deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9364
Published: 2017-06-02
Description: Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/bigtreecms/BigTree-CMS/commit/b[PII_REDACTED]1cc650eaf51f5d2f62ceac6335e12; https://github.com/bigtreecms/BigTree-CMS/issues/280; https://github.com/bigtreecms/BigTree-CMS/commit/b[PII_REDACTED]1cc650eaf51f5d2f62ceac6335e12
CVE: CVE-2017-9365
Published: 2017-06-02
Description: CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/commit/c17d09b05d9c20c214ee2f4fbb52f7307a7b4b6f; https://github.com/bigtreecms/BigTree-CMS/issues/281; https://github.com/bigtreecms/BigTree-CMS/commit/c17d09b05d9c20c214ee2f4fbb52f7307a7b4b6f
CVE: CVE-2017-9366
Published: 2017-06-02
Description: Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Base/Dashboard/Dashboard_0.php, which allows remote attackers to inject arbitrary web script or HTML via a crafted tab_name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Telaxus/EPESI/commit/36be628c2597fd0209224a09b17858294f49c585; https://github.com/Telaxus/EPESI/issues/196; https://github.com/Telaxus/EPESI/commit/36be628c2597fd0209224a09b17858294f49c585
CVE: CVE-2017-6039
Published: 2017-06-02
Description: A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow unauthorized access to the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-259, CWE-798
References: http://www.securityfocus.com/bid/98781; https://ics-cert.us-cert.gov/advisories/ICSA-17-152-01; http://www.securityfocus.com/bid/98781
CVE: CVE-2017-9372
Published: 2017-06-02
Description: PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2017-002.txt; http://www.debian.org/security/2017/dsa-3933; http://www.securityfocus.com/bid/98572
CVE: CVE-2017-9378
Published: 2017-06-02
Description: BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/bigtreecms/BigTree-CMS/commit/f7899701d7be91b7dc546b65e44a27b668eb3b76; https://github.com/bigtreecms/BigTree-CMS/issues/282; https://github.com/bigtreecms/BigTree-CMS/commit/f7899701d7be91b7dc546b65e44a27b668eb3b76
CVE: CVE-2017-9379
Published: 2017-06-02
Description: Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/issues/287; https://github.com/bigtreecms/BigTree-CMS/issues/287
CVE: CVE-2017-9380
Published: 2017-06-02
Description: OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/163087/OpenEMR-5.0.0-Remote-Shell-Upload.html; https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-9380-Exploit; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-002
CVE: CVE-2017-0896
Published: 2017-06-02
Description: Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285, CWE-862
References: https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b; https://groups.google.com/forum/#%21msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ; https://hackerone.com/reports/224210
CVE: CVE-2017-9403
Published: 2017-06-02
Description: In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://bugzilla.maptools.org/show_bug.cgi?id=2689; http://www.debian.org/security/2017/dsa-3903; https://security.gentoo.org/glsa/201709-27
CVE: CVE-2017-9404
Published: 2017-06-02
Description: In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://bugzilla.maptools.org/show_bug.cgi?id=2688; http://www.debian.org/security/2017/dsa-3903; https://usn.ubuntu.com/3602-1/
CVE: CVE-2017-9405
Published: 2017-06-02
Description: In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/457; https://github.com/ImageMagick/ImageMagick/issues/457
CVE: CVE-2017-9406
Published: 2017-06-02
Description: In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://bugs.freedesktop.org/show_bug.cgi?id=100775; https://security.gentoo.org/glsa/201801-17; https://www.debian.org/security/2018/dsa-4079
CVE: CVE-2017-9407
Published: 2017-06-02
Description: In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/459; https://github.com/ImageMagick/ImageMagick/issues/459
CVE: CVE-2017-9408
Published: 2017-06-02
Description: In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://bugs.freedesktop.org/show_bug.cgi?id=100776; https://security.gentoo.org/glsa/201801-17; https://www.debian.org/security/2018/dsa-4079
CVE: CVE-2017-9409
Published: 2017-06-02
Description: In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/458; https://github.com/ImageMagick/ImageMagick/issues/458
CVE: CVE-2016-8228
Published: 2017-06-04
Description: In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://support.lenovo.com/us/en/product_security/LEN-10149; https://support.lenovo.com/us/en/product_security/LEN-10149
CVE: CVE-2016-8229
Published: 2017-06-04
Description: A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DHCP server used by the system where LSB is installed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://support.lenovo.com/us/en/product_security/LEN-10149; https://support.lenovo.com/us/en/product_security/LEN-10149
CVE: CVE-2016-8230
Published: 2017-06-04
Description: In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model and product name to Lenovo's servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.lenovo.com/us/en/product_security/LEN-10149; https://support.lenovo.com/us/en/product_security/LEN-10149
CVE: CVE-2016-8231
Published: 2017-06-04
Description: In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://support.lenovo.com/us/en/product_security/LEN-10149; https://support.lenovo.com/us/en/product_security/LEN-10149
CVE: CVE-2017-3740
Published: 2017-06-04
Description: In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controller, which could cause a denial of service attack on the system or the ability to alter hardware functionality.
