deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6955
Published: 2017-03-17
Description: An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96965; https://github.com/boonebgorges/invite-anyone/compare/2ed5266ad3ae40f8db39adf06f450bbad56e2eac...boonebgorges:6121de08df86c5005b657dd67e48aa02c7982855; https://wordpress.org/plugins/invite-anyone/changelog/
CVE: CVE-2017-6958
Published: 2017-03-17
Description: An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search result page allows an attacker to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by crafting any valid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mantisbt-plugins/source-integration/issues/205; https://github.com/mantisbt-plugins/source-integration/issues/205
CVE: CVE-2017-6960
Published: 2017-03-17
Description: An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer over-read, related to the load_apng function and the imagesize variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854367; https://lists.debian.org/debian-lts-announce/2020/03/msg00039.html; https://usn.ubuntu.com/4513-1/
CVE: CVE-2017-6961
Published: 2017-03-17
Description: An issue was discovered in apng2gif 1.7. There is improper sanitization of user input causing huge memory allocations, resulting in a crash. This is related to the read_chunk function using the pChunk->size value (within the PNG file) to determine the amount of memory to allocate.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854441; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854441
CVE: CVE-2017-6962
Published: 2017-03-17
Description: An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer overflow. This is related to the read_chunk function making an unchecked addition of 12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854447; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854447
CVE: CVE-2017-6965
Published: 2017-03-17
Description: readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://security.gentoo.org/glsa/201709-02; https://sourceware.org/bugzilla/show_bug.cgi?id=21137; https://security.gentoo.org/glsa/201709-02
CVE: CVE-2017-6966
Published: 2017-03-17
Description: readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://security.gentoo.org/glsa/201709-02; https://sourceware.org/bugzilla/show_bug.cgi?id=21139; https://security.gentoo.org/glsa/201709-02
CVE: CVE-2017-6967
Published: 2017-03-17
Description: xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://bugs.launchpad.net/ubuntu/+source/xrdp/+bug/1672742; https://github.com/neutrinolabs/xrdp/issues/350; https://github.com/neutrinolabs/xrdp/pull/694
CVE: CVE-2017-6969
Published: 2017-03-17
Description: readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97065; https://security.gentoo.org/glsa/201709-02; https://sourceware.org/bugzilla/show_bug.cgi?id=21156
CVE: CVE-2014-8701
Published: 2017-03-17
Description: Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/wonder_cms_2014.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2014-8702
Published: 2017-03-17
Description: Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/wonder_cms_2014.txt; http://www.securityfocus.com/bid/97192
CVE: CVE-2014-8703
Published: 2017-03-17
Description: Cross-site scripting (XSS) vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/wonder_cms_2014.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2014-8704
Published: 2017-03-17
Description: Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/portfolio.php
CVE: CVE-2014-8705
Published: 2017-03-17
Description: PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/wonder_cms_2014.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2014-8706
Published: 2017-03-17
Description: Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSID"; (3) changing the image parameter to an array; or (4) changing the image parameter to a string, which reveals the installation path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/pluck_cms_4.7.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2014-8707
Published: 2017-03-17
Description: Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/pluck_cms_4.7.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2014-8708
Published: 2017-03-17
Description: Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/pluck_cms_4.7.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2014-8722
Published: 2017-03-17
Description: GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/162906/GetSimple-CMS-3.3.4-Information-Disclosure.html; http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/getSimple_cms_3.3.4.txt
CVE: CVE-2014-8723
Published: 2017-03-17
Description: GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous_data.php or (2) plugins/InnovationPlugin.php, which reveals the installation path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/getSimple_cms_3.3.4.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2014-9852
Published: 2017-03-17
Description: distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-913
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00018.html
CVE: CVE-2014-9853
Published: 2017-03-17
Description: Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html
CVE: CVE-2014-9854
Published: 2017-03-17
Description: coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image."
