deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9438
Published: 2017-06-05
Description: libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/VirusTotal/yara/commit/10e8bd3071677dd1fa76beeef4bc2fc427cea5e7; https://github.com/VirusTotal/yara/issues/674; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD/
CVE: CVE-2017-9439
Published: 2017-06-05
Description: In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/98907; https://github.com/ImageMagick/ImageMagick/issues/460; http://www.securityfocus.com/bid/98907
CVE: CVE-2017-9440
Published: 2017-06-05
Description: In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/98908; https://github.com/ImageMagick/ImageMagick/issues/462; http://www.securityfocus.com/bid/98908
CVE: CVE-2017-9420
Published: 2017-06-05
Description: Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://spiffycalendar.sunnythemes.com/version-3-3-0/; http://www.securityfocus.com/bid/98931; https://wpvulndb.com/vulnerabilities/8842
CVE: CVE-2017-9441
Published: 2017-06-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in manifest.json. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
CVSS Score: 2.7 (LOW)
CWE: CWE-79
References: https://github.com/bigtreecms/BigTree-CMS/issues/290; https://github.com/bigtreecms/BigTree-CMS/issues/290
CVE: CVE-2017-9442
Published: 2017-06-05
Description: BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/bigtreecms/BigTree-CMS/issues/291; https://github.com/bigtreecms/BigTree-CMS/issues/291
CVE: CVE-2017-9443
Published: 2017-06-05
Description: BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and core\admin\modules\developer\packages\install\process.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/bigtreecms/BigTree-CMS/issues/292; https://github.com/bigtreecms/BigTree-CMS/issues/292
CVE: CVE-2017-9444
Published: 2017-06-05
Description: BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/bigtreecms/BigTree-CMS/issues/293; https://github.com/bigtreecms/BigTree-CMS/issues/293
CVE: CVE-2014-9923
Published: 2017-06-06
Description: In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98225; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98225
CVE: CVE-2014-9924
Published: 2017-06-06
Description: In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/bid/98226; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98226
CVE: CVE-2014-9925
Published: 2017-06-06
Description: In HDR in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98227; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98227
CVE: CVE-2014-9926
Published: 2017-06-06
Description: In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98228; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98228
CVE: CVE-2014-9927
Published: 2017-06-06
Description: In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/2017-05-01; https://source.android.com/security/bulletin/2017-05-01
CVE: CVE-2014-9928
Published: 2017-06-06
Description: In GERAN in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98233; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98233
CVE: CVE-2014-9929
Published: 2017-06-06
Description: In WCDMA in all Android releases from CAF using the Linux kernel, a Use of Out-of-range Pointer Offset vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98235; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98235
CVE: CVE-2014-9930
Published: 2017-06-06
Description: In WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98323; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98323
CVE: CVE-2014-9941
Published: 2017-06-06
Description: In the Embedded File System in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/98242; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98242
CVE: CVE-2014-9942
Published: 2017-06-06
Description: In Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: http://www.securityfocus.com/bid/98243; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98243
CVE: CVE-2014-9943
Published: 2017-06-06
Description: In Core Kernel in all Android releases from CAF using the Linux kernel, a Null Pointer Dereference vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/98244; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98244
CVE: CVE-2014-9944
Published: 2017-06-06
Description: In the Secure File System in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/98245; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98245
CVE: CVE-2014-9945
Published: 2017-06-06
Description: In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-285
References: http://www.securityfocus.com/bid/98246; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98246
CVE: CVE-2014-9946
Published: 2017-06-06
Description: In Core Kernel in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98247; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98247
CVE: CVE-2014-9947
Published: 2017-06-06
Description: In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98248; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98248
CVE: CVE-2014-9948
Published: 2017-06-06
Description: In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Validation of Array Index vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://www.securityfocus.com/bid/98249; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98249
CVE: CVE-2014-9949
Published: 2017-06-06
Description: In TrustZone in all Android releases from CAF using the Linux kernel, an Untrusted Pointer Dereference vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/98250; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98250
CVE: CVE-2014-9950
Published: 2017-06-06
Description: In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-285
References: http://www.securityfocus.com/bid/98251; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98251
CVE: CVE-2014-9951
Published: 2017-06-06
Description: In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98252; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98252
CVE: CVE-2014-9952
Published: 2017-06-06
Description: In the Secure File System in all Android releases from CAF using the Linux kernel, a capture-replay vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/98253; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98253
CVE: CVE-2015-9005
Published: 2017-06-06
Description: In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/98322; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98322
CVE: CVE-2015-9006
Published: 2017-06-06
Description: In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/98321; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98321
CVE: CVE-2015-9007
Published: 2017-06-06
Description: In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://www.securityfocus.com/bid/98324; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98324
CVE: CVE-2016-10297
Published: 2017-06-06
Description: In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/98241; https://source.android.com/security/bulletin/2017-05-01; http://www.securityfocus.com/bid/98241
CVE: CVE-2017-5664
Published: 2017-06-06
Description: The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: http://www.debian.org/security/2017/dsa-3891; http://www.debian.org/security/2017/dsa-3892; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-7515
Published: 2017-06-06
Description: poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674, CWE-674
References: https://bugs.freedesktop.org/show_bug.cgi?id=101208; https://bugs.freedesktop.org/show_bug.cgi?id=101208
CVE: CVE-2017-8083
Published: 2017-06-06
Description: CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of flash memory regions, which allows local users to install a firmware rootkit by leveraging administrative privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862
References: http://seclists.org/fulldisclosure/2017/Jun/6; https://watchmysys.com/blog/2017/06/cve-2017-8083-compulab-intensepc-lacks-bios-wp/; http://seclists.org/fulldisclosure/2017/Jun/6
CVE: CVE-2017-9332
Published: 2017-06-06
Description: The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/pivot-weblog/code/4487/; https://sourceforge.net/p/pivot-weblog/code/4487/
CVE: CVE-2017-9448
Published: 2017-06-06
Description: Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged (administrator) users can attack high-privileged (Developer) users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigtreecms/BigTree-CMS/issues/294; https://github.com/bigtreecms/BigTree-CMS/issues/294
CVE: CVE-2017-9449
Published: 2017-06-06
Description: SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible at admin/ajax/auto-modules/views/searchable-page/ or admin/modules_name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/bigtreecms/BigTree-CMS/issues/295; https://github.com/bigtreecms/BigTree-CMS/issues/295
CVE: CVE-2017-5243
Published: 2017-06-06
Description: The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.