CVSS Score: 5.5 (MEDIUM)
References: https://support.lenovo.com/us/en/product_security/LEN-13637; https://support.lenovo.com/us/en/product_security/LEN-13637
CVE: CVE-2017-3741
Published: 2017-06-04
Description: In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly. This issue only affects ThinkPad X1 Carbon 5th generation.
CVSS Score: 3.3 (LOW)
References: https://support.lenovo.com/us/en/product_security/LEN-14440; https://support.lenovo.com/us/en/product_security/LEN-14440
CVE: CVE-2017-9416
Published: 2017-06-04
Description: Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/odoo/odoo/issues/17394; https://github.com/odoo/odoo/issues/17394
CVE: CVE-2017-9417
Published: 2017-06-04
Description: Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.
CVSS Score: 9.8 (CRITICAL)
References: http://seclists.org/fulldisclosure/2019/May/24; http://www.securityfocus.com/bid/99482; http://www.securitytracker.com/id/1038950
CVE: CVE-2012-6705
Published: 2017-06-04
Description: Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://st2tea.blogspot.com/2012/02/jamroom-cross-site-scripting.html; http://www.securityfocus.com/bid/52073; http://st2tea.blogspot.com/2012/02/jamroom-cross-site-scripting.html
CVE: CVE-2014-9983
Published: 2017-06-04
Description: Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks contained in the archive. This allows remote attackers to write to arbitrary files via a crafted archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774172; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774172
CVE: CVE-2017-9427
Published: 2017-06-04
Description: SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a crafted table name at admin/developer/modules/designer/ and the injection is visible at admin/dashboard/vitals-statistics/integrity/check/?external=true.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/bigtreecms/BigTree-CMS/issues/288; https://github.com/bigtreecms/BigTree-CMS/issues/288
CVE: CVE-2017-9428
Published: 2017-06-04
Description: A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary files via ..\ sequences in the directory parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/bigtreecms/BigTree-CMS/issues/289; https://github.com/bigtreecms/BigTree-CMS/issues/289
CVE: CVE-2017-7669
Published: 2017-06-05
Description: In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98795; https://mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%3E; http://www.securityfocus.com/bid/98795
CVE: CVE-2017-9431
Published: 2017-06-05
Description: Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1018; https://github.com/grpc/grpc/pull/10492; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1018
CVE: CVE-2017-9432
Published: 2017-06-05
Description: Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1029; https://github.com/fosnola/libstaroffice/commit/2d6253c7a692a3d92785dd990fce7256ea05e794; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1029
CVE: CVE-2017-9433
Published: 2017-06-05
Description: Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in lib/MsWrd1Parser.cxx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3875; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1037; https://sourceforge.net/p/libmwaw/libmwaw/ci/68b3b[PII_REDACTED]8bfb6cbb4266177cc253b292f/
CVE: CVE-2017-9430
Published: 2017-06-05
Description: Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv[0]. An example threat model is a web application that launches dnstracer with an untrusted name string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/142799/DNSTracer-1.8.1-Buffer-Overflow.html; https://www.exploit-db.com/exploits/42115/
CVE: CVE-2[PII_REDACTED]
Published: 2017-06-05
Description: Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html; http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html
CVE: CVE-2017-8438
Published: 2017-06-05
Description: Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a template that contains the _user properties, the behavior of run_as will be incorrect. Additionally if the run_as user specified does not exist, the transition will not happen.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-269
References: https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952; https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released; https://www.elastic.co/community/security
CVE: CVE-2017-8439
Published: 2017-06-05
