deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14024
Published: 2017-11-13
Description: A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions, and InTouch Machine Edition v8.0 SP2 Patch 1 and prior versions. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution with high privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101779; https://ics-cert.us-cert.gov/advisories/ICSA-17-313-02; http://www.securityfocus.com/bid/101779
CVE: CVE-2017-16804
Published: 2017-11-13
Description: In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/redmine/redmine/commit/0f09f161f64f4190a52166675ff380a15b72a8bc; https://www.debian.org/security/2018/dsa-4191; https://www.redmine.org/issues/25713
CVE: CVE-2017-16805
Published: 2017-11-13
Description: In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file, related to r_bin_dwarf_parse_comp_unit in dwarf.c and sdb_set_internal in shlr/sdb/src/sdb.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/radare/radare2/commit/2ca9ab45891b6ae8e32b6c28c81eebca059cbe5d; https://github.com/radare/radare2/issues/8813; https://github.com/radare/radare2/commit/2ca9ab45891b6ae8e32b6c28c81eebca059cbe5d
CVE: CVE-2017-16806
Published: 2017-11-13
Description: The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/Ulterius/server/commit/770d1821de43cf1d0a93c79025995bdd812a76ee; https://www.exploit-db.com/exploits/43141/; https://github.com/Ulterius/server/commit/770d1821de43cf1d0a93c79025995bdd812a76ee
CVE: CVE-2017-16807
Published: 2017-11-13
Description: A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://getkirby.com/changelog/kirby-2-5-7; https://packetstormsecurity.com/files/144965/KirbyCMS-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/43140/
CVE: CVE-2017-16808
Published: 2017-11-13
Description: tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00065.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
CVE: CVE-2016-8610
Published: 2017-11-13
Description: A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://rhn.redhat.com/errata/RHSA-2017-0286.html; http://rhn.redhat.com/errata/RHSA-2017-0574.html; http://rhn.redhat.com/errata/RHSA-2017-1415.html
CVE: CVE-2017-15525
Published: 2017-11-13
Description: Prior to SEE v11.1.3MP1, Symantec Endpoint Encryption can be susceptible to a denial of service (DoS) attack, which is a type of attack whereby the perpetrator attempts to make a particular machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a specific host within a network.
CVSS Score: 4.5 (MEDIUM)
References: http://www.securityfocus.com/bid/101697; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171113_00; http://www.securityfocus.com/bid/101697
CVE: CVE-2017-15526
Published: 2017-11-13
Description: Prior to SEE v11.1.3MP1, Symantec Endpoint Encryption can be susceptible to a null pointer de-reference issue, which can result in a NullPointerException that can lead to a privilege escalation scenario.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/101698; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171113_00; http://www.securityfocus.com/bid/101698
CVE: CVE-2017-1221
Published: 2017-11-13
Description: IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123861.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: http://www.ibm.com/support/docview.wss?uid=swg22010177; http://www.securityfocus.com/bid/101683; https://exchange.xforce.ibmcloud.com/vulnerabilities/123861
CVE: CVE-2017-1229
Published: 2017-11-13
Description: IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 123908.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22005246; https://exchange.xforce.ibmcloud.com/vulnerabilities/123908; http://www.ibm.com/support/docview.wss?uid=swg22005246
CVE: CVE-2017-1453
Published: 2017-11-13
Description: IBM Security Access Manager Appliance 9.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 128372.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.ibm.com/support/docview.wss?uid=swg22009242; https://exchange.xforce.ibmcloud.com/vulnerabilities/128372; http://www.ibm.com/support/docview.wss?uid=swg22009242
CVE: CVE-2017-1477
Published: 2017-11-13
Description: IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 128612.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg22009240; https://exchange.xforce.ibmcloud.com/vulnerabilities/128612; http://www.ibm.com/support/docview.wss?uid=swg22009240
CVE: CVE-2017-1710
Published: 2017-11-13
Description: A vulnerability in the Service Assistant GUI in IBM Storwize V7000 (2076) 8.1 could allow a remote attacker to perform a privilege escalation. IBM X-Force ID: 134531.
