deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12377
Published: 2018-01-26
Description: ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a heap-based buffer over-read condition in mew.c when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code on the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html; https://bugzilla.clamav.net/show_bug.cgi?id=11943; https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
CVE: CVE-2017-12378
Published: 2018-01-26
Description: ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a checksum buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html; https://bugzilla.clamav.net/show_bug.cgi?id=11946; https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
CVE: CVE-2017-12379
Published: 2018-01-26
Description: ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a messageAddArgument (in message.c) buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html; https://bugzilla.clamav.net/show_bug.cgi?id=11944; https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
CVE: CVE-2017-12380
Published: 2018-01-26
Description: ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms in mbox.c during certain mail parsing functions of the ClamAV software. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. An exploit could trigger a NULL pointer dereference condition when ClamAV scans the malicious email, which may result in a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html; https://bugzilla.clamav.net/show_bug.cgi?id=11945; https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
CVE: CVE-2017-14521
Published: 2018-01-26
Description: In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://securitywarrior9.blogspot.in/2018/01/vulnerability-in-wonder-cms-leading-to.html; https://www.exploit-db.com/exploits/43963/; https://securitywarrior9.blogspot.in/2018/01/vulnerability-in-wonder-cms-leading-to.html
CVE: CVE-2017-14522
Published: 2018-01-26
Description: In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://securitywarrior9.blogspot.in/2018/01/stored-xss-in-wonder-cms.html; https://securitywarrior9.blogspot.in/2018/01/stored-xss-in-wonder-cms.html
CVE: CVE-2017-14523
Published: 2018-01-26
Description: WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://securitywarrior9.blogspot.in/2018/01/host-header-injection-in-wonder-cms.html; https://www.exploit-db.com/exploits/43964/; https://securitywarrior9.blogspot.in/2018/01/host-header-injection-in-wonder-cms.html
CVE: CVE-2017-17976
Published: 2018-01-26
Description: In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/145903/PerfexCRM-1.9.7-Arbitrary-File-Upload.html; https://www.exploit-db.com/exploits/43590/; http://packetstormsecurity.com/files/145903/PerfexCRM-1.9.7-Arbitrary-File-Upload.html
CVE: CVE-2018-6015
Published: 2018-01-26
Description: An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blog.threatpress.com/vulnerability-email-subscribers-plugin/; https://wordpress.org/plugins/email-subscribers/#developers; https://www.exploit-db.com/exploits/43872/
CVE: CVE-2016-2983
Published: 2018-01-26
Description: IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLS session state for any active sessions, cause denial of service, or bypass security. IBM X-Force ID: 113999.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22006393; http://www.ibm.com/support/docview.wss?uid=swg22006455; http://www.securityfocus.com/bid/102891
CVE: CVE-2017-1204
Published: 2018-01-26
Description: IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials. A remote attacker could exploit this vulnerability to gain access to the system. IBM X-Force ID: 123740.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.ibm.com/support/docview.wss?uid=swg22006392; http://www.ibm.com/support/docview.wss?uid=swg22006455; https://exchange.xforce.ibmcloud.com/vulnerabilities/123740
CVE: CVE-2017-1279
Published: 2018-01-26
Description: IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 124757.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.ibm.com/support/docview.wss?uid=swg22006392; https://exchange.xforce.ibmcloud.com/vulnerabilities/124757; http://www.ibm.com/support/docview.wss?uid=swg22006392
CVE: CVE-2017-1506
Published: 2018-01-26
Description: IBM Cognos TM1 10.2 and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129617.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012623; http://www.securityfocus.com/bid/102892; http://www.securitytracker.com/id/1040302
CVE: CVE-2017-1515
Published: 2018-01-26
Description: IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses. IBM X-Force ID: 129825.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22012789; http://www.securityfocus.com/bid/102872; https://exchange.xforce.ibmcloud.com/vulnerabilities/129825
CVE: CVE-2017-1516
Published: 2018-01-26
Description: IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 129826.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22012789; http://www.securityfocus.com/bid/102867; https://exchange.xforce.ibmcloud.com/vulnerabilities/129826
CVE: CVE-2017-1532
Published: 2018-01-26
Description: IBM DOORS 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130411.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012789; http://www.securityfocus.com/bid/102888; https://exchange.xforce.ibmcloud.com/vulnerabilities/130411
CVE: CVE-2017-1540
Published: 2018-01-26
Description: IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130808.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012789; http://www.securityfocus.com/bid/102890; https://exchange.xforce.ibmcloud.com/vulnerabilities/130808
CVE: CVE-2017-1545
Published: 2018-01-26
Description: IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stored credentials. IBM X-Force ID: 130914.
