deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4950
Published: 2017-03-07
Description: Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://2016.hack.lu/archive/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf; http://www.securityfocus.com/bid/93879; http://2016.hack.lu/archive/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf
CVE: CVE-2016-6239
Published: 2017-03-07
Description: The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openbsd.org/errata58.html; http://www.openbsd.org/errata59.html; http://www.openwall.com/lists/oss-security/2016/07/14/5
CVE: CVE-2016-6240
Published: 2017-03-07
Description: Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://www.openbsd.org/errata58.html; http://www.openbsd.org/errata59.html; http://www.openwall.com/lists/oss-security/2016/07/14/5
CVE: CVE-2016-6241
Published: 2017-03-07
Description: Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.openbsd.org/errata58.html; http://www.openbsd.org/errata59.html; http://www.openwall.com/lists/oss-security/2016/07/14/5
CVE: CVE-2016-6242
Published: 2017-03-07
Description: OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent system call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-189
References: http://www.openbsd.org/errata58.html; http://www.openbsd.org/errata59.html; http://www.openwall.com/lists/oss-security/2016/07/14/5
CVE: CVE-2016-6243
Published: 2017-03-07
Description: thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of the __thrsleep system call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openbsd.org/errata58.html; http://www.openbsd.org/errata59.html; http://www.openwall.com/lists/oss-security/2016/07/14/5
CVE: CVE-2016-6245
Published: 2017-03-07
Description: OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openbsd.org/errata58.html; http://www.openbsd.org/errata59.html; http://www.openwall.com/lists/oss-security/2016/07/14/5
CVE: CVE-2016-6246
Published: 2017-03-07
Description: OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpfs with a VNOVAL in the (1) username, (2) groupname, or (3) device name of the root node.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://www.openbsd.org/errata58.html; http://www.openbsd.org/errata59.html; http://www.openwall.com/lists/oss-security/2016/07/14/5
CVE: CVE-2016-6247
Published: 2017-03-07
Description: OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openbsd.org/errata58.html; http://www.openbsd.org/errata59.html; http://www.openwall.com/lists/oss-security/2016/07/14/5
CVE: CVE-2016-6255
Published: 2017-03-07
Description: Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.debian.org/security/2016/dsa-3736; http://www.openwall.com/lists/oss-security/2016/07/18/13; http://www.openwall.com/lists/oss-security/2016/07/20/5
CVE: CVE-2016-6350
Published: 2017-03-07
Description: OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path starting with 10,9.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/kern/vfs_subr.c.diff?r1=1.248&r2=1.249; http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/tmpfs/tmpfs_vfsops.c.diff?r1=1.9&r2=1.10; http://www.openwall.com/lists/oss-security/2016/07/26/6
CVE: CVE-2016-6522
Published: 2017-03-07
Description: Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel panic) via a crafted mmap call, which triggers the new mapping to overlap with an existing mapping.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/023_uvmisavail.patch.sig; http://www.openwall.com/lists/oss-security/2016/08/02/12; http://www.openwall.com/lists/oss-security/2016/08/02/8
CVE: CVE-2016-7135
Published: 2017-03-07
Description: Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html; http://seclists.org/fulldisclosure/2016/Oct/80; http://www.openwall.com/lists/oss-security/2016/09/05/4
CVE: CVE-2016-7136
Published: 2017-03-07
Description: z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html; http://seclists.org/fulldisclosure/2016/Oct/80; http://www.openwall.com/lists/oss-security/2016/09/05/4
CVE: CVE-2016-7137
Published: 2017-03-07
Description: Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2) folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from parameter to /login_form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html; http://seclists.org/fulldisclosure/2016/Oct/80; http://www.openwall.com/lists/oss-security/2016/09/05/4
CVE: CVE-2016-7138
Published: 2017-03-07
Description: Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html; http://seclists.org/fulldisclosure/2016/Oct/80; http://www.openwall.com/lists/oss-security/2016/09/05/4
CVE: CVE-2016-7139
Published: 2017-03-07
Description: Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html; http://seclists.org/fulldisclosure/2016/Oct/80; http://www.openwall.com/lists/oss-security/2016/09/05/4
CVE: CVE-2016-7140
Published: 2017-03-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html; http://seclists.org/fulldisclosure/2016/Oct/80; http://www.openwall.com/lists/oss-security/2016/09/05/4
CVE: CVE-2016-7780
Published: 2017-03-07
Description: SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12; http://www.securityfocus.com/bid/97208
CVE: CVE-2016-7781
Published: 2017-03-07
Description: SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12; http://www.securityfocus.com/bid/97206
CVE: CVE-2016-7782
Published: 2017-03-07
Description: SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12; http://www.securityfocus.com/bid/97210
CVE: CVE-2016-7783
Published: 2017-03-07
Description: SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12; http://www.securityfocus.com/bid/97212
CVE: CVE-2016-7784
Published: 2017-03-07
Description: SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12; http://www.securityfocus.com/bid/97232
CVE: CVE-2016-7788
Published: 2017-03-07
Description: SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12; http://www.securityfocus.com/bid/97233
CVE: CVE-2016-7789
Published: 2017-03-07
Description: SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://forums.exponentcms.org/index.php?p=/discussion/comment/1591#Comment_1591; http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12
CVE: CVE-2016-8863
Published: 2017-03-07
Description: Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92849; https://security.gentoo.org/glsa/201701-52; https://sourceforge.net/p/pupnp/bugs/133/
CVE: CVE-2016-9019
Published: 2017-03-07
