deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6782
Published: 2017-08-17
Description: A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web interface of the affected application. The vulnerability is due to improper sanitization of parameter values by the affected application. An attacker could exploit this vulnerability by injecting malicious code into an affected parameter and persuading a user to access a web page that triggers the rendering of the injected code. Cisco Bug IDs: CSCve47074. Known Affected Releases: 3.2(0.0).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/100366; http://www.securitytracker.com/id/1039189; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-cpi
CVE: CVE-2017-6783
Published: 2017-08-17
Description: A vulnerability in SNMP polling for the Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to discover confidential information about the appliances that should be available only to an administrative user. The vulnerability occurs because the appliances do not protect confidential information at rest in response to Simple Network Management Protocol (SNMP) poll requests. An attacker could exploit this vulnerability by doing a crafted SNMP poll request to the targeted security appliance. An exploit could allow the attacker to discover confidential information that should be restricted, and the attacker could use this information to conduct additional reconnaissance. The attacker must know the configured SNMP community string to exploit this vulnerability. Cisco Bug IDs: CSCve26106, CSCve26202, CSCve26224. Known Affected Releases: 10.0.0-230 (Web Security Appliance), 9.7.2-065 (Email Security Appliance), and 10.1.0-037 (Content Security Management Appliance).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100387; http://www.securitytracker.com/id/1039186; http://www.securitytracker.com/id/1039187
CVE: CVE-2017-6784
Published: 2017-08-17
Description: A vulnerability in the web interface of the Cisco RV340, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to Cisco WebEx Meetings not sufficiently protecting sensitive data when responding to an HTTP request to the web interface. An attacker could exploit the vulnerability by attempting to use the HTTP protocol and looking at the data in the HTTP responses from the Cisco WebEx Meetings Server. An exploit could allow the attacker to find sensitive information about the application. Cisco Bug IDs: CSCve37988. Known Affected Releases: firmware 1.0.0.30, 1.0.0.33, 1.0.1.9, 1.0.1.16.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100402; http://www.securitytracker.com/id/1039191; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-crr
CVE: CVE-2017-6785
Published: 2017-08-17
Description: A vulnerability in configuration modification permissions validation for Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform a horizontal privilege escalation where one user can modify another user's configuration. The vulnerability is due to lack of proper Role Based Access Control (RBAC) when certain user configuration changes are requested. An attacker could exploit this vulnerability by sending an authenticated, crafted HTTP request to the targeted application. An exploit could allow the attacker to impact the integrity of the application where one user can modify the configuration of another user's information. Cisco Bug IDs: CSCve27331. Known Affected Releases: 10.5(2.10000.5), 11.0(1.10000.10), 11.5(1.10000.6).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100375; http://www.securitytracker.com/id/1039184; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-ucm
CVE: CVE-2017-6786
Published: 2017-08-17
Description: A vulnerability in Cisco Elastic Services Controller could allow an authenticated, local, unprivileged attacker to access sensitive information, including credentials for system accounts, on an affected system. The vulnerability is due to improper protection of sensitive log files. An attacker could exploit this vulnerability by logging in to an affected system and accessing unprotected log files. A successful exploit could allow the attacker to access sensitive log files, which may include system credentials, on the affected system. Cisco Bug IDs: CSCvc76616. Known Affected Releases: 2.2(9.76).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100391; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc4; http://www.securityfocus.com/bid/100391
CVE: CVE-2017-6788
Published: 2017-08-17
Description: The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected software. The vulnerability is due to insufficient input validation of some parameters that are passed to the WebLaunch function of the affected software. An attacker could exploit this vulnerability by convincing a user to access a malicious link or by intercepting a user request and injecting malicious code into the request. Cisco Bug IDs: CSCvf12055. Known Affected Releases: 98.89(40).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100364; http://www.securitytracker.com/id/1039190; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-caw
CVE: CVE-2017-6790
Published: 2017-08-17
Description: A vulnerability in the Session Initiation Protocol (SIP) on the Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the targeted appliance. The vulnerability is due to excessive SIP traffic sent to the device. An attacker could exploit this vulnerability by transmitting large volumes of SIP traffic to the VCS. An exploit could allow the attacker to cause a complete DoS condition on the targeted system. Cisco Bug IDs: CSCve32897.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/100369; http://www.securitytracker.com/id/1039185; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-vcs
CVE: CVE-2017-12927
Published: 2017-08-18
Description: A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100490; http://www.securitytracker.com/id/1039208; https://github.com/Cacti/cacti/commit/a032ce0be6a4ea47862c594e40a619ac8de1ef99
CVE: CVE-2017-12932
Published: 2017-08-18
