deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-5625
Published: 2017-04-25
Description: In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (except 'keystore') by issuing the 'fastboot oem dump <partition>' fastboot command.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-476
References: https://alephsecurity.com/vulns/aleph-2017006; https://alephsecurity.com/vulns/aleph-2017006
CVE: CVE-2017-8109
Published: 2017-04-25
Description: The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98095; https://bugzilla.suse.com/show_bug.cgi?id=1035912; https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html
CVE: CVE-2017-8110
Published: 2017-04-25
Description: www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-611
References: http://jgj212.blogspot.hk/2017/04/modified-ecommerce-shopsoftware-2022.html; http://jgj212.blogspot.hk/2017/04/modified-ecommerce-shopsoftware-2022.html
CVE: CVE-2017-1149
Published: 2017-04-25
Description: IBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM X-Force ID: 122202.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg2C1000289; http://www.securityfocus.com/bid/98026; http://www.ibm.com/support/docview.wss?uid=swg2C1000289
CVE: CVE-2017-1274
Published: 2017-04-25
Description: IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html; http://www.ibm.com/support/docview.wss?uid=swg22002280; http://www.securityfocus.com/bid/97910
CVE: CVE-2017-7983
Published: 2017-04-25
Description: In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98016; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-information-disclosure; http://www.securityfocus.com/bid/98016
CVE: CVE-2017-7984
Published: 2017-04-25
Description: In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering leads to XSS in the template manager component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98018; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-xss-vulnerability; http://www.securityfocus.com/bid/98018
CVE: CVE-2017-7985
Published: 2017-04-25
Description: In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98020; http://www.securitytracker.com/id/1038817; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-vulnerability
CVE: CVE-2017-7986
Published: 2017-04-25
Description: In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98024; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-xss-vulnerability; http://www.securityfocus.com/bid/98024
CVE: CVE-2017-7987
Published: 2017-04-25
Description: In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98021; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-xss-vulnerability; http://www.securityfocus.com/bid/98021
CVE: CVE-2017-7988
Published: 2017-04-25
Description: In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of form contents allows overwriting the author of an article.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/98022; https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-acl-violations; http://www.securityfocus.com/bid/98022
CVE: CVE-2017-7989
Published: 2017-04-25
Description: In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: http://www.securityfocus.com/bid/98029; https://developer.joomla.org/security-centre/[PII_REDACTED]7-core-acl-violations; http://www.securityfocus.com/bid/98029
CVE: CVE-2017-8057
Published: 2017-04-25
Description: In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98028; https://developer.joomla.org/security-centre/[PII_REDACTED]8-core-information-disclosure.html; http://www.securityfocus.com/bid/98028
CVE: CVE-2016-5483
Published: 2017-04-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-3600.  Reason: This candidate is a reservation duplicate of CVE-2017-3600.  Notes: All CVE users should reference CVE-2017-3600 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-3342
Published: 2017-04-25
Description: Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/98061; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3345
Published: 2017-04-25
Description: Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/98055; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3347
Published: 2017-04-25
Description: Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/98060; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3355
Published: 2017-04-25
Description: Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/98059; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3356
Published: 2017-04-25
Description: Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/98058; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-3434
Published: 2017-04-25
Description: Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Audience workbench). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data as well as unauthorized read access to a subset of Oracle One-to-One Fulfillment accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).
