deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8610
Published: 2017-07-11
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8598, CVE-2017-8596, CVE-2017-8595, CVE-2017-8618, CVE-2017-8619, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99415; http://www.securitytracker.com/id/1038849; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8610
CVE: CVE-2017-8611
Published: 2017-07-11
Description: Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99391; http://www.securitytracker.com/id/1038858; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8611
CVE: CVE-2017-8617
Published: 2017-07-11
Description: Microsoft Edge in Windows 10 1703 Microsoft Edge allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Remote Code Execution Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99422; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8617; http://www.securityfocus.com/bid/99422
CVE: CVE-2017-8618
Published: 2017-07-11
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 Internet Explorer in the way affected Microsoft scripting engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8619, CVE-2017-9598 and CVE-2017-8609.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99399; http://www.securitytracker.com/id/1038848; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8618
CVE: CVE-2017-8619
Published: 2017-07-11
Description: Microsoft Edge on Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8618, CVE-2017-9598 and CVE-2017-8609.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99392; http://www.securitytracker.com/id/1038849; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8619
CVE: CVE-2017-8621
Published: 2017-07-11
Description: Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/99533; http://www.securitytracker.com/id/1038852; https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8621
CVE: CVE-2017-11176
Published: 2017-07-11
Description: The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f991af3daabaecff34684fd51fac80319d1baad1; http://www.debian.org/security/2017/dsa-3927; http://www.debian.org/security/2017/dsa-3945
CVE: CVE-2017-11178
Published: 2017-07-12
Description: In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: http://www.yuesec.com/img/cccccve/finecms_writefile/finecmswritefile_2017_07_011_subm1t.html; http://www.yuesec.com/img/cccccve/finecms_writefile/finecmswritefile_2017_07_011_subm1t.html
CVE: CVE-2017-11179
Published: 2017-07-12
Description: FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.yuesec.com/img/cccccve/finecms_storedxss/finecms_storedxss26543.html; http://www.yuesec.com/img/cccccve/finecms_storedxss/finecms_storedxss26543.html
CVE: CVE-2017-11180
Published: 2017-07-12
Description: FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (1) the User-Agent header of an HTTP request or (2) the username entered on the login screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.yuesec.com/img/cccccve/finecms_storedxss/finecms_storedxss26543.html; http://www.yuesec.com/img/cccccve/finecms_storedxss/finecms_storedxss26543.html
CVE: CVE-2017-11181
Published: 2017-07-12
Description: In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/143307/Rise-Ultimate-Project-Manager-1.8-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/143307/Rise-Ultimate-Project-Manager-1.8-Cross-Site-Scripting.html
CVE: CVE-2017-11182
Published: 2017-07-12
Description: In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/143307/Rise-Ultimate-Project-Manager-1.8-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/143307/Rise-Ultimate-Project-Manager-1.8-Cross-Site-Scripting.html
CVE: CVE-2017-11165
Published: 2017-07-12
Description: dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html; https://www.exploit-db.com/exploits/42313/; https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
CVE: CVE-2016-8638
Published: 2017-07-12
Description: A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users.  This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-384
References: http://rhn.redhat.com/errata/RHSA-2016-2809.html; http://www.securityfocus.com/bid/94439; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8638
CVE: CVE-2017-11167
Published: 2017-07-12
Description: FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo() input value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.03sec.com/3169.shtml; http://www.03sec.com/3169.shtml
CVE: CVE-2017-7678
Published: 2017-07-12
Description: In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://apache-spark-developers-list.1001551.n3.nabble.com/CVE-2017-7678-Apache-Spark-XSS-web-UI-MHTML-vulnerability-td21947.html; http://www.securityfocus.com/bid/99603; http://apache-spark-developers-list.1001551.n3.nabble.com/CVE-2017-7678-Apache-Spark-XSS-web-UI-MHTML-vulnerability-td21947.html
CVE: CVE-2017-11187
Published: 2017-07-12
Description: phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: http://www.phpmyfaq.de/security/advisory-2017-07-12; http://www.phpmyfaq.de/security/advisory-2017-07-12
CVE: CVE-2017-11188
Published: 2017-07-12
Description: The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834
References: http://www.securityfocus.com/bid/99566; https://github.com/ImageMagick/ImageMagick/issues/509; http://www.securityfocus.com/bid/99566
CVE: CVE-2017-4052
Published: 2017-07-12
Description: Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to change or update any configuration settings, or gain administrator functionality via a crafted HTTP request parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/99557; https://kc.mcafee.com/corporate/index?page=content&id=SB10204; http://www.securityfocus.com/bid/99557
CVE: CVE-2017-4053
Published: 2017-07-12
Description: Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to execute a command of their choice via a crafted HTTP request parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.securityfocus.com/bid/99560; https://kc.mcafee.com/corporate/index?page=content&id=SB10204; http://www.securityfocus.com/bid/99560
CVE: CVE-2017-4054
Published: 2017-07-12
Description: Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a command of their choice via a crafted HTTP request parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/99559; https://kc.mcafee.com/corporate/index?page=content&id=SB10204; http://www.securityfocus.com/bid/99559
CVE: CVE-2017-4055
Published: 2017-07-12
Description: Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to bypass ATD detection via loose enforcement of authentication and authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://www.securityfocus.com/bid/99564; https://kc.mcafee.com/corporate/index?page=content&id=SB10204; http://www.securityfocus.com/bid/99564
CVE: CVE-2017-4057
Published: 2017-07-12
Description: Privilege Escalation vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/99561; https://kc.mcafee.com/corporate/index?page=content&id=SB10204; http://www.securityfocus.com/bid/99561
CVE: CVE-2017-11189
Published: 2017-07-12
Description: unrarlib.c in unrar-free 0.0.1 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash), which could be relevant if unrarlib is used as library code for a long-running application. NOTE: one of the several test cases in the references may be the same as what was separately reported as CVE-2017-14121.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/0x09AL/my-exploits/tree/master/pocs/unrar-free/dos; https://github.com/0x09AL/my-exploits/tree/master/pocs/unrar-free/dos
CVE: CVE-2017-11190
Published: 2017-07-12
Description: unrarlib.c in unrar-free 0.0.1, when _DEBUG_LOG mode is enabled, might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via an RAR archive containing a long filename.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/0x09AL/my-exploits/blob/master/pocs/unrar-free/buffer-overflow/DESCRIPTION; https://github.com/0x09AL/my-exploits/blob/master/pocs/unrar-free/buffer-overflow/DESCRIPTION
CVE: CVE-2017-9843
Published: 2017-07-12
Description: SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe, aka SAP Security Note 2406841.
