deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7359
Published: 2017-10-03
Description: The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html; http://www.openwall.com/lists/oss-security/2015/09/22/7; http://www.openwall.com/lists/oss-security/2015/09/24/3
CVE: CVE-2015-7841
Published: 2017-10-03
Description: The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allows remote attackers to bypass access restrictions and enter commands via unspecified parameters, as demonstrated by a "user creation command."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.securityfocus.com/bid/76836; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454418.htm; http://www.securityfocus.com/bid/76836
CVE: CVE-2015-7843
Published: 2017-10-03
Description: The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 does not limit the number of query attempts, which allows remote authenticated users to obtain credentials of higher-level users via a brute force attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/76836; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454418.htm; http://www.securityfocus.com/bid/76836
CVE: CVE-2015-7980
Published: 2017-10-03
Description: Cross-site scripting (XSS) vulnerability in the Compass Rose module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "embedding a JavaScript library from an external source that was not reliable."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/10/24/4; http://www.openwall.com/lists/oss-security/2015/10/26/2; http://www.securityfocus.com/bid/76247
CVE: CVE-2016-6806
Published: 2017-10-03
Description: Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd%40%3Cannounce.apache.org%3E
CVE: CVE-2017-11321
Published: 2017-10-03
Description: The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admin' privileges via shell metacharacters in the less command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://sysdream.com/news/lab/2017-09-29-cve-2017-11321-ucopia-wireless-appliance-5-1-8-restricted-shell-escape/; https://www.exploit-db.com/exploits/42937/; https://sysdream.com/news/lab/2017-09-29-cve-2017-11321-ucopia-wireless-appliance-5-1-8-restricted-shell-escape/
CVE: CVE-2017-11322
Published: 2017-10-03
Description: The chroothole_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign ($) metacharacter in the argument to chroothole_client.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: https://sysdream.com/news/lab/2017-09-29-cve-2017-11322-ucopia-wireless-appliance-5-1-8-privileges-escalation/; https://www.exploit-db.com/exploits/42936/; https://sysdream.com/news/lab/2017-09-29-cve-2017-11322-ucopia-wireless-appliance-5-1-8-privileges-escalation/
CVE: CVE-2017-11496
Published: 2017-10-03
Description: Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via malformed ASN.1 streams in V2C and similar input files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102739; http://www.securityfocus.com/bid/102906; https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf
CVE: CVE-2017-11497
Published: 2017-10-03
Description: Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102739; http://www.securityfocus.com/bid/102906; https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf
CVE: CVE-2017-11498
Published: 2017-10-03
Description: Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to shut down the remote process (a denial of service) via a language pack (ZIP file) with invalid HTML files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102739; http://www.securityfocus.com/bid/102906; https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf
CVE: CVE-2017-12620
Published: 2017-10-03
Description: When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://opennlp.apache.org/news/cve-2017-12620.html; http://opennlp.apache.org/news/cve-2017-12620.html
CVE: CVE-2017-12638
Published: 2017-10-03
Description: Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETBL or ETCETERABLUE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://docs.ipswitch.com/_Messaging/IMailServer/v12.5.6/ReleaseNotes/index.htm#link8; https://docs.ipswitch.com/_Messaging/IMailServer/v12.5.6/ReleaseNotes/index.htm#link8
CVE: CVE-2017-12639
Published: 2017-10-03
Description: Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETRE or ETCTERARED.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://docs.ipswitch.com/_Messaging/IMailServer/v12.5.6/ReleaseNotes/index.htm#link8; https://docs.ipswitch.com/_Messaging/IMailServer/v12.5.6/ReleaseNotes/index.htm#link8
CVE: CVE-2017-12792
Published: 2017-10-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) linkname, (2) url, or (3) title parameter in an add action to linksmanage.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/UUUUnotfound/cve-2017-12792; https://github.com/UUUUnotfound/cve-2017-12792
CVE: CVE-2017-1311
Published: 2017-10-03
Description: IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 125719.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg22009039; http://www.securityfocus.com/bid/101058; https://exchange.xforce.ibmcloud.com/vulnerabilities/125719
CVE: CVE-2017-1324
Published: 2017-10-03
Description: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125975.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008785; http://www.securityfocus.com/bid/101062; https://exchange.xforce.ibmcloud.com/vulnerabilities/125975
CVE: CVE-2017-1334
Published: 2017-10-03
Description: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126242.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008785; http://www.securityfocus.com/bid/101062; https://exchange.xforce.ibmcloud.com/vulnerabilities/126242
CVE: CVE-2017-1335
Published: 2017-10-03
Description: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126243.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008785; http://www.securityfocus.com/bid/101062; https://exchange.xforce.ibmcloud.com/vulnerabilities/126243
CVE: CVE-2017-1345
Published: 2017-10-03
Description: IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126460.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22009039; https://exchange.xforce.ibmcloud.com/vulnerabilities/126460; http://www.ibm.com/support/docview.wss?uid=swg22009039
CVE: CVE-2017-1359
Published: 2017-10-03
Description: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126686.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008785; http://www.securityfocus.com/bid/101062; https://exchange.xforce.ibmcloud.com/vulnerabilities/126686
CVE: CVE-2017-1364
Published: 2017-10-03
Description: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126857.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008785; http://www.securityfocus.com/bid/101062; https://exchange.xforce.ibmcloud.com/vulnerabilities/126857
CVE: CVE-2017-1369
Published: 2017-10-03
Description: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126862.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008785; http://www.securityfocus.com/bid/101062; https://exchange.xforce.ibmcloud.com/vulnerabilities/126862
