deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9267
Published: 2018-03-02
Description: In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-757
References: https://www.novell.com/support/kb/doc.php?id=7016794; https://www.novell.com/support/kb/doc.php?id=7016794
CVE: CVE-2017-9276
Published: 2018-03-02
Description: Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.novell.com/support/kb/doc.php?id=7022359; https://www.novell.com/support/kb/doc.php?id=7022359
CVE: CVE-2017-9277
Published: 2018-03-02
Description: The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections without EBA.
CVSS Score: 4.2 (MEDIUM)
References: https://bugzilla.suse.com/show_bug.cgi?id=1005473; https://www.netiq.com/documentation/edirectory-9/edirectory904_releasenotes/data/edirectory904_releasenotes.html; https://www.novell.com/support/kb/doc.php?id=7016794
CVE: CVE-2017-9278
Published: 2018-03-02
Description: The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the EBS tables.
CVSS Score: 3.3 (LOW)
CWE: CWE-532, CWE-532
References: https://bugzilla.suse.com/show_bug.cgi?id=1053200; https://download.novell.com/Download?buildid=DKFkx_xPeaw~; https://bugzilla.suse.com/show_bug.cgi?id=1053200
CVE: CVE-2017-9279
Published: 2018-03-02
Description: NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Administration, allowing malicious user administrators to potentially execute code or mislead users.
CVSS Score: 2.0 (LOW)
CWE: CWE-434, CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=1049129; https://download.novell.com/Download?buildid=K7lbPAGJyIk~; https://bugzilla.suse.com/show_bug.cgi?id=1049129
CVE: CVE-2017-9280
Published: 2018-03-02
Description: Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-598, CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=1049143; https://download.novell.com/Download?buildid=K7lbPAGJyIk~; https://bugzilla.suse.com/show_bug.cgi?id=1049143
CVE: CVE-2017-9285
Published: 2018-03-02
Description: NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-287
References: https://bugzilla.suse.com/show_bug.cgi?id=1029077; https://www.netiq.com/documentation/edirectory-9/edirectory904_releasenotes/data/edirectory904_releasenotes.html; https://www.novell.com/support/kb/doc.php?id=7016794
CVE: CVE-2018-7433
Published: 2018-03-02
Description: The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://wordpress.org/plugins/better-wp-security/#developers; https://wordpress.org/plugins/better-wp-security/#developers
CVE: CVE-2015-7596
Published: 2018-03-02
Description: SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7597
Published: 2018-03-02
Description: SafeNet Authentication Service IIS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7598
Published: 2018-03-02
Description: SafeNet Authentication Service TokenValidator Proxy Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7961
Published: 2018-03-02
Description: SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7962
Published: 2018-03-02
Description: SafeNet Authentication Service for Outlook Web App Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7963
Published: 2018-03-02
Description: SafeNet Authentication Service for AD FS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7964
Published: 2018-03-02
Description: SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7965
Published: 2018-03-02
Description: SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7966.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7966
Published: 2018-03-02
Description: SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7965.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2015-7967
Published: 2018-03-02
Description: SafeNet Authentication Service for Citrix Web Interface Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://labs.nettitude.com/blog/cve-2015-7596-through-cve-2015-7598-cve-2015-7961-through-cve-2015-7967-safenet-authentication-service-agent-vulnerabilities/; https://labs.nettitude.com/wp-content/uploads/2016/03/160125-1-Gemalto-IDSS-Security-Bulletin-SAS-Agents-Privilege-Escalation.pdf; https://safenet.gemalto.com/technical-support/security-updates/
CVE: CVE-2018-7449
Published: 2018-03-04
Description: SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or RETR command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://hyp3rlinx.altervista.org/advisories/SEGGER-embOS-FTP-SERVER-v3.22-FTP-COMMANDS-DENIAL-OF-SERVICE.txt; https://www.exploit-db.com/exploits/44221/; http://hyp3rlinx.altervista.org/advisories/SEGGER-embOS-FTP-SERVER-v3.22-FTP-COMMANDS-DENIAL-OF-SERVICE.txt
CVE: CVE-2018-7583
Published: 2018-03-04
Description: Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.exploit-db.com/exploits/44222/; https://www.exploit-db.com/exploits/44222/
CVE: CVE-2018-7651
Published: 2018-03-04
Description: index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://github.com/zkat/ssri/commit/d0ebcdc22cb5c8f47f89716d08b3518b2485d65d; https://github.com/zkat/ssri/issues/10; https://nodesecurity.io/advisories/565
CVE: CVE-2018-7652
Published: 2018-03-04
Description: lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dotse/zonemaster-gui/commit/568e8db44930fda4563c1e708a2440909fd8e5fe; https://github.com/dotse/zonemaster-gui/issues/217; https://github.com/dotse/zonemaster-gui/pull/218
CVE: CVE-2018-7654
Published: 2018-03-04
Description: On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.rootlabs.com.br/path-traversal-in-3cx/; https://medium.com/stolabs/path-traversal-in-3cx-7421a8ffdb7a; http://www.rootlabs.com.br/path-traversal-in-3cx/
CVE: CVE-2017-18213
Published: 2018-03-04
Description: In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges.