CVSS Score: 2.7 (LOW)
References: http://www.securityfocus.com/bid/96900; https://erpscan.io/advisories/erpscan-17-010-sap-netweaver-abap-dispwork-crash-using-cl_java_script/; http://www.securityfocus.com/bid/96900
CVE: CVE-2017-9844
Published: 2017-07-12
Description: SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/96865; https://erpscan.io/advisories/erpscan-17-014-sap-netweaver-java-deserialization-untrusted-user-value-metadatauploader/; https://me.sap.com/notes/2399804
CVE: CVE-2017-9845
Published: 2017-07-12
Description: disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note 2405918.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/96874; https://erpscan.io/advisories/erpscan-17-015-sap-netweaver-dispwork-anonymous-denial-service/; http://www.securityfocus.com/bid/96874
CVE: CVE-2017-9977
Published: 2017-07-12
Description: AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan inside disk image (aka DMG) files.
CVSS Score: 7.5 (HIGH)
References: https://wwws.nightwatchcybersecurity.com/2017/07/06/avg-antivirus-for-macos-doesnt-scan-inside-disk-images-cve-2017-9977/; https://wwws.nightwatchcybersecurity.com/2017/07/06/avg-antivirus-for-macos-doesnt-scan-inside-disk-images-cve-2017-9977/
CVE: CVE-2016-6114
Published: 2017-07-12
Description: IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118352.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005549; http://www.securityfocus.com/bid/99545; https://exchange.xforce.ibmcloud.com/vulnerabilities/118352
CVE: CVE-2016-8946
Published: 2017-07-12
Description: IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118833.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005549; http://www.securityfocus.com/bid/99545; https://exchange.xforce.ibmcloud.com/vulnerabilities/118833
CVE: CVE-2016-8947
Published: 2017-07-12
Description: IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118834
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22005549; http://www.securityfocus.com/bid/99545; https://exchange.xforce.ibmcloud.com/vulnerabilities/118834
CVE: CVE-2016-8948
Published: 2017-07-12
Description: IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118835.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005549; http://www.securityfocus.com/bid/99545; https://exchange.xforce.ibmcloud.com/vulnerabilities/118835
CVE: CVE-2016-8950
Published: 2017-07-12
Description: IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118837.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005549; http://www.securityfocus.com/bid/99545; https://exchange.xforce.ibmcloud.com/vulnerabilities/118837
CVE: CVE-2016-8953
Published: 2017-07-12
Description: IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118840.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22005549; http://www.securityfocus.com/bid/99545; https://exchange.xforce.ibmcloud.com/vulnerabilities/118840
CVE: CVE-2017-1285
Published: 2017-07-12
Description: IBM WebSphere MQ 9.0.1 and 9.0.2 could allow an authenticated user with authority to send a specially crafted message that would cause a channel to remain in a running state but not process messages. IBM X-Force ID: 125146.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99538; https://exchange.xforce.ibmcloud.com/vulnerabilities/125146; https://www.ibm.com/support/docview.wss?uid=swg22003856
CVE: CVE-2017-1321
Published: 2017-07-12
Description: IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125916.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004729; http://www.securityfocus.com/bid/99537; https://exchange.xforce.ibmcloud.com/vulnerabilities/125916
CVE: CVE-2017-2814
Published: 2017-07-12
Description: An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted pdf can cause an image resizing after allocation has already occurred, resulting in heap corruption which can lead to code execution. An attacker controlled PDF file can be used to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99497; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0311; http://www.securityfocus.com/bid/99497
CVE: CVE-2017-2818
Published: 2017-07-12
Description: An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting in heap corruption. An attacker controlled PDF file can be used to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99497; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0319; http://www.securityfocus.com/bid/99497
CVE: CVE-2017-2820
Published: 2017-07-12
Description: An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/99497; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0321; http://www.securityfocus.com/bid/99497
CVE: CVE-2017-2863
Published: 2017-07-12
Description: An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0367; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0367
CVE: CVE-2017-11193
Published: 2017-07-12
Description: Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/99621; http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf; https://twitter.com/sxcurity/status/[PII_REDACTED]45937921
CVE: CVE-2017-11194
Published: 2017-07-12
Description: Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel, the certid parameter of adminservercacertdetails.cgi is reflected in the application's response and is not properly sanitized, allowing an attacker to inject tags. An attacker could come up with clever payloads to make the system run commands such as ping, ping6, traceroute, nslookup, arp, etc.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf; https://twitter.com/sxcurity/status/[PII_REDACTED]45937921; http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf