deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7901
Published: 2017-06-30
Description: A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. Insufficiently random TCP initial sequence numbers are generated, which may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections, resulting in a denial of service for the target device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-343, CWE-330
References: http://www.securitytracker.com/id/1038546; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04; http://www.securitytracker.com/id/1038546
CVE: CVE-2017-7902
Published: 2017-06-30
Description: A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. The affected product reuses nonces, which may allow an attacker to capture and replay a valid request until the nonce is changed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-323, CWE-330
References: http://www.securitytracker.com/id/1038546; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04; http://www.securitytracker.com/id/1038546
CVE: CVE-2017-7903
Published: 2017-06-30
Description: A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. The affected products use a numeric password with a small maximum character size for the password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-326
References: http://www.securitytracker.com/id/1038546; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04; http://www.securitytracker.com/id/1038546
CVE: CVE-2017-7905
Published: 2017-06-30
Description: A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Version 5.23; SR 489 Generator Protection Relay, firmware versions prior to Version 4.06; SR 745 Transformer Protection Relay, firmware versions prior to Version 5.23; SR 369 Motor Protection Relay, all firmware versions; Multilin Universal Relay, firmware Version 6.0 and prior versions; and Multilin URplus (D90, C90, B95), all versions. Ciphertext versions of user passwords were created with a non-random initialization vector leaving them susceptible to dictionary attacks. Ciphertext of user passwords can be obtained from the front LCD panel of affected products and through issued Modbus commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-261, CWE-326, CWE-330, CWE-522
References: http://www.securityfocus.com/bid/98063; https://ics-cert.us-cert.gov/advisories/ICSA-17-117-01A; http://www.securityfocus.com/bid/98063
CVE: CVE-2017-10668
Published: 2017-06-30
Description: A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under an MITM condition within the OSCI infrastructure, an attacker needs to send crafted protocol messages to analyse the CBC mode padding in order to decrypt the transport encryption.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: http://seclists.org/fulldisclosure/2017/Jun/44; http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html; http://seclists.org/fulldisclosure/2017/Jun/44
CVE: CVE-2017-10669
Published: 2017-06-30
Description: Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: http://seclists.org/fulldisclosure/2017/Jun/44; http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html; http://seclists.org/fulldisclosure/2017/Jun/44
CVE: CVE-2017-10670
Published: 2017-06-30
Description: An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://seclists.org/fulldisclosure/2017/Jun/44; http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html; http://seclists.org/fulldisclosure/2017/Jun/44
CVE: CVE-2015-9102
Published: 2017-06-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.fortiguard.com/zeroday/FG-VD-15-103; http://www.fortiguard.com/zeroday/FG-VD-15-104; http://www.fortiguard.com/zeroday/FG-VD-15-109
CVE: CVE-2015-9103
Published: 2017-06-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) note title or (2) file name of attachments.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.fortiguard.com/zeroday/FG-VD-15-110; http://www.fortiguard.com/zeroday/FG-VD-15-111; https://www.synology.com/en-global/support/security/Note_Station_1_1_0214
CVE: CVE-2015-9104
Published: 2017-06-30
Description: Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.fortiguard.com/zeroday/FG-VD-15-106; https://www.synology.com/en-global/support/security/Audio_Station_5_4_2857; http://www.fortiguard.com/zeroday/FG-VD-15-106
CVE: CVE-2015-9105
Published: 2017-06-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) file name or (2) collection name of videos.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.fortiguard.com/zeroday/FG-VD-15-107; http://www.fortiguard.com/zeroday/FG-VD-15-108; https://www.synology.com/en-global/support/security/Video_station_1_5_0772
CVE: CVE-2017-10674
Published: 2017-06-30
