deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12567
Published: 2017-08-07
Description: SQL injection exists in Quest KACE Asset Management Appliance 6.4.120822 through 7.2, Systems Management Appliance 6.4.120822 through 7.2.101, and K1000 as a Service 7.0 through 7.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://support.quest.com/kace-systems-management-appliance/kb/231874; https://support.quest.com/kace-systems-management-appliance/kb/231874
CVE: CVE-2017-12645
Published: 2017-08-07
Description: XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities; https://issues.liferay.com/browse/LPS-72307; https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE: CVE-2017-12646
Published: 2017-08-07
Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities; https://github.com/brianchandotcom/liferay-portal/pull/49833; https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE: CVE-2017-12647
Published: 2017-08-07
Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities; https://github.com/brianchandotcom/liferay-portal/pull/48901; https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE: CVE-2017-12648
Published: 2017-08-07
Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities; https://github.com/brianchandotcom/liferay-portal/pull/47888; https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE: CVE-2017-12649
Published: 2017-08-07
Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities; https://github.com/brianchandotcom/liferay-portal/pull/47579; https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities
CVE: CVE-2009-5145
Published: 2017-08-07
Description: Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://cve.killedkenny.io/cve/CVE-2009-5145; http://www.openwall.com/lists/oss-security/2015/03/02/7; http://www.securityfocus.com/bid/72792/info
CVE: CVE-2011-5325
Published: 2017-08-07
Description: Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html; http://seclists.org/fulldisclosure/2019/Jun/18; http://seclists.org/fulldisclosure/2020/Aug/20
CVE: CVE-2014-9260
Published: 2017-08-07
Description: The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/130690/WordPress-Download-Manager-2.7.2-Privilege-Escalation.html; http://packetstormsecurity.com/files/130690/WordPress-Download-Manager-2.7.2-Privilege-Escalation.html
CVE: CVE-2014-9262
Published: 2017-08-07
Description: The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.
CVSS Score: 8.2 (HIGH)
CWE: CWE-264
References: https://www.exploit-db.com/exploits/36112/; https://www.exploit-db.com/exploits/36112/
CVE: CVE-2015-1378
Published: 2017-08-07
Description: cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by non-root users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://cve.killedkenny.io/cve/CVE-2015-1378; http://www.openwall.com/lists/oss-security/2015/01/27/17; https://github.com/grml/grml-debootstrap/issues/59
CVE: CVE-2015-1555
Published: 2017-08-07
Description: Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: http://framework.zend.com/security/advisory/ZF2015-01; http://framework.zend.com/security/advisory/ZF2015-01
CVE: CVE-2015-3839
Published: 2017-08-07
Description: The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://blog.trendmicro.com/trendlabs-security-intelligence/os-x-zero-days-on-the-rise-a-2015-midyear-review-on-advanced-attack-surfaces/; http://blog.trendmicro.com/trendlabs-security-intelligence/two-new-android-bugs-mess-up-messaging-may-lead-to-multiple-send-charges/; http://www.securityfocus.com/bid/100158
CVE: CVE-2015-7561
Published: 2017-08-07
Description: Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.
CVSS Score: 3.1 (LOW)
CWE: CWE-264
References: https://bugzilla.redhat.com/show_bug.cgi?id=1291963; https://github.com/kubernetes/kubernetes/pull/18909; https://bugzilla.redhat.com/show_bug.cgi?id=1291963
CVE: CVE-2015-7875
Published: 2017-08-07
Description: ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/10/21/2; http://www.securityfocus.com/bid/76441; https://www.drupal.org/node/2554145
CVE: CVE-2015-7887
Published: 2017-08-07
Description: NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/77315; https://kb.netapp.com/support/s/article/ka51A00000007EnQAI/authentication-bypass-vulnerability-in-snapcenter-server-1-0?language=en_US; http://www.securityfocus.com/bid/77315
CVE: CVE-2015-8621
Published: 2017-08-07
Description: t-coffee before 11.00.8cbe486-2 allows local users to write to ~/.t_coffee globally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://cve.killedkenny.io/cve/CVE-2015-8621; http://www.openwall.com/lists/oss-security/2015/12/23/4; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=751579
CVE: CVE-2017-12650
Published: 2017-08-07
Description: SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.wpscans.com/sql-injection-and-csrf-security-vulnerability-in-loginizer/; https://sv.wordpress.org/plugins/loginizer/#developers; https://wpvulndb.com/vulnerabilities/8883
CVE: CVE-2017-12651
Published: 2017-08-07
Description: Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.wpscans.com/sql-injection-and-csrf-security-vulnerability-in-loginizer/; https://sv.wordpress.org/plugins/loginizer/#developers; https://wpvulndb.com/vulnerabilities/8884
CVE: CVE-2017-12653
Published: 2017-08-07
Description: 360 Total Security 9.0.0.1202 before 2017-07-07 allows Privilege Escalation via a Trojan horse Shcore.dll file in any directory in the PATH, as demonstrated by the C:\Python27 directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://blogs.securiteam.com/index.php/archives/3314#more-3314; https://blogs.securiteam.com/index.php/archives/3314#more-3314
CVE: CVE-2017-12654
Published: 2017-08-07
Description: The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100230; https://github.com/ImageMagick/ImageMagick/issues/620; http://www.securityfocus.com/bid/100230
CVE: CVE-2014-1235
Published: 2017-08-07
Description: Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file.  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://seclists.org/oss-sec/2014/q1/54; http://www.securityfocus.com/bid/64736; https://bugzilla.redhat.com/show_bug.cgi?id=1050871
CVE: CVE-2014-3462
Published: 2017-08-07
Description: The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes".