Description: ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/100427; https://access.redhat.com/errata/RHSA-2018:1296
CVE: CVE-2017-12933
Published: 2017-08-18
Description: The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://php.net/ChangeLog-5.php; http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/99490
CVE: CVE-2017-12934
Published: 2017-08-18
Description: ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the zval_get_type function in Zend/zend_types.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://php.net/ChangeLog-7.php; http://www.securityfocus.com/bid/100428; https://access.redhat.com/errata/RHSA-2018:1296
CVE: CVE-2017-12935
Published: 2017-08-18
Description: The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/cd699a44f188; https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-invalid-memory-read-in-setimagecolorcallback-image-c/; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
CVE: CVE-2017-12936
Published: 2017-08-18
Description: The ReadWMFImage function in coders/wmf.c in GraphicsMagick 1.3.26 has a use-after-free issue for data associated with exception reporting.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/be898b7c97bd; https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-use-after-free-in-readwmfimage-wmf-c/; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
CVE: CVE-2017-12937
Published: 2017-08-18
Description: The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/95d00d55e978; http://www.securityfocus.com/bid/100442; https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-heap-based-buffer-overflow-in-readsunimage-sun-c/
CVE: CVE-2017-10811
Published: 2017-08-18
Description: Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://buffalo.jp/support_s/s20170804_1.html; https://jvn.jp/en/jp/JVN05340005/index.html; http://buffalo.jp/support_s/s20170804_1.html
CVE: CVE-2017-10821
Published: 2017-08-18
Description: Untrusted search path vulnerability in Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program (program released on 2013 September 30) Distributed on the website until 2017 May 17 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN73559859/index.html; https://jvn.jp/en/jp/JVN73559859/index.html
CVE: CVE-2017-10822
Published: 2017-08-18
Description: Untrusted search path vulnerability in Installer for Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program (program released on 2013 September 30) distributed on the website until 2017 May 17 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN71104430/index.html; https://jvn.jp/en/jp/JVN71104430/index.html
CVE: CVE-2017-10823
Published: 2017-08-18
Description: Untrusted search path vulnerability in Installer for Shin Kinkyuji Houkoku Data Nyuryoku Program (program released on 2011 March 10) Distributed on the website till 2017 May 17 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN23546631/index.html; https://jvn.jp/en/jp/JVN23546631/index.html
CVE: CVE-2017-10824
Published: 2017-08-18
Description: Untrusted search path vulnerability in TDB CA TypeA use software Version 5.2 and earlier, distributed until 10 August 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN18641169/index.html; https://jvn.jp/en/jp/JVN18641169/index.html
CVE: CVE-2017-12938
Published: 2017-08-18
Description: UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://seclists.org/oss-sec/2017/q3/290; http://seclists.org/oss-sec/2017/q3/290
CVE: CVE-2017-12939
Published: 2017-08-18
Description: A Remote Code Execution vulnerability was identified in all Windows versions of Unity Editor, e.g., before 5.3.8p2, 5.4.x before 5.4.5p5, 5.5.x before 5.5.4p3, 5.6.x before 5.6.3p1, and 2017.x before 2017.1.0p4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100444; https://twitter.com/0x09AL/status/[PII_REDACTED]85711108; https://unity3d.com/security#issues
CVE: CVE-2017-2228
Published: 2017-08-18
Description: Untrusted search path vulnerability in Teikihoukokusho Sakuseishien Tool v4.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN53292345/index.html; https://jvn.jp/en/jp/JVN53292345/index.html
CVE: CVE-2017-2289
Published: 2017-08-18
Description: Untrusted search path vulnerability in Installer of Qua station connection tool for Windows version 1.00.03 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN81659403/index.html; https://jvn.jp/en/jp/JVN81659403/index.html
CVE: CVE-2017-10665
Published: 2017-08-18
Description: Directory traversal vulnerability in ajaxfileupload.php in Kayson Group Ltd. phpGrid before 7.2.5 allows remote attackers to execute arbitrary code by uploading a crafted file with a .. (dot dot) in the file name.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://phpgrid.com/announcement/version-7-2-5/; https://www.futureweb.at/security/CVE-2017-10665/; https://phpgrid.com/announcement/version-7-2-5/
CVE: CVE-2017-12440
Published: 2017-08-18
Description: Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://www.debian.org/security/2017/dsa-3953; http://www.securityfocus.com/bid/100455; https://access.redhat.com/errata/RHSA-2017:3227
CVE: CVE-2017-12940
Published: 2017-08-18
Description: libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://seclists.org/oss-sec/2017/q3/290; https://kc.mcafee.com/corporate/index?page=content&id=SB10241; https://security.gentoo.org/glsa/201709-24
CVE: CVE-2017-12941
Published: 2017-08-18
Description: libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://seclists.org/oss-sec/2017/q3/290; https://kc.mcafee.com/corporate/index?page=content&id=SB10241; https://security.gentoo.org/glsa/201709-24
CVE: CVE-2017-12942
Published: 2017-08-18
Description: libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://seclists.org/oss-sec/2017/q3/290; https://kc.mcafee.com/corporate/index?page=content&id=SB10241; https://security.gentoo.org/glsa/201709-24
CVE: CVE-2017-7278
Published: 2017-08-18
Description: Unspecified vulnerability in ASSA ABLOY APTUS Styra Porttelefonkort 4400 before A2 has unknown impact and attack vectors.