Description: Antiy Antivirus Engine 5.0.0.06281654 allows local users to cause a denial of service (BSOD) via a long third argument in a DeviceIoControl call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://blog.csdn.net/wdone/article/details/73958872; http://blog.csdn.net/wdone/article/details/73958872
CVE: CVE-2017-10699
Published: 2017-06-30
Description: avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securitytracker.com/id/1038816; https://trac.videolan.org/vlc/ticket/18467; https://www.debian.org/security/2017/dsa-4045
CVE: CVE-2017-10709
Published: 2017-06-30
Description: The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://www.reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with/; https://www.security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707
CVE: CVE-2017-8443
Published: 2017-06-30
Description: In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-598, CWE-200
References: https://www.elastic.co/community/security; https://www.elastic.co/community/security
CVE: CVE-2017-2292
Published: 2017-06-30
Description: Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://puppet.com/security/cve/cve-2017-2292; https://security.gentoo.org/glsa/201709-01; https://puppet.com/security/cve/cve-2017-2292
CVE: CVE-2017-2298
Published: 2017-06-30
Description: The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to an arbitrary location on the client with the filename appended with the string "_pub.pem".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/puppetlabs/mcollective-sshkey-security/blob/0.5.1/CHANGELOG.md; https://github.com/puppetlabs/mcollective-sshkey-security/commit/3388a3109f4fb1c69fa8505e991bf59ca20d19a2; https://puppet.com/security/cve/cve-2017-2298
CVE: CVE-2017-10788
Published: 2017-07-01
Description: The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://seclists.org/oss-sec/2017/q2/443; http://www.securityfocus.com/bid/99374; https://github.com/perl5-dbi/DBD-mysql/issues/120
CVE: CVE-2017-10789
Published: 2017-07-01
Description: The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/99364; https://github.com/perl5-dbi/DBD-mysql/issues/110; https://github.com/perl5-dbi/DBD-mysql/issues/140
CVE: CVE-2017-10790
Published: 2017-07-02
Description: The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1464141; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-10791
Published: 2017-07-02
Description: There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://lists.gnu.org/archive/html/pspp-announce/2017-08/msg00000.html; https://bugzilla.redhat.com/show_bug.cgi?id=1467004; http://lists.gnu.org/archive/html/pspp-announce/2017-08/msg00000.html
CVE: CVE-2017-10792
Published: 2017-07-02
Description: There is a NULL Pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://lists.gnu.org/archive/html/pspp-announce/2017-08/msg00000.html; http://www.securityfocus.com/bid/99385; https://bugzilla.redhat.com/show_bug.cgi?id=1467005
CVE: CVE-2017-10706
Published: 2017-07-02
Description: When Antiy Antivirus Engine before 5.0.0.05171547 scans a special ZIP archive, it crashes with a stack-based buffer overflow because a fixed path length is used.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://www.lofter.com/lpost/1d52afc9_105e13e5; http://www.lofter.com/lpost/1d52afc9_105e13e5
CVE: CVE-2017-10795
Published: 2017-07-02
Description: Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99378; https://github.com/intelliants/subrion/issues/467; http://www.securityfocus.com/bid/99378
CVE: CVE-2017-0377
Published: 2017-07-02
Description: Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blog.torproject.org/blog/tor-0309-released-security-update-clients; https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients; https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c[PII_REDACTED]
CVE: CVE-2017-8797
Published: 2017-07-02
Description: The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b550a32e60a4941994b437a8d662432a486235a5; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f961e3f2acae94b727380c0b74e2d3954d0edf79; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.3
CVE: CVE-2017-8893
Published: 2017-07-02
Description: AeroAdmin 4.1 uses a function to copy data between two pointers where the size of the data copied is taken directly from a network packet. This can cause a buffer overflow and denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.tarlogic.com/advisories/Tarlogic-2017-001.txt; https://www.tarlogic.com/advisories/Tarlogic-2017-001.txt
CVE: CVE-2017-8894
Published: 2017-07-02
Description: AeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software updates. An attacker can hijack an update via man-in-the-middle in order to execute code in the machine.
