deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-3213
Published: 2017-05-05
Description: The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.kb.cert.org/vuls/id/276408; http://www.securityfocus.com/bid/98308; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5901
Published: 2017-05-05
Description: The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5902
Published: 2017-05-05
Description: The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5905
Published: 2017-05-05
Description: The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5906
Published: 2017-05-05
Description: The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5907
Published: 2017-05-05
Description: The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5908
Published: 2017-05-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-3212.  Reason:  This candidate is a reservation duplicate of CVE-2017-3212.  Notes: All CVE users should reference CVE-2017-3212 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-5909
Published: 2017-05-05
Description: The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5911
Published: 2017-05-05
Description: The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5912
Published: 2017-05-05
Description: The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5913
Published: 2017-05-05
Description: The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5914
Published: 2017-05-05
Description: The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5915
Published: 2017-05-05
Description: The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5916
Published: 2017-05-05
Description: The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5917
Published: 2017-05-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-3213.  Reason:  This candidate is a reservation duplicate of CVE-2017-3213.  Notes: All CVE users should reference CVE-2017-3213 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-5918
Published: 2017-05-05
Description: The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-5919
Published: 2017-05-05
Description: The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-8058
Published: 2017-05-05
Description: Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/98318; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; http://www.securityfocus.com/bid/98318
CVE: CVE-2017-8059
Published: 2017-05-05
Description: Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept login information (username/password), in addition to the static authentication token if the user is already logged in.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f
CVE: CVE-2017-8060
Published: 2017-05-05
Description: Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/98327; https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data[PII_REDACTED]9f; http://www.securityfocus.com/bid/98327
CVE: CVE-2017-8787
Published: 2017-05-05
Description: The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861738; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861738
CVE: CVE-2017-6557
Published: 2017-05-05
Description: SQL injection vulnerability in ArrayOS before AG 9.4.0.135, when the portal bookmark function is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/amaciasf/array/blob/master/ArrayOS_AG_9_4_0_135_Release_Note.pdf; https://github.com/amaciasf/array/blob/master/ArrayOS_AG_9_4_0_135_Release_Note.pdf
CVE: CVE-2017-8080
Published: 2017-05-05
Description: Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://www.securityfocus.com/bid/98262; https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-04-24-894234898.html; https://jira.atlassian.com/browse/HCPUB-2980
CVE: CVE-2017-8303
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8304
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8760
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads, e.g., URL encoding.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8788
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a CRLF vulnerability in settings_global_text_edit.php allowing ?display=x%0Dnewline attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8789
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. A report_error.php?year='payload SQL injection vector exists.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8790
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-90
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8791
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a home/seos/courier/login.html auth_params CRLF attack vector.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8792
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/user_add.html with the param parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8793
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site access with a bypass of the Same Origin Policy.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8794
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwd#https:// URL pattern.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8795
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/smtpg_add.html with the param parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8796
Published: 2017-05-05
Description: An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because mysql_real_escape_string is misused, seos/courier/communication_p2p.php allows SQL injection with the app_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb; https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb
CVE: CVE-2017-8799
Published: 2017-05-05
Description: Untrusted input execution via igetwild in all iRODS versions before 4.1.11 and 4.2.1 allows other iRODS users (potentially anonymous) to execute remote shell commands via iRODS virtual pathnames. To exploit this vulnerability, a virtual iRODS pathname that includes a semicolon would be retrieved via igetwild. Because igetwild is a Bash script, the part of the pathname following the semicolon would be executed in the user's shell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/irods/irods/issues/3452; https://github.com/irods/irods/issues/3452
CVE: CVE-2016-0255
Published: 2017-05-05
Description: IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 110564.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001950; http://www.securityfocus.com/bid/98336; http://www.ibm.com/support/docview.wss?uid=swg22001950
CVE: CVE-2016-8916
Published: 2017-05-05
Description: IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21998166; http://www.securityfocus.com/bid/98335; http://www.ibm.com/support/docview.wss?uid=swg21998166
CVE: CVE-2016-9691
Published: 2017-05-05
Description: IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM X-Force ID: 119515.
CVSS Score: 8.6 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg21998014; http://www.securityfocus.com/bid/98338; http://www.ibm.com/support/docview.wss?uid=swg21998014
CVE: CVE-2016-9692
Published: 2017-05-05
Description: IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. IBM X-Force ID: 119516.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg21998014; http://www.securityfocus.com/bid/98337; http://www.ibm.com/support/docview.wss?uid=swg21998014
CVE: CVE-2017-1156
Published: 2017-05-05
Description: IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force. ID: 122592
CVSS Score: 8.8 (HIGH)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22000153; http://www.securityfocus.com/bid/98340; http://www.securitytracker.com/id/1038390
CVE: CVE-2017-8801
Published: 2017-05-05
Description: Trend Micro OfficeScan 11.0 before SP1 CP 6325 (with Agent Module Build before 6152) and XG before CP 1352 has XSS via a crafted URI using a blocked website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://files.trendmicro.com/products/officescan/11.0_SP1/readme/osce-11-sp1-patch1-win-all-criticalpatch-6325_readme.txt; https://success.trendmicro.com/solution/1117204-security-bulletin-trend-micro-officescan-11-xg-multiple-vulnerabilities; http://files.trendmicro.com/products/officescan/11.0_SP1/readme/osce-11-sp1-patch1-win-all-criticalpatch-6325_readme.txt
CVE: CVE-2016-6877
Published: 2017-05-05
Description: Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page.  NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98341; https://www.solutionary.com/threat-intelligence/vulnerability-disclosures/2017/03/citrix-xenmobile-server/; http://www.securityfocus.com/bid/98341
CVE: CVE-2017-6024
Published: 2017-05-06
Description: A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V28.013; ControlLogix 5580 controllers V29.011; CompactLogix 5380 controllers V28.011; and CompactLogix 5380 controllers V29.011. This vulnerability may allow an attacker to cause a denial of service condition by sending a series of specific CIP-based commands to the controller.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/98309; https://ics-cert.us-cert.gov/advisories/ICSA-17-094-05; http://www.securityfocus.com/bid/98309