deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-10206
Published: 2017-03-03
Description: Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2017/02/05/1; http://www.securityfocus.com/bid/97114; https://www.foxmole.com/advisories/foxmole-2016-07-05.txt
CVE: CVE-2017-2290
Published: 2017-03-03
Description: On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/96583; https://puppet.com/security/cve/cve-2017-2290; http://www.securityfocus.com/bid/96583
CVE: CVE-2017-5193
Published: 2017-03-03
Description: The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a message without a nick.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2017/01/06/1; http://www.securityfocus.com/bid/95310; https://irssi.org/security/irssi_sa_2017_01.txt
CVE: CVE-2017-5194
Published: 2017-03-03
Description: Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2017/01/06/1; http://www.securityfocus.com/bid/95310; https://irssi.org/security/irssi_sa_2017_01.txt
CVE: CVE-2017-5195
Published: 2017-03-03
Description: Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2017/01/06/1; http://www.securityfocus.com/bid/95310; https://irssi.org/security/irssi_sa_2017_01.txt
CVE: CVE-2017-5196
Published: 2017-03-03
Description: Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2017/01/06/1; http://www.securityfocus.com/bid/95310; https://irssi.org/security/irssi_sa_2017_01.txt
CVE: CVE-2017-5356
Published: 2017-03-03
Description: Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2017/01/12/8; http://www.openwall.com/lists/oss-security/2017/01/13/2; http://www.securityfocus.com/bid/96581
CVE: CVE-2017-5571
Published: 2017-03-03
Description: Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in Citrix License Server for Windows and the Citrix License Server VPX, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/96028; https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01; https://support.citrix.com/article/CTX219885
CVE: CVE-2017-5613
Published: 2017-03-03
Description: Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-134
References: http://www.openwall.com/lists/oss-security/2017/01/28/8; http://www.securityfocus.com/bid/95870; https://news.cpanel.com/tsr-2017-0001-full-disclosure/
CVE: CVE-2017-5614
Published: 2017-03-03
Description: Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.openwall.com/lists/oss-security/2017/01/28/8; http://www.securityfocus.com/bid/95870; https://news.cpanel.com/tsr-2017-0001-full-disclosure/
CVE: CVE-2017-5615
Published: 2017-03-03
Description: cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.openwall.com/lists/oss-security/2017/01/28/8; http://www.securityfocus.com/bid/95870; https://news.cpanel.com/tsr-2017-0001-full-disclosure/
CVE: CVE-2017-5616
Published: 2017-03-03
Description: Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2017/01/28/8; http://www.securityfocus.com/bid/95870; https://news.cpanel.com/tsr-2017-0001-full-disclosure/
CVE: CVE-2017-5830
Published: 2017-03-03
Description: Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2017/02/02/3; http://www.securityfocus.com/bid/95875; https://www.revive-adserver.com/security/revive-sa-2017-001/
CVE: CVE-2017-5831
Published: 2017-03-03
Description: Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384
References: http://www.openwall.com/lists/oss-security/2017/02/02/3; http://www.securityfocus.com/bid/95875; https://www.revive-adserver.com/security/revive-sa-2017-001/
CVE: CVE-2017-5832
Published: 2017-03-03
Description: Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2017/02/02/3; http://www.securityfocus.com/bid/95875; https://www.revive-adserver.com/security/revive-sa-2017-001/
CVE: CVE-2017-5833
Published: 2017-03-03
Description: Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2017/02/02/3; http://www.securityfocus.com/bid/95875; https://www.revive-adserver.com/security/revive-sa-2017-001/
CVE: CVE-2017-5834
Published: 2017-03-03
Description: The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2017/01/31/6; http://www.openwall.com/lists/oss-security/2017/02/02/4; http://www.securityfocus.com/bid/96022
CVE: CVE-2017-5835
Published: 2017-03-03
Description: libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2017/01/31/6; http://www.openwall.com/lists/oss-security/2017/02/02/4; http://www.securityfocus.com/bid/96022
CVE: CVE-2017-5836
Published: 2017-03-03
Description: The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: http://www.openwall.com/lists/oss-security/2017/01/31/6; http://www.openwall.com/lists/oss-security/2017/02/02/4; http://www.securityfocus.com/bid/96022
CVE: CVE-2017-5865
Published: 2017-03-03
Description: The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96425; https://owncloud.org/security/advisory/?id=oc-sa-2017-001; http://www.securityfocus.com/bid/96425
CVE: CVE-2017-5866
Published: 2017-03-03
Description: The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96426; https://owncloud.org/security/advisory/?id=oc-sa-2017-002; http://www.securityfocus.com/bid/96426
CVE: CVE-2017-5867
Published: 2017-03-03
Description: ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and logfile flooding) via a one bit BMP file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/96430; https://owncloud.org/security/advisory/?id=oc-sa-2017-003; http://www.securityfocus.com/bid/96430
CVE: CVE-2015-8813
Published: 2017-03-03
Description: The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
CVSS Score: 8.2 (HIGH)
CWE: CWE-918
References: http://issues.umbraco.org/issue/U4-7457; http://www.openwall.com/lists/oss-security/2016/02/16/10; http://www.openwall.com/lists/oss-security/2016/02/17/1
CVE: CVE-2015-8814
Published: 2017-03-03
Description: Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://issues.umbraco.org/issue/U4-7459; http://www.openwall.com/lists/oss-security/2016/02/16/10; https://github.com/umbraco/Umbraco-CMS/commit/18c3345e47663a358a042652e697b988d6a380eb
CVE: CVE-2015-8815
Published: 2017-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to (1) the media page, (2) the developer data edit page, or (3) the form page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://issues.umbraco.org/issue/U4-7461; http://www.openwall.com/lists/oss-security/2016/02/16/10; http://issues.umbraco.org/issue/U4-7461
CVE: CVE-2016-6882
Published: 2017-03-03
Description: MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key information by conducting a Lenstra side-channel attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-320
References: http://www.openwall.com/lists/oss-security/2016/08/19/7; http://www.securityfocus.com/bid/91488; https://access.redhat.com/blogs/766093/posts/1976703
CVE: CVE-2016-6883
Published: 2017-03-03
