CVE: CVE-2017-5054
Published: 2017-10-27
Description: An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to obtain heap memory contents via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97220; https://access.redhat.com/errata/RHSA-2017:0860; https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html
CVE: CVE-2017-5055
Published: 2017-10-27
Description: A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-416
References: http://www.securityfocus.com/bid/97221; https://access.redhat.com/errata/RHSA-2017:0860; https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html
CVE: CVE-2017-5056
Published: 2017-10-27
Description: A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/97220; http://www.securitytracker.com/id/1038623; https://access.redhat.com/errata/RHSA-2017:0860
CVE: CVE-2017-5057
Published: 2017-10-27
Description: Type confusion in PDFium in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5058
Published: 2017-10-27
Description: A use after free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5059
Published: 2017-10-27
Description: Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5060
Published: 2017-10-27
Description: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5061
Published: 2017-10-27
Description: A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5062
Published: 2017-10-27
Description: A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to potentially perform out of bounds memory access via a crafted Chrome extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5063
Published: 2017-10-27
Description: A numeric overflow in Skia in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5064
Published: 2017-10-27
Description: Incorrect handling of DOM changes in Blink in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5065
Published: 2017-10-27
Description: Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially confuse a user into making an incorrect security decision via a crafted HTML page.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5066
Published: 2017-10-27
Description: Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to incorrectly accept a badly formed X.509 certificate via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5067
Published: 2017-10-27
Description: An insufficient watchdog timer in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5068
Published: 2017-10-27
Description: Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/98288; https://access.redhat.com/errata/RHSA-2017:1228; https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html
CVE: CVE-2017-5069
Published: 2017-10-27
Description: Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97939; http://www.securitytracker.com/id/1038317; https://access.redhat.com/errata/RHSA-2017:1124
CVE: CVE-2017-5070
Published: 2017-10-27
Description: Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5071
Published: 2017-10-27
Description: Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5072
Published: 2017-10-27
Description: Inappropriate implementation in Omnibox in Google Chrome prior to 59.0.3071.92 for Android allowed a remote attacker to perform domain spoofing with RTL characters via a crafted URL page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5073
Published: 2017-10-27
Description: Use after free in print preview in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5074
Published: 2017-10-27
Description: A use after free in Chrome Apps in Google Chrome prior to 59.0.3071.86 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, related to Bluetooth.
CVSS Score: 8.0 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5075
Published: 2017-10-27
Description: Inappropriate implementation in CSP reporting in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to obtain the value of url fragments via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5076
Published: 2017-10-27
Description: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5077
Published: 2017-10-27
Description: Insufficient validation of untrusted input in Skia in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5078
Published: 2017-10-27
Description: Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5079
Published: 2017-10-27
Description: Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5080
Published: 2017-10-27
Description: A use after free in credit card autofill in Google Chrome prior to 59.0.3071.86 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5081
Published: 2017-10-27
Description: Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed an attacker with local write access to modify extensions by modifying extension files.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5082
Published: 2017-10-27
Description: Failure to take advantage of available mitigations in credit card autofill in Google Chrome prior to 59.0.3071.92 for Android allowed a local attacker to take screen shots of credit card information via a crafted HTML page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399