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://git.imagemagick.org/repos/ImageMagick/commit/7fb9b7e095a65b4528d0180e26574f2bc7cd0e8b; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html
CVE: CVE-2015-3881
Published: 2017-03-17
Description: Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/qdPM_8.3.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2015-3882
Published: 2017-03-17
Description: qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/qdPM_8.3.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2015-3883
Published: 2017-03-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] parameter to index.php/users page; the (2) "Name of application" on index.php/configuration; (3) a new project name on index.php/projects; (4) the task name on index.php/tasks; (5) ticket name on index.php/tickets; (6) discussion name on index.php/discussions; (7) report name on index.php/projectReports; or (8) event name on index.php/scheduler/personal.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/qdPM_8.3.txt; http://rossmarks.uk/portfolio.php
CVE: CVE-2015-3884
Published: 2017-03-17
Description: Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.html; http://rossmarks.uk/portfolio.php; http://rossmarks.uk/whitepapers/qdPM_8.3.txt
CVE: CVE-2015-4645
Published: 2017-03-17
Description: Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162171.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162226.html; http://www.securityfocus.com/bid/75272
CVE: CVE-2015-7313
Published: 2017-03-17
Description: LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://seclists.org/oss-sec/2015/q3/601; http://www.securityfocus.com/bid/76843; https://bugzilla.redhat.com/show_bug.cgi?id=1265998
CVE: CVE-2017-6370
Published: 2017-03-17
Description: TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.securityfocus.com/bid/97071; https://github.com/faizzaidi/TYPO3-v7.6.15-Unencrypted-Login-Request; http://www.securityfocus.com/bid/97071
CVE: CVE-2017-6880
Published: 2017-03-17
Description: Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/41620/; https://www.exploit-db.com/exploits/41620/
CVE: CVE-2017-3811
Published: 2017-03-17
Description: An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc39165. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.2054.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/96912; http://www.securitytracker.com/id/1038042; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-wms
CVE: CVE-2017-3815
Published: 2017-03-17
Description: An API Privilege vulnerability in Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to emulate Cisco TelePresence Server endpoints. Affected Products: This vulnerability affects Cisco TelePresence Server MSE 8710 Processors that are running a software release prior to Cisco TelePresence Software Release 4.3 and are running in locally managed mode. The vulnerable API was deprecated in Cisco TelePresence Software Release 4.3. More Information: CSCvc37616.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.securityfocus.com/bid/96922; http://www.securitytracker.com/id/1038035; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-tps
CVE: CVE-2017-3866
Published: 2017-03-17
Description: A vulnerability in the web framework code of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvc79842 CSCvc79846 CSCvc79855 CSCvc79873 CSCvc79882 CSCvc79891. Known Affected Releases: 11.1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96917; http://www.securitytracker.com/id/1038045; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-psc
CVE: CVE-2017-3867
Published: 2017-03-17
Description: A vulnerability in the Border Gateway Protocol (BGP) Bidirectional Forwarding Detection (BFD) implementation of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to bypass the access control list (ACL) for specific TCP and UDP traffic. More Information: CSCvc68229. Known Affected Releases: 9.6(2). Known Fixed Releases: 99.1(20.1) 99.1(10.2) 98.1(12.7) 98.1(1.49) 97.1(6.58) 97.1(0.134) 96.2(0.109) 9.7(1.1) 9.6(2.99) 9.6(2.8).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/96926; http://www.securitytracker.com/id/1038051; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asa
CVE: CVE-2017-3868
Published: 2017-03-17
Description: A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc44344. Known Affected Releases: 6.0(0.0).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96921; http://www.securitytracker.com/id/1038039; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucs
CVE: CVE-2017-3869
Published: 2017-03-17
Description: An API Credentials Management vulnerability in the APIs for Cisco Prime Infrastructure could allow an authenticated, remote attacker to access an API that should be restricted to a privileged user. The attacker needs to have valid credentials. More Information: CSCuy36192. Known Affected Releases: 3.1(1) 3.1(1).
