deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6754
Published: 2017-08-07
Description: A vulnerability in the web-based management interface of the Cisco Smart Net Total Care (SNTC) Software Collector Appliance 3.11 could allow an authenticated, remote attacker to perform a read-only, blind SQL injection attack, which could allow the attacker to compromise the confidentiality of the system through SQL timing attacks. The vulnerability is due to insufficient input validation of certain user-supplied fields that are subsequently used by the affected software to build SQL queries. An attacker could exploit this vulnerability by submitting crafted URLs, which are designed to exploit the vulnerability, to the affected software. To execute an attack successfully, the attacker would need to submit a number of requests to the affected software. A successful exploit could allow the attacker to determine the presence of values in the SQL database of the affected software. Cisco Bug IDs: CSCvf07617.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/100126; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf07617; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-sntc
CVE: CVE-2017-6756
Published: 2017-08-07
Description: A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of defense against cross-site request forgery (CSRF) attacks. An attacker could exploit this vulnerability by forcing the user's browser to perform any action authorized for that user. Cisco Bug IDs: CSCvc90280.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/100112; http://www.securitytracker.com/id/1039061; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-pcpt1
CVE: CVE-2017-6757
Published: 2017-08-07
Description: A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this vulnerability by sending crafted URLs that include SQL statements. An exploit could allow the attacker to modify or delete entries in some database tables, affecting the integrity of the data. Cisco Bug IDs: CSCve13786.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/100121; http://www.securitytracker.com/id/1039063; https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13786
CVE: CVE-2017-6758
Published: 2017-08-07
Description: A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem. Cisco Bug IDs: CSCve13796.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/100119; http://www.securitytracker.com/id/1039064; https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796
CVE: CVE-2017-6759
Published: 2017-08-07
Description: A vulnerability in the UpgradeManager of the Cisco Prime Collaboration Provisioning Tool 12.1 could allow an authenticated, remote attacker to write arbitrary files as root on the system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by triggering the upgrade package installation functionality. Cisco Bug IDs: CSCvc90304.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securitytracker.com/id/1039062; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc90304; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-pcpt
CVE: CVE-2017-6761
Published: 2017-08-07
Description: A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd96744.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100110; http://www.securitytracker.com/id/1039059; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvd96744
CVE: CVE-2017-6762
Published: 2017-08-07
Description: A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve09718.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100108; http://www.securitytracker.com/id/1039060; https://quickview.cloudapps.cisco.com/quickview/bug/CSCve09718
CVE: CVE-2017-6763
Published: 2017-08-07
Description: A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server (CMS) 2.1.4 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability exists because the affected application does not properly validate Fragmentation Unit (FU-A) protocol packets. An attacker could exploit this vulnerability by sending a crafted H.264 FU-A packet through the affected application. A successful exploit could allow the attacker to cause a DoS condition on the affected system due to an unexpected restart of the CMS media process on the system. Although the CMS platform continues to operate and only the single, affected CMS media process is restarted, a brief interruption of media traffic for certain users could occur. Cisco Bug IDs: CSCve10131.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100111; http://www.securitytracker.com/id/1039058; https://quickview.cloudapps.cisco.com/quickview/bug/CSCve10131
CVE: CVE-2017-6764
Published: 2017-08-07
Description: A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd82064.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100107; http://www.securitytracker.com/id/1039055; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvd82064
CVE: CVE-2017-6765
Published: 2017-08-07
Description: A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device, aka WebVPN XSS. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve19179.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100150; http://www.securitytracker.com/id/1039056; https://quickview.cloudapps.cisco.com/quickview/bug/CSCve19179
CVE: CVE-2017-6766
Published: 2017-08-07
Description: A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, and 6.2.2 could allow an unauthenticated, remote attacker to bypass the SSL policy for decrypting and inspecting traffic on an affected system. The vulnerability is due to unexpected interaction with Known Key and Decrypt and Resign configuration settings of SSL policies when the affected software receives unexpected SSL packet headers. An attacker could exploit this vulnerability by sending a crafted SSL packet through an affected device in a valid SSL session. A successful exploit could allow the attacker to bypass the SSL decryption and inspection policy for the affected system, which could allow traffic to flow through the system without being inspected. Cisco Bug IDs: CSCve12652.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: https://quickview.cloudapps.cisco.com/quickview/bug/CSCve12652; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-fpw; https://quickview.cloudapps.cisco.com/quickview/bug/CSCve12652
CVE: CVE-2017-6769
Published: 2017-08-07
Description: A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCve70587. Known Affected Releases: 5.8(0.8) 5.8(1.5).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99985; http://www.securitytracker.com/id/1038996; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170726-acs
CVE: CVE-2017-6770
Published: 2017-08-07