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2017-01/msg00090.html; http://www.openwall.com/lists/oss-security/2014/05/14/2; https://bugzilla.redhat.com/show_bug.cgi?id=1097537
CVE: CVE-2014-9827
Published: 2017-08-07
Description: coders/xpm.c in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=69490f5cffbda612e15a[PII_REDACTED]bb0b45e276; https://bugzilla.redhat.com/show_bug.cgi?id=1343483
CVE: CVE-2014-9828
Published: 2017-08-07
Description: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=460547be494cc8c039b99b65e64a1fa2eb08ab5c; https://bugzilla.redhat.com/show_bug.cgi?id=1343484
CVE: CVE-2014-9830
Published: 2017-08-07
Description: coders/sun.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted sun file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=b68b78e2625122d9f6b6d88ba4df7e85b47b556f; https://bugzilla.redhat.com/show_bug.cgi?id=1343486
CVE: CVE-2014-9831
Published: 2017-08-07
Description: coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via a corrupted wpg file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=b68b78e2625122d9f6b6d88ba4df7e85b47b556f; https://bugzilla.redhat.com/show_bug.cgi?id=1343487
CVE: CVE-2015-5244
Published: 2017-08-07
Description: The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175248.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176026.html; https://bugzilla.redhat.com/show_bug.cgi?id=1259216
CVE: CVE-2015-5946
Published: 2017-08-07
Description: Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
CVSS Score: 7.8 (HIGH)
CWE: CWE-184
References: http://www.openwall.com/lists/oss-security/2015/08/06/6; http://www.openwall.com/lists/oss-security/2016/03/02/5; http://xiphosresearch.com/2016/03/01/Vulnerability-Inheritance-across-Forks.html
CVE: CVE-2015-7571
Published: 2017-08-07
Description: Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html; http://seclists.org/fulldisclosure/2016/Feb/44; http://www.securityfocus.com/archive/1/537493/100/0/threaded
CVE: CVE-2015-7691
Published: 2017-08-07
Description: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations.  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-0780.html; http://rhn.redhat.com/errata/RHSA-2016-2583.html; http://support.ntp.org/bin/view/Main/NtpBug2899
CVE: CVE-2015-7692
Published: 2017-08-07
Description: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash).  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-0780.html; http://rhn.redhat.com/errata/RHSA-2016-2583.html; http://support.ntp.org/bin/view/Main/NtpBug2899
CVE: CVE-2015-7701
Published: 2017-08-07
Description: Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://rhn.redhat.com/errata/RHSA-2016-0780.html; http://rhn.redhat.com/errata/RHSA-2016-2583.html; http://support.ntp.org/bin/view/Main/NtpBug2909
CVE: CVE-2015-7702
Published: 2017-08-07
Description: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash).  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-0780.html; http://rhn.redhat.com/errata/RHSA-2016-2583.html; http://support.ntp.org/bin/view/Main/NtpBug2899
CVE: CVE-2015-7704
Published: 2017-08-07
Description: The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bugs.ntp.org/show_bug.cgi?id=2901; http://rhn.redhat.com/errata/RHSA-2015-1930.html; http://rhn.redhat.com/errata/RHSA-2015-2520.html
CVE: CVE-2015-7705
Published: 2017-08-07
Description: The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html
CVE: CVE-2015-7849
Published: 2017-08-07
Description: Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://support.ntp.org/bin/view/Main/NtpBug2916; http://www.securityfocus.com/bid/77276; http://www.securitytracker.com/id/1033951
CVE: CVE-2015-7850
Published: 2017-08-07
Description: ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://support.ntp.org/bin/view/Main/NtpBug2917; http://www.debian.org/security/2015/dsa-3388; http://www.securityfocus.com/bid/77279
CVE: CVE-2015-7852
Published: 2017-08-07