CVSS Score: 5.4 (MEDIUM)
References: http://www.securityfocus.com/bid/96931; http://www.securitytracker.com/id/1038048; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-cpi
CVE: CVE-2017-3870
Published: 2017-03-17
Description: A vulnerability in the URL filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass a configured URL filter rule. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA), both virtual and hardware appliances, that are configured with URL filters for email scanning. More Information: CSCvc69700. Known Affected Releases: 8.5.3-069 9.1.1-074 9.1.2-010.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96907; http://www.securitytracker.com/id/1038043; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-wsa
CVE: CVE-2017-3871
Published: 2017-03-17
Description: A RADIUS Secret Disclosure vulnerability in the web network management interface of Cisco Prime Optical for Service Providers could allow an authenticated, remote attacker to disclose sensitive information in the configuration generated for a device. The attacker must have valid credentials for the device. More Information: CSCvc65257. Known Affected Releases: 10.6(0.1).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96928; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-cpo; http://www.securityfocus.com/bid/96928
CVE: CVE-2017-3872
Published: 2017-03-17
Description: A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct XSS attacks against a user of an affected device. More Information: CSCvc21620. Known Affected Releases: 10.5(2.14076.1). Known Fixed Releases: 12.0(0.98000.641) 12.0(0.98000.500) 12.0(0.98000.219).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96916; http://www.securitytracker.com/id/1038036; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucm
CVE: CVE-2017-3874
Published: 2017-03-17
Description: A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack. More Information: CSCvb70033. Known Affected Releases: 11.5(1.11007.2). Known Fixed Releases: 12.0(0.98000.507) 11.0(1.23900.5) 11.0(1.23900.3) 10.5(2.15900.2).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96914; http://www.securitytracker.com/id/1038037; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucm1
CVE: CVE-2017-3875
Published: 2017-03-17
Description: An Access-Control Filtering Mechanisms Bypass vulnerability in certain access-control filtering mechanisms on Cisco Nexus 7000 Series Switches could allow an unauthenticated, remote attacker to bypass defined traffic configured within an access control list (ACL) on the affected system. More Information: CSCtz59354. Known Affected Releases: 5.2(4) 6.1(3)S5 6.1(3)S6 6.2(1.121)S0 7.2(1)D1(1) 7.3(0)ZN(0.161) 7.3(1)N1(0.1). Known Fixed Releases: 7.3(0)D1(1) 6.2(2) 6.1(5) 8.3(0)KMT(0.24) 8.3(0)CV(0.337) 7.3(1)N1(1) 7.3(0)ZN(0.210) 7.3(0)ZN(0.177) 7.3(0)ZD(0.194) 7.3(0)TSH(0.99) 7.3(0)SC(0.14) 7.3(0)RSP(0.7) 7.3(0)N1(1) 7.3(0)N1(0.193) 7.3(0)IZN(0.13) 7.3(0)IB(0.102) 7.3(0)GLF(0.44) 7.3(0)D1(0.178) 7.1(0)D1(0.14) 7.0(3)ITI2(1.6) 7.0(3)ISH1(2.13) 7.0(3)IFD6(0.78) 7.0(3)IFD6(0) 7.0(3)IDE6(0.12) 7.0(3)IDE6(0) 7.0(3)I2(1) 7.0(3)I2(0.315) 7.0(1)ZD(0.3) 7.0(0)ZD(0.84) 6.2(1.149)S0 6.2(0.285) 6.1(5.32)S0 6.1(4.97)S0 6.1(2.30)S0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96930; http://www.securitytracker.com/id/1038049; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-cns
CVE: CVE-2017-3877
Published: 2017-03-17
Description: A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web interface of the affected software. More Information: CSCvb70021. Known Affected Releases: 11.5(1.11007.2).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/96915; http://www.securitytracker.com/id/1038038; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucm2
CVE: CVE-2017-3878
Published: 2017-03-17
Description: A Denial of Service vulnerability in the Telnet remote login functionality of Cisco NX-OS Software running on Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to cause a Telnet process used for login to terminate unexpectedly and the login attempt to fail. There is no impact to user traffic flowing through the device. Affected Products: This vulnerability affects Cisco Nexus 9000 Series Switches that are running Cisco NX-OS Software and are configured to allow remote Telnet connections to the device. More Information: CSCux46778. Known Affected Releases: 7.0(3)I3(0.170). Known Fixed Releases: 7.0(3)I3(1) 7.0(3)I3(0.257) 7.0(3)I3(0.255) 7.0(3)I2(2e) 7.0(3)F1(1.22) 7.0(3)F1(1).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96927; http://www.securitytracker.com/id/1038047; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-nss
CVE: CVE-2017-3879
Published: 2017-03-17
Description: A Denial of Service vulnerability in the remote login functionality for Cisco NX-OS Software running on Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to cause a process used for login to terminate unexpectedly and the login attempt to fail. There is no impact to user traffic flowing through the device. The attacker could use either a Telnet or an SSH client for the remote login attempt. Affected Products: This vulnerability affects Cisco Nexus 9000 Series Switches that are running Cisco NX-OS Software and are configured to allow remote Telnet connections to the device. More Information: CSCuy25824. Known Affected Releases: 7.0(3)I3(1) 8.3(0)CV(0.342) 8.3(0)CV(0.345). Known Fixed Releases: 8.3(0)CV(0.362) 8.0(1) 7.0(3)IED5(0.19) 7.0(3)IED5(0) 7.0(3)I4(1) 7.0(3)I4(0.8) 7.0(3)I2(2e) 7.0(3)F1(1.22) 7.0(3)F1(1) 7.0(3)F1(0.230).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96920; http://www.securitytracker.com/id/1038046; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-nss1