CVSS Score: 8.1 (HIGH)
CWE: CWE-444
References: https://www.tarlogic.com/advisories/Tarlogic-2017-001.txt; https://www.tarlogic.com/advisories/Tarlogic-2017-001.txt
CVE: CVE-2017-10794
Published: 2017-07-02
Description: When GraphicsMagick 1.3.25 processes an RGB TIFF picture (with metadata indicating a single sample per pixel) in coders/tiff.c, a buffer overflow occurs, related to QuantumTransferMode.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99355; https://sourceforge.net/p/graphicsmagick/code/ci/a20bee0a0ad216aa11a2be3de63b60ca6bef4106/; https://usn.ubuntu.com/4206-1/
CVE: CVE-2017-10796
Published: 2017-07-02
Description: On TP-Link NC250 devices with firmware through 1.2.1 build 170515, anyone can view video and audio without authentication via an rtsp://admin@yourip:554/h264_hd.sdp URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://gist.github.com/elbauldelgeek/8f0f24c582f43f51a34b34420a385d75; https://gist.github.com/elbauldelgeek/8f0f24c582f43f51a34b34420a385d75
CVE: CVE-2017-10799
Published: 2017-07-03
Description: When GraphicsMagick 1.3.25 processes a DPX image (with metadata indicating a large width) in coders/dpx.c, a denial of service (OOM) can occur in ReadDPXImage().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/f10b9bb3ca62; http://www.securityfocus.com/bid/99358; https://lists.debian.org/debian-lts-announce/2019/04/msg00015.html
CVE: CVE-2017-10800
Published: 2017-07-03
Description: When GraphicsMagick 1.3.25 processes a MATLAB image in coders/mat.c, it can lead to a denial of service (OOM) in ReadMATImage() if the size specified for a MAT Object is larger than the actual amount of data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/e5761e3a2012; http://www.securityfocus.com/bid/99356; https://www.debian.org/security/2018/dsa-4321
CVE: CVE-2017-10798
Published: 2017-07-03
Description: In ObjectPlanet Opinio before 7.6.4, there is XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.objectplanet.com/opinio/changelog.html; http://www.objectplanet.com/opinio/changelog.html
CVE: CVE-2016-3400
Published: 2017-07-03
Description: NetApp Data ONTAP 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1006063; http://www.securityfocus.com/bid/99101; https://exchange.xforce.ibmcloud.com/vulnerabilities/113589
CVE: CVE-2016-3997
Published: 2017-07-03
Description: NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service by leveraging failure to enable SMB signing enforcement in its default state.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1006063; https://kb.netapp.com/support/s/article/ka51A0000008SXzQAM/smb-vulnerabilities-in-multiple-netapp-products; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1006063
CVE: CVE-2016-3998
Published: 2017-07-03
Description: NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.
CVSS Score: 8.1 (HIGH)
CWE: CWE-264
References: https://kb.netapp.com/support/s/article/ka51A0000008SXzQAM/smb-vulnerabilities-in-multiple-netapp-products; https://kb.netapp.com/support/s/article/ka51A0000008SXzQAM/smb-vulnerabilities-in-multiple-netapp-products
CVE: CVE-2016-5045
Published: 2017-07-03
Description: NetApp OnCommand System Manager before 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering setup.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://kb.netapp.com/support/s/article/ka51A00000007OTQAY/NTAP-20[PII_REDACTED]; https://kb.netapp.com/support/s/article/ka51A00000007OTQAY/NTAP-20[PII_REDACTED]
CVE: CVE-2016-6127
Published: 2017-07-03
Description: Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2017/dsa-3882; http://www.securityfocus.com/bid/99375; https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
CVE: CVE-2016-6201
Published: 2017-07-03
Description: Cross-site scripting (XSS) vulnerability in Ektron Content Management System (CMS) before 9.1.0.184 SP3 (9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/143014/Ektron-CMS-9.10SP1-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/143014/Ektron-CMS-9.10SP1-Cross-Site-Scripting.html
CVE: CVE-2017-5361
Published: 2017-07-03
Description: Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.
CVSS Score: 5.9 (MEDIUM)
References: http://www.debian.org/security/2017/dsa-3882; http://www.debian.org/security/2017/dsa-3883; https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
CVE: CVE-2017-5943
Published: 2017-07-03
Description: Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.debian.org/security/2017/dsa-3882; http://www.securityfocus.com/bid/99384; https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016