CVSS Score: 6.8 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22012789; http://www.securityfocus.com/bid/102896; https://exchange.xforce.ibmcloud.com/vulnerabilities/130914
CVE: CVE-2017-1563
Published: 2018-01-26
Description: IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131763.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012789; http://www.securityfocus.com/bid/102862; https://exchange.xforce.ibmcloud.com/vulnerabilities/131763
CVE: CVE-2017-1567
Published: 2018-01-26
Description: IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131769.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012789; http://www.securityfocus.com/bid/102851; https://exchange.xforce.ibmcloud.com/vulnerabilities/131769
CVE: CVE-2017-1653
Published: 2018-01-26
Description: IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 6.0.x) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133268.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012712; http://www.securityfocus.com/bid/102853; http://www.securitytracker.com/id/1040305
CVE: CVE-2017-18077
Published: 2018-01-27
Description: index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugs.debian.org/862712; https://github.com/juliangruber/brace-expansion/issues/33; https://github.com/juliangruber/brace-expansion/pull/35/commits/b13381281cead487cbdbfd6a69fb097ea5e456c3
CVE: CVE-2018-6352
Published: 2018-01-27
Description: In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1539237; https://bugzilla.redhat.com/show_bug.cgi?id=1539237
CVE: CVE-2018-6353
Published: 2018-01-27
Description: The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering attacks in which a user pastes code that they do not understand and (2) code pasted by a physically proximate attacker at an unattended workstation, which makes it easier for attackers to steal Bitcoin via hook code that runs at a later time when the wallet password has been entered, a different vulnerability than CVE-2[PII_REDACTED].
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/spesmilo/electrum/issues/3678; https://github.com/spesmilo/electrum/pull/3700; https://github.com/spesmilo/electrum/issues/3678
CVE: CVE-2018-6354
Published: 2018-01-27
Description: templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/formspree/formspree/commit/5f18eeaaa459bee9a58f70cdf7c46adb1ef34ea7; https://github.com/formspree/formspree/commit/5f18eeaaa459bee9a58f70cdf7c46adb1ef34ea7
CVE: CVE-2018-6357
Published: 2018-01-27
Description: The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: http://lists.openwall.net/full-disclosure/2018/01/10/8; https://wordpress.org/plugins/acurax-social-media-widget/#developers; http://lists.openwall.net/full-disclosure/2018/01/10/8
CVE: CVE-2018-6358
Published: 2018-01-27
Description: The printDefineFont2 function (util/listfdb.c) in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attackers to cause a denial of service or unspecified other impact via a crafted FDB file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/libming/libming/issues/104; https://lists.debian.org/debian-lts-announce/2018/04/msg00008.html; https://security.gentoo.org/glsa/201904-24
CVE: CVE-2018-6359
Published: 2018-01-27
Description: The decompileIF function (util/decompile.c) in libming through 0.4.8 is vulnerable to a use-after-free, which may allow attackers to cause a denial of service or unspecified other impact via a crafted SWF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102856; https://github.com/libming/libming/issues/105; https://lists.debian.org/debian-lts-announce/2018/03/msg00008.html
CVE: CVE-2018-6360
Published: 2018-01-28
Description: mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/mpv-player/mpv/commit/e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43; https://github.com/mpv-player/mpv/issues/5456; https://security.gentoo.org/glsa/201805-05
CVE: CVE-2017-18078
Published: 2018-01-29
Description: systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-updates/2018-02/msg00109.html; http://packetstormsecurity.com/files/146184/systemd-Local-Privilege-Escalation.html; http://www.openwall.com/lists/oss-security/2018/01/29/3
CVE: CVE-2017-18079
Published: 2018-01-29
Description: drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=340d394a789518018f834ff70f7534fc463d3226; http://www.securityfocus.com/bid/102895; https://github.com/torvalds/linux/commit/340d394a789518018f834ff70f7534fc463d3226