Description: MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher variant attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/08/19/8; http://www.securityfocus.com/bid/91488; https://github.com/matrixssl/matrixssl/blob/master/CHANGES.md
CVE: CVE-2016-6884
Published: 2017-03-03
Description: TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/08/19/8; http://www.securityfocus.com/bid/91488; https://github.com/matrixssl/matrixssl/blob/master/CHANGES.md
CVE: CVE-2016-7406
Published: 2017-03-03
Description: Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/09/15/2; http://www.securityfocus.com/bid/92974; https://bugzilla.redhat.com/show_bug.cgi?id=1376353
CVE: CVE-2016-7407
Published: 2017-03-03
Description: The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/09/15/2; http://www.securityfocus.com/bid/92972; https://bugzilla.redhat.com/show_bug.cgi?id=1376353
CVE: CVE-2016-7408
Published: 2017-03-03
Description: The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/09/15/2; http://www.securityfocus.com/bid/92970; https://bugzilla.redhat.com/show_bug.cgi?id=1376353
CVE: CVE-2016-7409
Published: 2017-03-03
Description: The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/09/15/2; http://www.securityfocus.com/bid/92973; https://bugzilla.redhat.com/show_bug.cgi?id=1376353
CVE: CVE-2016-7969
Published: 2017-03-03
Description: The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00068.html; http://www.openwall.com/lists/oss-security/2016/10/05/2; http://www.securityfocus.com/bid/93358
CVE: CVE-2016-7970
Published: 2017-03-03
Description: Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/10/05/2; http://www.securityfocus.com/bid/93358; https://bugzilla.redhat.com/show_bug.cgi?id=1381960
CVE: CVE-2016-7971
Published: 2017-03-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2016-7972
Published: 2017-03-03
Description: The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00068.html; http://www.openwall.com/lists/oss-security/2016/10/05/2; http://www.securityfocus.com/bid/93358
CVE: CVE-2016-10061
Published: 2017-03-03
Description: The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-252
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95207; https://bugzilla.redhat.com/show_bug.cgi?id=1410471
CVE: CVE-2016-10065
Published: 2017-03-03
Description: The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html; http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95213
CVE: CVE-2016-10066
Published: 2017-03-03
Description: Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95217; https://bugzilla.redhat.com/show_bug.cgi?id=1410491
CVE: CVE-2016-10070
Published: 2017-03-03
Description: Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00031.html; http://www.openwall.com/lists/oss-security/2016/12/26/9
CVE: CVE-2016-3127
Published: 2017-03-03
Description: An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain diagnostic log files through either a valid logon or an unrelated compromise of the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000038301; http://www.securityfocus.com/bid/96629; http://support.blackberry.com/kb/articleDetail?articleNumber=000038301
CVE: CVE-2016-8236
Published: 2017-03-03
Description: Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM versions earlier than 3.77.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://support.lenovo.com/us/en/solutions/LEN-9307; https://support.lenovo.com/us/en/solutions/LEN-9307
CVE: CVE-2017-6467
Published: 2017-03-04
Description: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by changing the restrictions on file size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96561; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12083
CVE: CVE-2017-6468
Published: 2017-03-04
Description: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating the relationship between pages and records.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96569; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13430
CVE: CVE-2017-6469
Published: 2017-03-04
Description: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-ldss.c by ensuring that memory is allocated for a certain data structure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96577; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13346
CVE: CVE-2017-6470
Published: 2017-03-04
Description: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-iax2.c by constraining packet lateness.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96563; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13432
CVE: CVE-2017-6471
Published: 2017-03-04
Description: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by validating the capability length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96564; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13348
CVE: CVE-2017-6472
Published: 2017-03-04
Description: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rtmpt.c by properly incrementing a certain sequence value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96571; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13347
CVE: CVE-2017-6473
Published: 2017-03-04
Description: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c by validating the relationships between lengths and offsets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96565; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13431
CVE: CVE-2017-6474
Published: 2017-03-04
Description: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating record sizes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96566; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13429
CVE: CVE-2017-6445
Published: 2017-03-05
Description: The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-347
References: http://www.securityfocus.com/bid/96580; https://tech.feedyourhead.at/content/openelec-cve-2017-6445-revisited; https://tech.feedyourhead.at/content/openelec-remote-code-execution-vulnerability-through-man-in-the-middle
CVE: CVE-2017-6478
Published: 2017-03-05
Description: paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php (step parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96584; https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2017-6478.md; https://github.com/paintballrefjosh/MaNGOSWebV4/issues/15
CVE: CVE-2017-6479
Published: 2017-03-05
Description: FenixHosting/fenix-open-source before 2017-03-04 is vulnerable to a reflected XSS in forums/search.php (search-by-topic parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96587; https://github.com/FenixHosting/fenix-open-source/issues/2; http://www.securityfocus.com/bid/96587
CVE: CVE-2017-6480
Published: 2017-03-05
Description: groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php (path parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96585; https://github.com/groovel/cmsgroovel/issues/2; https://github.com/groovel/cmsgroovel/releases/tag/3.3.7-beta