Description: ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-0780.html; http://rhn.redhat.com/errata/RHSA-2016-2583.html; http://support.ntp.org/bin/view/Main/NtpBug2919
CVE: CVE-2015-7853
Published: 2017-08-07
Description: The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
CVE: CVE-2015-7854
Published: 2017-08-07
Description: Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://support.ntp.org/bin/view/Main/NtpBug2921; http://www.securityfocus.com/bid/77277; http://www.securitytracker.com/id/1033951
CVE: CVE-2015-7855
Published: 2017-08-07
Description: The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://support.ntp.org/bin/view/Main/NtpBug2922; http://www.debian.org/security/2015/dsa-3388; http://www.securityfocus.com/bid/77283
CVE: CVE-2015-7871
Published: 2017-08-07
Description: Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://support.ntp.org/bin/view/Main/NtpBug2941; http://www.debian.org/security/2015/dsa-3388; http://www.securityfocus.com/bid/77287
CVE: CVE-2016-3113
Published: 2017-08-07
Description: Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1326598; https://bugzilla.redhat.com/show_bug.cgi?id=1326598
CVE: CVE-2016-6220
Published: 2017-08-07
Description: Information Disclosure vulnerability in the Dashboard and Error Pages in Trend Micro Control Manager SP3 6.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92363; https://success.trendmicro.com/solution/1114749; http://www.securityfocus.com/bid/92363
CVE: CVE-2016-7976
Published: 2017-08-07
Description: The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://git.ghostscript.com/?p=user/chrisl/ghostpdl.git%3Ba=commit%3Bh=6d444c273da5499a4cd72f21cb6d4c9a5256807d; http://www.debian.org/security/2016/dsa-3691; http://www.openwall.com/lists/oss-security/2016/10/19/6
CVE: CVE-2017-12637
Published: 2017-08-07
Description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://web.archive.org/web/[PII_REDACTED]2056/http://www.sh0w.top/index.php/archives/7/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12637
CVE: CVE-2017-12655
Published: 2017-08-07
Description: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lu4n.com/cve/1.txt; http://lu4n.com/cve/1.txt
CVE: CVE-2017-6212
Published: 2017-08-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its requester. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2017-12662
Published: 2017-08-07
Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100232; https://github.com/ImageMagick/ImageMagick/commit/bd40cc5f[PII_REDACTED]1b881485cbd70f509f3829; https://github.com/ImageMagick/ImageMagick/issues/576
CVE: CVE-2017-12663
Published: 2017-08-07
Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/commit/1dc0ac5016f1c4d50b100a086526d6a2453a5444; https://github.com/ImageMagick/ImageMagick/issues/573; https://github.com/ImageMagick/ImageMagick/commit/1dc0ac5016f1c4d50b100a086526d6a2453a5444
CVE: CVE-2017-12664
Published: 2017-08-07
Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePALMImage in coders/palm.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/commit/0417cea1b6d72f90bd4f1f573f91e42a8ba66a89; https://github.com/ImageMagick/ImageMagick/issues/574; https://github.com/ImageMagick/ImageMagick/commit/0417cea1b6d72f90bd4f1f573f91e42a8ba66a89
CVE: CVE-2017-12665
Published: 2017-08-07
Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePICTImage in coders/pict.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/commit/c1b09bbec148f6ae11d0b686fdb89ac6dc0ab14e; https://github.com/ImageMagick/ImageMagick/issues/577; https://github.com/ImageMagick/ImageMagick/commit/c1b09bbec148f6ae11d0b686fdb89ac6dc0ab14e
CVE: CVE-2017-12666
Published: 2017-08-07
Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteINLINEImage in coders/inline.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100226; https://github.com/ImageMagick/ImageMagick/commit/d5559407ce29f4371e5df9c1cbde65455fe5854c; https://github.com/ImageMagick/ImageMagick/issues/572