Description: Cisco IOS 12.0 through 15.6, Adaptive Security Appliance (ASA) Software 7.0.1 through 9.7.1.2, NX-OS 4.0 through 12.0, and IOS XE 3.6 through 3.18 are affected by a vulnerability involving the Open Shortest Path First (OSPF) Routing Protocol Link State Advertisement (LSA) database. This vulnerability could allow an unauthenticated, remote attacker to take full control of the OSPF Autonomous System (AS) domain routing table, allowing the attacker to intercept or black-hole traffic. The attacker could exploit this vulnerability by injecting crafted OSPF packets. Successful exploitation could cause the targeted router to flush its routing table and propagate the crafted OSPF LSA type 1 update throughout the OSPF AS domain. To exploit this vulnerability, an attacker must accurately determine certain parameters within the LSA database on the target router. This vulnerability can only be triggered by sending crafted unicast or multicast OSPF LSA type 1 packets. No other LSA type packets can trigger this vulnerability. OSPFv3 is not affected by this vulnerability. Fabric Shortest Path First (FSPF) protocol is not affected by this vulnerability. Cisco Bug IDs: CSCva74756, CSCve47393, CSCve47401.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100005; http://www.securitytracker.com/id/1039005; http://www.securitytracker.com/id/1039006
CVE: CVE-2017-7916
Published: 2017-08-07
Description: A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. The web application does not properly restrict privileges of the Guest account. A malicious user may be able to gain access to configuration information that should be restricted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264, CWE-269
References: http://search.abb.com/library/Download.aspx?DocumentID=9AKK107045A1977&LanguageCode=en&DocumentPartId=&Action=Launch; http://www.securityfocus.com/bid/99558; https://ics-cert.us-cert.gov/advisories/ICSA-17-192-03
CVE: CVE-2017-7920
Published: 2017-08-07
Description: An Improper Authentication issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access internal information about status and connected devices without authenticating.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: http://search.abb.com/library/Download.aspx?DocumentID=9AKK107045A1977&LanguageCode=en&DocumentPartId=&Action=Launch; http://www.securityfocus.com/bid/99558; https://ics-cert.us-cert.gov/advisories/ICSA-17-192-03
CVE: CVE-2017-7928
Published: 2017-08-07
Description: An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may allow for unauthorized communications to downstream devices.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/99536; https://ics-cert.us-cert.gov/advisories/ICSA-17-192-06; http://www.securityfocus.com/bid/99536
CVE: CVE-2017-7932
Published: 2017-08-07
Description: An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/99966; https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02; http://www.securityfocus.com/bid/99966
CVE: CVE-2017-7936
Published: 2017-08-07
Description: A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/99966; https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02; http://www.securityfocus.com/bid/99966
CVE: CVE-2017-9630
Published: 2017-08-07
Description: An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The web server does not properly verify that provided authentication information is correct.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03; https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03
CVE: CVE-2017-9632
Published: 2017-08-07
Description: A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpress and AutoExpress Plus, all versions, LaserJet, all versions, ProTouch Tandem, all versions, ProTouch ICON, all versions, and ProTouch AutoGloss, all versions. The username and password are transmitted insecurely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-311, CWE-311
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03; https://ics-cert.us-cert.gov/advisories/ICSA-17-208-03
CVE: CVE-2017-9633
Published: 2017-08-07
Description: An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/100132; https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01; http://www.securityfocus.com/bid/100132
CVE: CVE-2017-9647
Published: 2017-08-07
Description: A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/100132; https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01; http://www.securityfocus.com/bid/100132
CVE: CVE-2017-12477
Published: 2017-08-07
Description: It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.unitrends.com/UnitrendsBackup/s/article/000005755; https://www.exploit-db.com/exploits/43031/; https://support.unitrends.com/UnitrendsBackup/s/article/000005755
CVE: CVE-2017-12478
Published: 2017-08-07
Description: It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.unitrends.com/UnitrendsBackup/s/article/000005756; https://www.exploit-db.com/exploits/43030/; https://www.exploit-db.com/exploits/45559/
CVE: CVE-2017-12479
Published: 2017-08-07
Description: It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges.
CVSS Score: 8.8 (HIGH)
References: https://support.unitrends.com/UnitrendsBackup/s/article/000005757; https://support.unitrends.com/UnitrendsBackup/s/article/000005757
CVE: CVE-2017-12640
Published: 2017-08-07
Description: ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100155; https://github.com/ImageMagick/ImageMagick/commit/307fa45d512641fcd105f0d57ca50c1437cd1b81; https://github.com/ImageMagick/ImageMagick/issues/542
CVE: CVE-2017-12641
Published: 2017-08-07
Description: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/commit/c9aa9f80828594eacbe3affe16c43d623562e5d8; https://github.com/ImageMagick/ImageMagick/issues/550; https://github.com/ImageMagick/ImageMagick/commit/c9aa9f80828594eacbe3affe16c43d623562e5d8
CVE: CVE-2017-12642
Published: 2017-08-07
Description: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100159; https://github.com/ImageMagick/ImageMagick/issues/552; http://www.securityfocus.com/bid/100159
CVE: CVE-2017-12643
Published: 2017-08-07
Description: ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://www.securityfocus.com/bid/100218; https://github.com/ImageMagick/ImageMagick/commit/d9ccd8227c4c88a907cda5278408b73552cb0c07; https://github.com/ImageMagick/ImageMagick/issues/549
CVE: CVE-2017-12644
Published: 2017-08-07
Description: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100162; https://github.com/ImageMagick/ImageMagick/commit/a33f7498f9052b50e8fe8c8422a11ba84474cb42; https://github.com/ImageMagick/ImageMagick/issues/551
CVE: CVE-2017-9801
Published: 2017-08-07
Description: When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100082; http://www.securitytracker.com/id/1039043; https://lists.apache.org/thread.html/7ef903a772a2ff08605df1be819044fb15df2815eb3d63878b3fbbb5%40%3Cannounce.apache.org%3E
CVE: CVE-2016-10404
Published: 2017-08-07
Description: XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities; https://github.com/liferay/liferay-portal/commit/333f65bae9106182d12e02d249d4f95e16e93fa2; https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities