deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9385
Published: 2017-01-23
Description: The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94472; http://www.securitytracker.com/id/1037342; http://xenbits.xen.org/xsa/advisory-193.html
CVE: CVE-2016-9386
Published: 2017-01-23
Description: The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94471; http://www.securitytracker.com/id/1037340; http://xenbits.xen.org/xsa/advisory-191.html
CVE: CVE-2016-9401
Published: 2017-01-23
Description: popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0725.html; http://www.openwall.com/lists/oss-security/2016/11/17/5; http://www.openwall.com/lists/oss-security/2016/11/17/9
CVE: CVE-2016-9445
Published: 2017-01-23
Description: Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2016-2974.html; http://rhn.redhat.com/errata/RHSA-2017-0018.html; http://rhn.redhat.com/errata/RHSA-2017-0021.html
CVE: CVE-2016-9446
Published: 2017-01-23
Description: The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: http://www.openwall.com/lists/oss-security/2016/11/18/12; http://www.openwall.com/lists/oss-security/2016/11/18/13; http://www.securityfocus.com/bid/94423
CVE: CVE-2016-9447
Published: 2017-01-23
Description: The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: http://rhn.redhat.com/errata/RHSA-2016-2974.html; http://rhn.redhat.com/errata/RHSA-2017-0018.html; http://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-compromising-linux-desktop.html
CVE: CVE-2017-5371
Published: 2017-01-23
Description: Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process crash) via a series of crafted requests, aka SAP Security Note 2330422.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/140610/SAP-ASE-ODATA-Server-16-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2017/Jan/47; http://www.securityfocus.com/bid/93545
CVE: CVE-2017-5372
Published: 2017-01-23
Description: The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing authorization check for the (1) getInformation, (2) getParameters, (3) getServiceInfo, (4) getStatistic, or (5) getClientStatistic function, aka SAP Security Note 2331908.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/140611/SAP-NetWeaver-AS-Java-P4-MSPRUNTIMEINTERFACE-Information-Disclosure.html; http://seclists.org/fulldisclosure/2017/Jan/50; http://www.securityfocus.com/bid/93504
CVE: CVE-2017-2929
Published: 2017-01-24
Description: Adobe Acrobat Chrome extension version 15.1.0.3 and earlier have a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScript code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95693; http://www.securitytracker.com/id/1037687; https://helpx.adobe.com/security/products/acrobat/apsb17-03.html
CVE: CVE-2017-2970
Published: 2017-01-24
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the XSLT engine related to template manipulation. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95690; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html; http://www.securityfocus.com/bid/95690
CVE: CVE-2017-2971
Published: 2017-01-24
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the JPEG decoder routine. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95690; http://www.talosintelligence.com/reports/TALOS-2016-0259/; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html
CVE: CVE-2017-2972
Published: 2017-01-24
Description: Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in the image conversion module related to JPEG parsing. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95690; https://helpx.adobe.com/security/products/acrobat/apsb17-01.html; http://www.securityfocus.com/bid/95690
CVE: CVE-2017-5495
Published: 2017-01-24
Description: All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0794.html; http://savannah.nongnu.org/forum/forum.php?forum_id=8783; http://www.securityfocus.com/bid/95745
CVE: CVE-2016-10158
Published: 2017-01-24
Description: The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.debian.org/security/2017/dsa-3783
CVE: CVE-2016-10159
Published: 2017-01-24
Description: Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.debian.org/security/2017/dsa-3783
CVE: CVE-2016-10160
Published: 2017-01-24
Description: Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.debian.org/security/2017/dsa-3783
CVE: CVE-2016-10161
Published: 2017-01-24
Description: The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.debian.org/security/2017/dsa-3783
CVE: CVE-2016-10162
Published: 2017-01-24
Description: The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/95668; http://www.securitytracker.com/id/1037659
CVE: CVE-2016-9041
Published: 2017-01-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-2971.  Reason: This candidate is a reservation duplicate of CVE-2017-2971.  Notes: All CVE users should reference CVE-2017-2971 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-8214
Published: 2017-01-25
Description: EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3.0 and 7.3.1 contain a vulnerability that may allow malicious administrators to compromise Avamar servers.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-275