CVE: CVE-2017-13704
Published: 2017-10-03
Description: In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://thekelleys.org.uk/dnsmasq/CHANGELOG; http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=63437ffbb58837b214b4b92cb1c54bc5f3279928; http://www.securityfocus.com/bid/101085
CVE: CVE-2017-13997
Published: 2017-10-03
Description: A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes of performing customized calculations or actions. A remote malicious entity could bypass the server authentication and trigger the execution of an arbitrary command. The command is executed under high privileges and could lead to a complete compromise of the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://www.securityfocus.com/bid/100952; https://ics-cert.us-cert.gov/advisories/ICSA-17-264-01; http://www.securityfocus.com/bid/100952
CVE: CVE-2017-1429
Published: 2017-10-03
Description: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127587.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008785; http://www.securityfocus.com/bid/101062; https://exchange.xforce.ibmcloud.com/vulnerabilities/127587
CVE: CVE-2017-14492
Published: 2017-10-03
Description: Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://thekelleys.org.uk/dnsmasq/CHANGELOG
CVE: CVE-2017-14493
Published: 2017-10-03
Description: Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://thekelleys.org.uk/dnsmasq/CHANGELOG
CVE: CVE-2017-14494
Published: 2017-10-03
Description: dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://thekelleys.org.uk/dnsmasq/CHANGELOG
CVE: CVE-2017-14495
Published: 2017-10-03
Description: Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://thekelleys.org.uk/dnsmasq/CHANGELOG
CVE: CVE-2017-14496
Published: 2017-10-03
Description: Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://thekelleys.org.uk/dnsmasq/CHANGELOG
CVE: CVE-2017-14754
Published: 2017-10-03
Description: OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Arbitrary File Read: /xAdmin/html/cm_datasource_group_xsd.jsp, parameter: xsd_datasource_schema_file filename. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2017/Sep/92; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; http://seclists.org/fulldisclosure/2017/Sep/92
CVE: CVE-2017-14755
Published: 2017-10-03
Description: OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-Site Scripting: /xAdmin/html/XPressoDoc, parameter: categoryId.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Sep/95; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; http://seclists.org/fulldisclosure/2017/Sep/95
CVE: CVE-2017-14756
Published: 2017-10-03
Description: OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-Site Scripting: /xAdmin/html/Deployment (cat_id).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Sep/96; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; http://seclists.org/fulldisclosure/2017/Sep/96
CVE: CVE-2017-14757
Published: 2017-10-03
Description: OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xDashboard/html/jobhistory/downloadSupportFile.action, parameter: jobRunId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2017/Oct/8; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; https://www.exploit-db.com/exploits/42939/
CVE: CVE-2017-14758
Published: 2017-10-03
Description: OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xAdmin/html/cm_doclist_view_uc.jsp, parameter: documentId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2017/Oct/23; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; https://www.exploit-db.com/exploits/42940/
CVE: CVE-2017-14759
Published: 2017-10-03
Description: OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory listings or system files, or cause SSRF or Denial of Service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://seclists.org/fulldisclosure/2017/Sep/97; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; http://seclists.org/fulldisclosure/2017/Sep/97
CVE: CVE-2017-14770
Published: 2017-10-03
Description: Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes. A local authenticated attacker can access the password hashes in a debugger-pause state during the authentication process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101069; https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox_Product_Security_Advisory_9_28_17.pdf; http://www.securityfocus.com/bid/101069
CVE: CVE-2017-14771
Published: 2017-10-03
Description: Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation of user-supplied files path when uploading files via the application. During a debugger-pause state, a local authenticated attacker can upload an arbitrary file and overwrite existing files within the scope of the affected application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101069; https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox_Product_Security_Advisory_9_28_17.pdf; http://www.securityfocus.com/bid/101069
CVE: CVE-2017-14772
Published: 2017-10-03
Description: Skybox Manager Client Application is prone to information disclosure via a username enumeration attack. A local unauthenticated attacker could exploit the flaw to obtain valid usernames, by analyzing error messages upon valid and invalid account login attempts.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101069; https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox_Product_Security_Advisory_9_28_17.pdf; http://www.securityfocus.com/bid/101069
CVE: CVE-2017-14773
Published: 2017-10-03
Description: Skybox Manager Client Application prior to 8.5.501 is prone to an elevation of privileges vulnerability during authentication of a valid user in a debugger-pause state. The vulnerability can only be exploited by a local authenticated attacker.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/101069; https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox_Product_Security_Advisory_9_28_17.pdf; http://www.securityfocus.com/bid/101069
CVE: CVE-2017-14848
Published: 2017-10-03
Description: WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpvulndb.com/vulnerabilities/8929; https://www.exploit-db.com/exploits/42924/; https://wpvulndb.com/vulnerabilities/8929
CVE: CVE-2017-14979
Published: 2017-10-03
Description: Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Blck4/blck4/blob/master/Gxlcms%20POC.php; https://github.com/Blck4/blck4/blob/master/Gxlcms%20POC.php
CVE: CVE-2017-14981
Published: 2017-10-03
Description: Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtration of data (url in /mods/_standard/rss_feeds/edit_feed.php). An attacker could inject arbitrary HTML and script code into a browser in the context of the vulnerable website.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/atutor/ATutor/commit/9292360c8b3898d[PII_REDACTED]f110cef21729090; https://github.com/atutor/ATutor/issues/135; https://github.com/atutor/ATutor/commit/9292360c8b3898d[PII_REDACTED]f110cef21729090