CVSS Score: 7.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/98054; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-8115
Published: 2017-04-25
Description: Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/modxcms/revolution/issues/13432; https://github.com/modxcms/revolution/pull/13433; https://github.com/modxcms/revolution/issues/13432
CVE: CVE-2017-8217
Published: 2017-04-25
Description: TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html; https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html
CVE: CVE-2017-8218
Published: 2017-04-25
Description: vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoor guest account with the guest password, and a backdoor test account with the test password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html; https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html
CVE: CVE-2017-8219
Published: 2017-04-25
Description: TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html; https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html
CVE: CVE-2017-8220
Published: 2017-04-25
Description: TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html; https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html
CVE: CVE-2017-8221
Published: 2017-04-25
Description: Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Android application and a camera device, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: http://seclists.org/fulldisclosure/2017/Mar/23; https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#cloud; http://seclists.org/fulldisclosure/2017/Mar/23
CVE: CVE-2017-8222
Published: 2017-04-25
Description: Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in /system/www/pem/ck.pem inside the firmware, which allows attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://seclists.org/fulldisclosure/2017/Mar/23; https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#rsa-lulz; http://seclists.org/fulldisclosure/2017/Mar/23
CVE: CVE-2017-8223
Published: 2017-04-25
Description: On Wireless IP Camera (P2P) WIFICAM devices, an attacker can use the RTSP server on port 10554/tcp to watch the streaming without authentication via tcp/av0_1 or tcp/av0_0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2017/Mar/23; https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-info-leak-goahead; http://seclists.org/fulldisclosure/2017/Mar/23
CVE: CVE-2017-8224
Published: 2017-04-25
Description: Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2017/Mar/23; https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#backdoor-account; http://seclists.org/fulldisclosure/2017/Mar/23
CVE: CVE-2017-8225
Published: 2017-04-25
Description: On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://seclists.org/fulldisclosure/2017/Mar/23; https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-info-leak-goahead; http://seclists.org/fulldisclosure/2017/Mar/23
CVE: CVE-2017-5437
Published: 2017-04-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10195, CVE-2016-10196, CVE-2016-10197.  Reason: This candidate is a duplicate of CVE-2016-10195, CVE-2016-10196, and CVE-2016-10197.  Notes: All CVE users should reference CVE-2016-10195, CVE-2016-10196, and/or CVE-2016-10197 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-7293
Published: 2017-04-26
Description: The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary system privileges, because these services have .NET code for DCOM. This affects Dolby Audio X2 (DAX2) 1.0, 1.0.1, 1.1, 1.1.1, 1.2, 1.3, 1.3.1, 1.3.2, 1.4, 1.4.1, 1.4.2, 1.4.3, and 1.4.4 and Dolby Audio X3 (DAX3) 1.0 and 1.1. An example affected driver is Realtek Audio Driver 6.0.1.7898 on a Lenovo P50.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075; https://www.exploit-db.com/exploits/41933/; https://bugs.chromium.org/p/project-zero/issues/detail?id=1075
CVE: CVE-2017-8283
Published: 2017-04-26
Description: dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2017/04/20/2; http://www.securityfocus.com/bid/98064; http://www.openwall.com/lists/oss-security/2017/04/20/2
CVE: CVE-2017-6052
Published: 2017-04-26
Description: A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified endpoints.
CVSS Score: 3.7 (LOW)
CWE: CWE-300
References: http://www.securityfocus.com/bid/98033; https://community.rapid7.com/community/infosec/blog/2017/04/25/r7-2017-02-hyundai-blue-link-potential-info-disclosure-fixed; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-03
CVE: CVE-2017-6054
Published: 2017-04-26
Description: A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-coded decryption password to protect sensitive user information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321, CWE-798
References: http://www.securityfocus.com/bid/98033; https://community.rapid7.com/community/infosec/blog/2017/04/25/r7-2017-02-hyundai-blue-link-potential-info-disclosure-fixed; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-03
CVE: CVE-2017-7720
Published: 2017-04-26
Description: Buffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service (SEH overwrite) or possibly have unspecified other impact via a long password.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/41916/; https://www.exploit-db.com/exploits/41916/
CVE: CVE-2017-8284
Published: 2017-04-26
Description: The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.
CVSS Score: 7.0 (HIGH)
CWE: CWE-94
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1122; https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14; https://bugs.chromium.org/p/project-zero/issues/detail?id=1122
CVE: CVE-2016-8924
Published: 2017-04-26
Description: IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21996256; http://www.securityfocus.com/bid/98023; http://www.ibm.com/support/docview.wss?uid=swg21996256
CVE: CVE-2016-8962
Published: 2017-04-26
Description: IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-255
References: http://www.ibm.com/support/docview.wss?uid=swg21995031; http://www.securityfocus.com/bid/98030; http://www.securitytracker.com/id/1038360
CVE: CVE-2017-1170
Published: 2017-04-26
Description: IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230.
CVSS Score: 5.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22001225; http://www.securityfocus.com/bid/98027; http://www.securitytracker.com/id/1038359
CVE: CVE-2017-3161
Published: 2017-04-26
Description: The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98025; https://lists.apache.org/thread.html/r127f75748fcabc63bc5a1bec6885753eb9b2bed803b6ed7bd46f965b%40%3Cuser.hadoop.apache.org%3E; https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E
CVE: CVE-2017-3162
Published: 2017-04-26
Description: HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98017; https://lists.apache.org/thread.html/r127f75748fcabc63bc5a1bec6885753eb9b2bed803b6ed7bd46f965b%40%3Cuser.hadoop.apache.org%3E; https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E
CVE: CVE-2017-6035
Published: 2017-04-27
Description: A Stack-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. This vulnerability causes a buffer overflow, which could result in denial of service when a malicious project file is run on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/97639; https://ics-cert.us-cert.gov/advisories/ICSA-17-103-01; http://www.securityfocus.com/bid/97639