CVE: CVE-2018-5720
Published: 2018-01-29
Description: An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead to changing an existing user's username and password, changing the Wi-Fi password, etc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/43898/; https://www.exploit-db.com/exploits/43898/
CVE: CVE-2018-6007
Published: 2018-01-29
Description: CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://packetstormsecurity.com/files/146135/Joomla-JS-Support-Ticket-1.1.0-Cross-Site-Request-Forgery.html; https://www.exploit-db.com/exploits/43912/; https://packetstormsecurity.com/files/146135/Joomla-JS-Support-Ticket-1.1.0-Cross-Site-Request-Forgery.html
CVE: CVE-2018-6008
Published: 2018-01-29
Description: Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://packetstormsecurity.com/files/146137/Joomla-Jtag-Members-Directory-5.3.7-Arbitrary-File-Download.html; https://www.exploit-db.com/exploits/43913/; https://packetstormsecurity.com/files/146137/Joomla-Jtag-Members-Directory-5.3.7-Arbitrary-File-Download.html
CVE: CVE-2018-6363
Published: 2018-01-29
Description: SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/146131/Task-Rabbit-Clone-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/43914/; https://packetstormsecurity.com/files/146131/Task-Rabbit-Clone-1.0-SQL-Injection.html
CVE: CVE-2018-6364
Published: 2018-01-29
Description: SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/146130/Multilanguage-Real-Estate-MLM-Script-3.0-SQL-Injection.html; https://www.exploit-db.com/exploits/43917/; https://packetstormsecurity.com/files/146130/Multilanguage-Real-Estate-MLM-Script-3.0-SQL-Injection.html
CVE: CVE-2018-6365
Published: 2018-01-29
Description: SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/146128/TSiteBuilder-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/43915/; https://packetstormsecurity.com/files/146128/TSiteBuilder-1.0-SQL-Injection.html
CVE: CVE-2018-6367
Published: 2018-01-29
Description: SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/146136/Vastal-I-Tech-Facebook-Clone-2.9.9-SQL-Injection.html; https://www.exploit-db.com/exploits/43918/; https://packetstormsecurity.com/files/146136/Vastal-I-Tech-Facebook-Clone-2.9.9-SQL-Injection.html
CVE: CVE-2017-14190
Published: 2018-01-29
Description: A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102779; http://www.securitytracker.com/id/1040284; https://fortiguard.com/advisory/FG-IR-17-262
CVE: CVE-2017-14698
Published: 2018-01-29
Description: ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote attackers to change passwords of arbitrary users via the http_passwd parameter to mod_login.asp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/; https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers/; https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/
CVE: CVE-2017-14699
Published: 2018-01-29
Description: Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U, DSL-N66U, and DSL-AC750 routers allow remote authenticated users to read arbitrary files via a crafted DTD in (1) an UPDATEACCOUNT or (2) a PROPFIND request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/; https://www.securityartwork.es/2018/01/25/some-vulnerability-in-asus-routers/; https://www.asus.com/Networking/DSL-N14U-B1/HelpDesk_BIOS/
CVE: CVE-2017-1779
Published: 2018-01-29
Description: IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user. IBM X-Force ID: 136824.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://www.ibm.com/support/docview.wss?uid=swg22011561; http://www.securityfocus.com/bid/102858; http://www.securitytracker.com/id/1040299
CVE: CVE-2017-1783
Published: 2018-01-29
Description: IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without proper authentication. IBM X-Force ID: 136857.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=swg22011561; http://www.securityfocus.com/bid/102863; http://www.securitytracker.com/id/1040299
CVE: CVE-2017-1784
Published: 2018-01-29
Description: IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can be read by a local user. IBM X-Force ID: 136858.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22011561; http://www.securitytracker.com/id/1040299; https://exchange.xforce.ibmcloud.com/vulnerabilities/136858