References: http://www.securityfocus.com/archive/1/540031/30/0/threaded; http://www.securityfocus.com/bid/95719; http://www.securitytracker.com/id/1037667
CVE: CVE-2016-8215
Published: 2017-01-25
Description: EMC RSA Security Analytics 10.5.3 and 10.6.2 contains fixes for a Reflected Cross-Site Scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/540032/30/0/threaded; http://www.securityfocus.com/bid/95718; http://www.securitytracker.com/id/1037666
CVE: CVE-2017-5594
Published: 2017-01-25
Description: An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: http://www.securityfocus.com/bid/95806; https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b; https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf
CVE: CVE-2016-9303
Published: 2017-01-25
Description: Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code or cause an infinite loop condition when reading or converting malformed FBX format files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01; http://www.securityfocus.com/bid/95805; http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01
CVE: CVE-2016-9304
Published: 2017-01-25
Description: Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DFX format files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01; http://www.securityfocus.com/bid/95799; http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01
CVE: CVE-2016-9305
Published: 2017-01-25
Description: Improper handling in the Autodesk FBX-SDK before 2017.1 of type mismatches and previously deleted objects related to reading and converting malformed FBX format files can allow attackers to gain access to uninitialized pointers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01; http://www.securityfocus.com/bid/95803; http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01
CVE: CVE-2016-9306
Published: 2017-01-25
Description: Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DAE format files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01; http://www.securityfocus.com/bid/95807; http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01
CVE: CVE-2016-9307
Published: 2017-01-25
Description: Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed 3DS format files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01; http://www.securityfocus.com/bid/95802; http://www.autodesk.com/trust/security-advisories/adsk-sa-2016-01
CVE: CVE-2017-5596
Published: 2017-01-25
Description: In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-835
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/95795; http://www.securitytracker.com/id/1037694
CVE: CVE-2017-5597
Published: 2017-01-25
Description: In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dhcpv6.c by changing a data type to avoid an integer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/95798; http://www.securitytracker.com/id/1037694
CVE: CVE-2016-9216
Published: 2017-01-26
Description: An IKE Packet Parsing Denial of Service Vulnerability in the ipsecmgr process of Cisco ASR 5000 Software could allow an unauthenticated, remote attacker to cause the ipsecmgr process to reload. More Information: CSCuy06917 CSCuy45036 CSCuy59525. Known Affected Releases: 20.0.0 20.0.M0.62842 20.0.v0 20.0.M0.63229 20.1.0 20.1.a0 20.1.v0 21.0.0 21.0.v0. Known Fixed Releases: 20.0.0 20.0.0.63250 20.0.M0.63148 20.0.R0.63294 20.0.R0.63316 20.0.V0.63170 20.0.VG0.63188 20.0.v0 20.0.v0.64175 20.0.vg0.63522 20.1.A0.63166 20.2.A0.63174 20.1.A0.63232 20.2.A0.63237 20.0.M0.63226 20.0.M0.63229 20.0.R0.63294 20.0.R0.63316 20.0.V0.63263 20.0.VG0.63233 20.0.v0 20.0.v0.64175 20.0.vg0.63522 20.1.0 20.1.0.63959 20.1.M0.63876 20.1.T0.63886 20.1.V0.64231 20.1.VA0.64194 20.1.VB0.64210 20.1.a0 20.1.a0.64023 20.1.v0 20.1.v0.64607 20.2.A0.63895 21.0.0 21.0.0.65256 21.0.M0.63881 21.0.M0.64281 21.0.PP0.64366 21.0.V0.65052 21.0.v0 21.0.v0.65831 21.0.vb0.65887 21.1.R0.65130 21.1.R0.65135.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/95629; http://www.securitytracker.com/id/1037652; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-asr
CVE: CVE-2016-9218
Published: 2017-01-26
Description: A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. More Information: CSCvc28662. Known Affected Releases: 1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/95634; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-hms; http://www.securityfocus.com/bid/95634
CVE: CVE-2016-9220
Published: 2017-01-26
Description: A Denial of Service Vulnerability in 802.11 ingress packet processing of the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause the connection table to be full of invalid connections and be unable to process new incoming requests. More Information: CSCvb66659. Known Affected Releases: 8.2(130.0). Known Fixed Releases: 8.2(131.10) 8.2(131.6) 8.2(141.0) 8.3(104.56) 8.4(1.88) 8.4(1.91).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/95633; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-cme1; http://www.securityfocus.com/bid/95633