CVSS Score: 9.8 (CRITICAL)
References: https://www.aptus.se/sv/site/aptusse/support/sakerhetsuppdatering/; https://www.aptus.se/sv/site/aptusse/support/sakerhetsuppdatering/
CVE: CVE-2017-9454
Published: 2017-08-18
Description: Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted DNS response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/resiprocate/resiprocate/commit/d67a9ca6fd06ca65d23e313bdbad1ef4dd3aa0df; https://list.resiprocate.org/archive/resiprocate-users/msg02700.html; https://github.com/resiprocate/resiprocate/commit/d67a9ca6fd06ca65d23e313bdbad1ef4dd3aa0df
CVE: CVE-2017-12943
Published: 2017-08-18
Description: D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal attack, as demonstrated by discovering the admin password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://jithindkurup.tumblr.com/post/[PII_REDACTED]4/d-link-dir-600-authentication-bypass-absolute; https://www.exploit-db.com/exploits/42581/; https://www.youtube.com/watch?v=PeNOJORAQsQ
CVE: CVE-2017-12944
Published: 2017-08-18
Description: The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial of service (allocation failure and application crash) in the TIFFFetchStripThing function in tif_dirread.c during a tiff2pdf invocation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://bugzilla.maptools.org/show_bug.cgi?id=2725; https://usn.ubuntu.com/3602-1/; https://usn.ubuntu.com/3606-1/
CVE: CVE-2017-1338
Published: 2017-08-18
Description: IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126246.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004138; http://www.securityfocus.com/bid/100353; https://exchange.xforce.ibmcloud.com/vulnerabilities/126246
CVE: CVE-2017-1501
Published: 2017-08-18
Description: IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the web services security bindings settings. IBM X-Force ID: 129576.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006810; http://www.securityfocus.com/bid/100394; http://www.securitytracker.com/id/1039199
CVE: CVE-2015-1817
Published: 2017-08-18
Description: Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/03/30/3; http://www.securityfocus.com/bid/73408; http://www.openwall.com/lists/oss-security/2015/03/30/3
CVE: CVE-2015-1878
Published: 2017-08-18
Description: Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key [KNETI] and impersonate the nShield Connect device on a network, affect the integrity and confidentiality of newly created keys, and potentially cause other unspecified impacts using previously loaded keys by connecting to the USB port on the front panel.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.securitytracker.com/id/1032152; http://www.securitytracker.com/id/1032152
CVE: CVE-2015-3649
Published: 2017-08-18
Description: The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.benjaminfleischer.com/2013/03/20/yaml-and-security-in-ruby/; http://www.openwall.com/lists/oss-security/2015/05/06/2; http://www.securityfocus.com/bid/74469
CVE: CVE-2015-4082
Published: 2017-08-18
Description: attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2015/05/31/3; http://www.securityfocus.com/bid/74821; https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072
CVE: CVE-2017-12582
Published: 2017-08-18
Description: Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that unprivileged user SID, all function can access at Surveillance Station.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: http://www.kth.ninja/2017/08/qnap-surveillance-station.html; http://www.kth.ninja/2017/08/qnap-surveillance-station.html
CVE: CVE-2017-12680
Published: 2017-08-18
Description: Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.lsafe.org/cve.txt; http://www.securityfocus.com/bid/100424; http://www.lsafe.org/cve.txt
CVE: CVE-2017-12859
Published: 2017-08-18
Description: NetApp Data ONTAP before 8.2.5, when operating in 7-Mode in NFS environments, allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100417; https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]; http://www.securityfocus.com/bid/100417
CVE: CVE-2017-9767
Published: 2017-08-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Name or (2) Description parameter to RM/Reservation/ReserveNew; the (3) Description parameter to RM/Topology/Update; the (4) Name, (5) Description, (6) ExecutionBatches[0].Name, (7) ExecutionBatches[0].Description, or (8) Labels parameter to SnQ/JobTemplate/Edit; or (9) Alias or (10) Description parameter to RM/AbstractTemplate/AddOrUpdateAbstractTemplate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/143746/Quali-CloudShell-7.1.0.6508-Patch-6-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/541023/100/0/threaded; https://www.exploit-db.com/exploits/42453/
CVE: CVE-2017-9816
Published: 2017-08-18
Description: Cross-site scripting (XSS) vulnerability in Paessler PRTG Network Monitor before 17.2.32.2279 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.paessler.com/prtg/history/stable; https://www.paessler.com/prtg/history/stable
CVE: CVE-2015-7944
Published: 2017-08-18
Description: The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://docs.ganeti.org/ganeti/2.10/html/news.html#version-2-10-8; http://docs.ganeti.org/ganeti/2.11/html/news.html#version-2-11-8; http://docs.ganeti.org/ganeti/2.12/html/news.html#version-2-12.6