Description: Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952; https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released; https://www.elastic.co/community/security
CVE: CVE-2017-8440
Published: 2017-06-05
Description: Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952; https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released; https://www.elastic.co/community/security
CVE: CVE-2017-8441
Published: 2017-06-05
Description: Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-279, CWE-200
References: https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952; https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released; https://www.elastic.co/community/security
CVE: CVE-2017-8835
Published: 2017-06-05
Description: SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a session ID can be retrieved from the sessions database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://seclists.org/bugtraq/2017/Jun/1; https://www.exploit-db.com/exploits/42130/; https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
CVE: CVE-2017-8836
Published: 2017-06-05
Description: CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious website. This can for example be used to change the credentials of the administrative webinterface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seclists.org/bugtraq/2017/Jun/1; https://www.exploit-db.com/exploits/42130/; https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
CVE: CVE-2017-8837
Published: 2017-06-05
Description: Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass. In case one of these devices is compromised, the attacker can gain access to passwords and abuse them to compromise further systems.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://seclists.org/bugtraq/2017/Jun/1; https://www.exploit-db.com/exploits/42130/; https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
CVE: CVE-2017-8838
Published: 2017-06-05
Description: XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2017/Jun/1; https://www.exploit-db.com/exploits/42130/; https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
CVE: CVE-2017-8839
Published: 2017-06-05
Description: XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is guest/preview.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2017/Jun/1; https://www.exploit-db.com/exploits/42130/; https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
CVE: CVE-2017-8840
Published: 2017-06-05
Description: Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. A direct request to cgi-bin/HASync/hasync.cgi?debug=1 shows Master LAN Address, Serial Number, HA Group ID, Virtual IP, and Submitted syncid.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/bugtraq/2017/Jun/1; https://www.exploit-db.com/exploits/42130/; https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
CVE: CVE-2017-8841
Published: 2017-06-05
Description: Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: http://seclists.org/bugtraq/2017/Jun/1; https://www.exploit-db.com/exploits/42130/; https://www.x41-dsec.de/lab/advisories/x41-2017-005-peplink/
CVE: CVE-2017-9434
Published: 2017-06-05
Description: Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: http://openwall.com/lists/oss-security/2017/06/06/2; http://www.securityfocus.com/bid/99007; https://github.com/weidai11/cryptopp/commit/07dbcc3d9644b18e05c1776db2a57fe04d780965
CVE: CVE-2017-9435
Published: 2017-06-05
Description: Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog; https://github.com/Dolibarr/dolibarr/commit/70636cc59ffa1ffbc0ce3dba315d7d9b837aad04; https://github.com/Dolibarr/dolibarr/blob/develop/ChangeLog
CVE: CVE-2017-9436
Published: 2017-06-05
Description: TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nilsteampassnet/TeamPass/blob/master/changelog.md; https://github.com/nilsteampassnet/TeamPass/blob/master/changelog.md
CVE: CVE-2017-9437
Published: 2017-06-05
Description: Openbravo Business Suite 3.0 is affected by SQL injection. This vulnerability could allow remote authenticated attackers to inject arbitrary SQL code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-005; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-005
CVE: CVE-2[PII_REDACTED]
Published: 2017-06-05
Description: Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98838; https://access.redhat.com/errata/RHSA-2017:1574; https://kc.mcafee.com/corporate/index?page=content&id=SB10205