CVE: CVE-2016-9221
Published: 2017-01-26
Description: A Denial of Service Vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause authentication to fail. Affected Products: This vulnerability affects Cisco Mobility Express 2800 Series and 3800 Series Access Points when configured in local mode in 40 MHz. More Information: CSCvb33575. Known Affected Releases: 8.2(121.12) 8.4(1.82). Known Fixed Releases: 8.2(131.2) 8.2(131.3) 8.2(131.4) 8.2(141.0) 8.3(104.53) 8.3(104.54) 8.4(1.80) 8.4(1.85).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/95631; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-cme2; http://www.securityfocus.com/bid/95631
CVE: CVE-2016-9222
Published: 2017-01-26
Description: A vulnerability in the web-based management interface of Cisco NetFlow Generation Appliance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvb15229. Known Affected Releases: 1.0(2).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95640; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-nga; http://www.securityfocus.com/bid/95640
CVE: CVE-2017-3794
Published: 2017-01-26
Description: A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against an administrative user. More Information: CSCuz03317. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/95635; http://www.securitytracker.com/id/1037649; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-wms
CVE: CVE-2017-3795
Published: 2017-01-26
Description: A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrative user. More Information: CSCuz03345. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/95643; http://www.securitytracker.com/id/1037650; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-wms1
CVE: CVE-2017-3796
Published: 2017-01-26
Description: A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts. More Information: CSCuz03353. Known Affected Releases: 2.6.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/95641; http://www.securitytracker.com/id/1037651; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-wms2
CVE: CVE-2017-3797
Published: 2017-01-26
Description: A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view the fully qualified domain name of the Cisco WebEx administration server. More Information: CSCvb60655. Known Affected Releases: 2.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95639; http://www.securitytracker.com/id/1037648; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-wms3
CVE: CVE-2017-3798
Published: 2017-01-26
Description: A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to mount XSS attacks against a user of an affected device. More Information: CSCvb97237. Known Affected Releases: 11.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 11.5(1.12029.1) 11.5(1.12900.11) 12.0(0.98000.369) 12.0(0.98000.370) 12.0(0.98000.398) 12.0(0.98000.457).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95872; http://www.securitytracker.com/id/1037653; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-cucm
CVE: CVE-2017-3799
Published: 2017-01-26
Description: A vulnerability in a URL parameter of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to perform site redirection. More Information: CSCzu78401. Known Affected Releases: T28.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/95642; http://www.securitytracker.com/id/1037647; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-wms4
CVE: CVE-2017-3800
Published: 2017-01-26
Description: A vulnerability in the content scanning engine of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured message or content filters on the device. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. More Information: CSCuz16076. Known Affected Releases: 9.7.1-066 9.7.1-HP2-207 9.8.5-085. Known Fixed Releases: 10.0.1-083 10.0.1-087.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/95637; http://www.securitytracker.com/id/1037656; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-esa
CVE: CVE-2017-3802
Published: 2017-01-26
Description: A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc20679. Known Affected Releases: 12.0(0.99000.9). Known Fixed Releases: 12.0(0.98000.176) 12.0(0.98000.414) 12.0(0.98000.531) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.8).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95636; http://www.securitytracker.com/id/1037655; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-cucm1
CVE: CVE-2017-3803
Published: 2017-01-26
Description: A vulnerability in the Cisco IOS Software forwarding queue of Cisco 2960X and 3750X switches could allow an unauthenticated, adjacent attacker to cause a memory leak in the software forwarding queue that would eventually lead to a partial denial of service (DoS) condition. More Information: CSCva72252. Known Affected Releases: 15.2(2)E3 15.2(4)E1. Known Fixed Releases: 15.2(2)E6 15.2(4)E3 15.2(5)E1 15.2(5.3.28i)E1 15.2(6.0.49i)E 3.9(1)E.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/95632; http://www.securitytracker.com/id/1037657; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-catalyst