Description: SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the is_what parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://forums.exponentcms.org/index.php?p=/discussion/comment/1591#Comment_1591; http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12
CVE: CVE-2016-9020
Published: 2017-03-07
Description: SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12; http://www.securityfocus.com/bid/97269
CVE: CVE-2016-9087
Published: 2017-03-07
Description: SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.html; http://seclists.org/fulldisclosure/2016/Nov/12; http://www.securityfocus.com/bid/97271
CVE: CVE-2016-9643
Published: 2017-03-07
Description: The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and a large number of +) (plus close parenthesis).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2016/11/26/2; http://www.openwall.com/lists/oss-security/2016/11/26/5; http://www.securityfocus.com/bid/94559
CVE: CVE-2017-6509
Published: 2017-03-07
Description: Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Smith0r/burgundy-cms/issues/36; https://github.com/Smith0r/burgundy-cms/issues/36
CVE: CVE-2016-8940
Published: 2017-03-07
Description: IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these product specific database tables may allow access to passwords or other sensitive information for the product. IBM Reference #: 1998946.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21998946; http://www.ibm.com/support/docview.wss?uid=swg21998946
CVE: CVE-2016-8971
Published: 2017-03-07
Description: IBM WebSphere MQ 8.0 could allow an authenticated user with queue manager permissions to cause a segmentation fault which would result in the box having to be rebooted to resume normal operations. IBM Reference #: 1998663.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://www.ibm.com/support/docview.wss?uid=swg21998663; https://www.ibm.com/support/docview.wss?uid=swg21998663
CVE: CVE-2016-9693
Published: 2017-03-07
Description: IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine. IBM Reference #: 1998655.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98074; https://www.ibm.com/support/docview.wss?uid=swg21998655; http://www.securityfocus.com/bid/98074
CVE: CVE-2016-9720
Published: 2017-03-07
Description: IBM QRadar 7.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM Reference #: 1999533.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21999533; http://www.securityfocus.com/bid/96531; http://www.ibm.com/support/docview.wss?uid=swg21999533
CVE: CVE-2016-9723
Published: 2017-03-07
Description: IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999534.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21999534; http://www.securityfocus.com/bid/98073; http://www.ibm.com/support/docview.wss?uid=swg21999534
CVE: CVE-2016-9724
Published: 2017-03-07
Description: IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999537.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg21999537; http://www.ibm.com/support/docview.wss?uid=swg21999537
CVE: CVE-2016-9725
Published: 2017-03-07
Description: IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request resources from external sites, avoiding the need to duplicate them. IBM Reference #: 1999539.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21999539; http://www.securityfocus.com/bid/96530; http://www.ibm.com/support/docview.wss?uid=swg21999539
CVE: CVE-2016-9726
Published: 2017-03-07
Description: IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg21999542; http://www.ibm.com/support/docview.wss?uid=swg21999542
CVE: CVE-2016-9727
Published: 2017-03-07
Description: IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg21999542; http://www.ibm.com/support/docview.wss?uid=swg21999542
CVE: CVE-2016-9728
Published: 2017-03-07
Description: IBM Qradar 7.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, information in the back-end database. IBM Reference #: 1999543.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg21999543; http://www.ibm.com/support/docview.wss?uid=swg21999543
CVE: CVE-2016-9729
Published: 2017-03-07
Description: IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM Reference #: 1999545.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=swg21999545; http://www.securityfocus.com/bid/96538; http://www.ibm.com/support/docview.wss?uid=swg21999545
CVE: CVE-2016-9730
Published: 2017-03-07
Description: IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1999549.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg21999549; http://www.ibm.com/support/docview.wss?uid=swg21999549
CVE: CVE-2016-9740
Published: 2017-03-07
Description: IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested by an actor. IBM Reference #: 1999556.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.ibm.com/support/docview.wss?uid=swg21999556; http://www.securityfocus.com/bid/96535; http://www.ibm.com/support/docview.wss?uid=swg21999556
CVE: CVE-2017-1124
Published: 2017-03-07
Description: IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 1998053.
CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21998053; http://www.securityfocus.com/bid/96536; http://www.ibm.com/support/docview.wss?uid=swg21998053
CVE: CVE-2017-1133
Published: 2017-03-07
Description: IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999534.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21999534; http://www.securityfocus.com/bid/97239; http://www.ibm.com/support/docview.wss?uid=swg21999534
CVE: CVE-2017-5681
Published: 2017-03-07
Description: The RSA-CRT implementation in the Intel QuickAssist Technology (QAT) Engine for OpenSSL versions prior to 0.5.19 may allow remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.
CVSS Score: 7.5 (HIGH)
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00071&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00071&languageid=en-fr
CVE: CVE-2017-6511
Published: 2017-03-07
Description: andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/andrzuk/FineCMS/commit/2c80de96d403d4a2e81ac4c48f358bdffbe85ea0; https://github.com/andrzuk/FineCMS/issues/2; https://github.com/andrzuk/FineCMS/commit/2c80de96d403d4a2e81ac4c48f358bdffbe85ea0
CVE: CVE-2016-10200
Published: 2017-03-07
Description: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264, CWE-362, CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=32c231164b762dddefa13af5a0101032c70b50ef; http://source.android.com/security/bulletin/2017-03-01.html; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.14