CVSS Score: 8.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://community.rapid7.com/community/nexpose/blog/2017/05/31/r7-2017-13-nexpose-hardware-appliance-ssh-enabled-obsolete-algorithms-cve-2017-5243; https://community.rapid7.com/community/nexpose/blog/2017/05/31/r7-2017-13-nexpose-hardware-appliance-ssh-enabled-obsolete-algorithms-cve-2017-5243
CVE: CVE-2017-8920
Published: 2017-06-06
Description: irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://cgiirc.org/; https://github.com/dgl/cgiirc/commit/46dd[PII_REDACTED]7b52c16065ad67d294194afd8d; http://cgiirc.org/
CVE: CVE-2017-9422
Published: 2017-06-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-8920.  Reason: This candidate is a reservation duplicate of CVE-2017-8920.  Notes: All CVE users should reference CVE-2017-8920 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-9451
Published: 2017-06-06
Description: Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatCore/flatCore-CMS/commit/f1b42b338693a9c240182e76ef2131057f2c2a87; https://github.com/flatCore/flatCore-CMS/issues/34; https://github.com/flatCore/flatCore-CMS/commit/f1b42b338693a9c240182e76ef2131057f2c2a87
CVE: CVE-2017-9452
Published: 2017-06-06
Description: Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Piwigo/Piwigo/issues/667; https://github.com/Piwigo/Piwigo/issues/667
CVE: CVE-2014-8180
Published: 2017-06-06
Description: MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/installation_guide/preparing_your_environment_for_installation#restricting_access_to_mongod; https://bugzilla.redhat.com/show_bug.cgi?id=1301703; https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/installation_guide/preparing_your_environment_for_installation#restricting_access_to_mongod
CVE: CVE-2015-1207
Published: 2017-06-06
Description: Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://bugs.chromium.org/p/chromium/issues/detail?id=444539; https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9; https://lists.debian.org/debian-lts-announce/2019/02/msg00005.html
CVE: CVE-2015-3830
Published: 2017-06-06
Description: The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/CHEF-KOCH/Android-Vulnerabilities-Overview/blob/master/2015.md; https://jsfiddle.net/dy4swq4o/; https://github.com/CHEF-KOCH/Android-Vulnerabilities-Overview/blob/master/2015.md
CVE: CVE-2016-0726
Published: 2017-06-06
Description: The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://bugzilla.redhat.com/show_bug.cgi?id=1295446; https://bugzilla.redhat.com/show_bug.cgi?id=1295446
CVE: CVE-2016-0767
Published: 2017-06-06
Description: PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://tada.github.io/pljava/releasenotes.html; https://tada.github.io/pljava/releasenotes.html
CVE: CVE-2016-0768
Published: 2017-06-06
Description: PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://tada.github.io/pljava/releasenotes.html; https://tada.github.io/pljava/releasenotes.html
CVE: CVE-2016-2192
Published: 2017-06-06
Description: PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://tada.github.io/pljava/releasenotes.html; https://tada.github.io/pljava/releasenotes.html
CVE: CVE-2016-3066
Published: 2017-06-06
Description: The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1320263; https://bugzilla.redhat.com/show_bug.cgi?id=1320263
CVE: CVE-2016-3077
Published: 2017-06-06
Description: The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1321972; https://bugzilla.redhat.com/show_bug.cgi?id=1321972
CVE: CVE-2016-5004
Published: 2017-06-06
Description: The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2016/07/12/5; http://www.securityfocus.com/bid/91736; http://www.securitytracker.com/id/1036294