CVSS Score: 9.8 (CRITICAL)
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1010788; http://www.securityfocus.com/bid/101770; http://www.securitytracker.com/id/1039776
CVE: CVE-2017-16810
Published: 2017-11-14
Description: Cross-site scripting (XSS) vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 (fixed in 3.13.7) allows remote attackers to inject arbitrary web script or HTML via the Variable Set Name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/OctopusDeploy/Issues/issues/3919; https://github.com/OctopusDeploy/Issues/issues/3919
CVE: CVE-2017-12624
Published: 2017-11-14
Description: Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".
CVSS Score: 5.5 (MEDIUM)
References: http://cxf.apache.org/security-advisories.data/CVE-2017-12624.txt.asc; http://www.securityfocus.com/bid/101859; http://www.securitytracker.com/id/1040486
CVE: CVE-2017-6274
Published: 2017-11-14
Description: An elevation of Privilege vulnerability exists in the Thermal Driver, where a missing bounds checks in the thermal throttle driver can cause an out-of-bounds write in the kernel. This issue is rated as moderate. Product: Pixel. Version: N/A. Android ID: A-34705801. References: N-CVE-2017-6274.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4787; https://source.android.com/security/bulletin/pixel/2017-11-01#announcements; https://nvidia.custhelp.com/app/answers/detail/a_id/4787
CVE: CVE-2017-6275
Published: 2017-11-14
Description: An information disclosure vulnerability exists in the Thermal Driver, where a missing bounds checking in the thermal driver could allow a read from an arbitrary kernel address. This issue is rated as moderate. Product: Pixel. Versions: N/A. Android ID: A-34702397. References: N-CVE-2017-6275.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4804; https://source.android.com/security/bulletin/pixel/2017-11-01#announcements; https://nvidia.custhelp.com/app/answers/detail/a_id/4804
CVE: CVE-2017-16239
Published: 2017-11-14
Description: In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/101950; https://access.redhat.com/errata/RHSA-2018:0241; https://access.redhat.com/errata/RHSA-2018:0314
CVE: CVE-2017-6264
Published: 2017-11-14
Description: An elevation of privilege vulnerability exists in the NVIDIA GPU driver (gm20b_clk_throt_set_cdev_state), where an out of bound memory read is used as a function pointer could lead to code execution in the kernel.This issue is rated as high because it could allow a local malicious application to execute arbitrary code within the context of a privileged process. Product: Android. Version: N/A. Android ID: A-34705430. References: N-CVE-2017-6264.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/101744; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101744
CVE: CVE-2017-9085
Published: 2017-11-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 6.5 to 8.0 allow remote attackers to inject arbitrary web script via the (1) "paramFile" parameter to /Site/Troubleshooting/DiagnosticReport.asp, or (2) "paramFile" parameter to /Site/Troubleshooting/SpeedTest.asp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/142587/Kodak-InSite-8.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/142587/Kodak-InSite-8.0-Cross-Site-Scripting.html
CVE: CVE-2017-16815
Published: 2017-11-14
Description: installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-content/plugins/duplicator/installer/build/view.step4.php) and "logging" (wp-content/plugins/duplicator/installer/build/view.step2.php) are not filtered correctly.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/144914/WordPress-Duplicator-Migration-1.2.28-Cross-Site-Scripting.html; https://snapcreek.com/duplicator/docs/changelog; https://packetstormsecurity.com/files/144914/WordPress-Duplicator-Migration-1.2.28-Cross-Site-Scripting.html
CVE: CVE-2017-12635
Published: 2017-11-14
Description: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://www.securityfocus.com/bid/101868; https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf[PII_REDACTED]1ebdf0c67%40%3Cdev.couchdb.apache.org%3E; https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html
CVE: CVE-2017-12636
Published: 2017-11-14
Description: CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf[PII_REDACTED]1ebdf0c67%40%3Cdev.couchdb.apache.org%3E; https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html; https://security.gentoo.org/glsa/201711-16
CVE: CVE-2017-16820
Published: 2017-11-14
Description: The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://access.redhat.com/errata/RHSA-2018:0252; https://access.redhat.com/errata/RHSA-2018:0299; https://access.redhat.com/errata/RHSA-2018:0560
CVE: CVE-2017-3891
Published: 2017-11-14
Description: In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on other QNX nodes regardless of permissions by executing commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-923, CWE-863
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000046674; https://www.midnightbluelabs.com/blog/2017/12/8/elevation-of-privilege-vulnerability-in-qnx-qnet; http://support.blackberry.com/kb/articleDetail?articleNumber=000046674
CVE: CVE-2017-3892
Published: 2017-11-14
Description: In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an information disclosure vulnerability in the default configuration of the QNX SDP could allow an attacker to gain information relating to memory layout that could be used in a blended attack by executing commands targeting procfs resources.
CVSS Score: 3.8 (LOW)
CWE: CWE-200, CWE-200
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000046674; http://support.blackberry.com/kb/articleDetail?articleNumber=000046674
CVE: CVE-2017-3893
Published: 2017-11-14
Description: In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers from modifying the GOT or PLT tables with buffer overflow attacks.
CVSS Score: 1.9 (LOW)
CWE: CWE-693, CWE-119
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000046674; http://support.blackberry.com/kb/articleDetail?articleNumber=000046674
CVE: CVE-2017-9369
Published: 2017-11-14
Description: In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, an information disclosure vulnerability in the default configuration of the QNX SDP could allow an attacker to gain information relating to memory layout of higher privileged processes by manipulating environment variables that influence the loader.
CVSS Score: 3.8 (LOW)
CWE: CWE-200, CWE-200
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000046674; http://support.blackberry.com/kb/articleDetail?articleNumber=000046674
CVE: CVE-2017-9371
Published: 2017-11-14
Description: In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an attacker being able to reduce the entropy of the PRNG, making other blended attacks more practical by gaining control over environmental factors that influence seed generation.
CVSS Score: 2.6 (LOW)
CWE: CWE-332, CWE-332
References: http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000046674; http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000046674
CVE: CVE-2017-9394
Published: 2017-11-14
Description: A stored cross-site scripting vulnerability in CA Identity Governance 12.6 allows remote authenticated attackers to display HTML or execute script in the context of another user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/101849; https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20171114-01--security-notice-for-ca-identity-governance.html; http://www.securityfocus.com/bid/101849
CVE: CVE-2017-10266
Published: 2017-11-14
Description: Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Tuxedo accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html; http://www.securityfocus.com/bid/101852; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html
CVE: CVE-2017-10267
Published: 2017-11-14
Description: Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html; http://www.securityfocus.com/bid/101875; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html
CVE: CVE-2017-10269
Published: 2017-11-14
Description: Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. While the vulnerability is in Oracle Tuxedo, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Tuxedo accessible data as well as unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Tuxedo. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L).
CVSS Score: 10.0 (CRITICAL)
References: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html; http://www.securityfocus.com/bid/101841; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html
CVE: CVE-2017-10272
Published: 2017-11-14
Description: Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via Jolt to compromise Oracle Tuxedo. While the vulnerability is in Oracle Tuxedo, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Tuxedo accessible data as well as unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Tuxedo. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).
CVSS Score: 9.9 (CRITICAL)
References: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html; http://www.securityfocus.com/bid/101871; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html
CVE: CVE-2017-10278
Published: 2017-11-14
Description: Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data as well as unauthorized update, insert or delete access to some of Oracle Tuxedo accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Tuxedo. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html; http://www.securityfocus.com/bid/101870; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10[PII_REDACTED].html
CVE: CVE-2017-11768
Published: 2017-11-15
Description: Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows remote attackers to test for the presence of files on disk via a specially crafted application. due to the way Windows Media Player discloses file information, aka "Windows Media Player Information Disclosure Vulnerability."
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101705; http://www.securitytracker.com/id/1039794; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11768