CVSS Score: 7.2 (HIGH)
References: http://www.exponentcms.org/news/patch-6-released-for-v2-4-1-to-fix-a-few-big-issues; https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.1patch6; http://www.exponentcms.org/news/patch-6-released-for-v2-4-1-to-fix-a-few-big-issues
CVE: CVE-2018-7653
Published: 2018-03-04
Description: In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ponyma233/YzmCMS/blob/master/YzmCMS_3.6_bug.md; https://packetstormsecurity.com/files/147065/YzmCMS-3.6-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/44405/
CVE: CVE-2018-7560
Published: 2018-03-04
Description: index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/myshenin/aws-lambda-multipart-parser/commit/56ccb03af4dddebc2b2defb348b6558783d5757e; https://github.com/myshenin/aws-lambda-multipart-parser/commit/56ccb03af4dddebc2b2defb348b6558783d5757e
CVE: CVE-2018-7567
Published: 2018-03-04
Description: In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation.  NOTE: the vendor disputes this issue stating "the behaviour is as designed and needed for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", and "there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://0day.today/exploit/29938; https://0day.today/exploit/29938
CVE: CVE-2017-18214
Published: 2018-03-04
Description: The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/moment/moment/issues/4163; https://nodesecurity.io/advisories/532; https://www.tenable.com/security/tns-2019-02
CVE: CVE-2018-7661
Published: 2018-03-04
Description: Papenmeier WiFi Baby Monitor Free & Lite before 2.02.2 allows remote attackers to obtain audio data via certain requests to TCP ports 8258 and 8257.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://blog.manchestergreyhats.co.uk/2018/02/25/eavesdropping-on-wifi-baby-monitor/; https://www.exploit-db.com/exploits/442322/; https://blog.manchestergreyhats.co.uk/2018/02/25/eavesdropping-on-wifi-baby-monitor/
CVE: CVE-2018-7662
Published: 2018-03-04
Description: Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/CouchCMS/CouchCMS/issues/46; https://github.com/CouchCMS/CouchCMS/issues/46
CVE: CVE-2018-7663
Published: 2018-03-05
Description: An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile (resources/views/layouts/app.blade.php) allows for server-side template injection of arbitrary JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/spencerdodd/public-writeups/blob/master/CVE-2018-7663/README.md; https://github.com/voten-co/voten/commit/ee6a322568166e28465da075159a6d4adbf74d53; https://github.com/spencerdodd/public-writeups/blob/master/CVE-2018-7663/README.md
CVE: CVE-2018-7664
Published: 2018-03-05
Description: An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the file_name parameter to /api/file_uploader.php or /actions/file_downloader.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://lists.openwall.net/full-disclosure/2018/02/27/1; https://www.sec-consult.com/en/blog/advisories/os-command-injection-arbitrary-file-upload-sql-injection-in-clipbucket/index.html; http://lists.openwall.net/full-disclosure/2018/02/27/1
CVE: CVE-2018-7665
Published: 2018-03-05
Description: An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beats_uploader.php or actions/photo_uploader.php, or the coverPhoto parameter to edit_account.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://lists.openwall.net/full-disclosure/2018/02/27/1; https://www.sec-consult.com/en/blog/advisories/os-command-injection-arbitrary-file-upload-sql-injection-in-clipbucket/index.html; http://lists.openwall.net/full-disclosure/2018/02/27/1
CVE: CVE-2018-7666
Published: 2018-03-05
Description: An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/vote_channel.php channelId parameter, the ajax/commonAjax.php email parameter, and the ajax/commonAjax.php username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lists.openwall.net/full-disclosure/2018/02/27/1; https://www.sec-consult.com/en/blog/advisories/os-command-injection-arbitrary-file-upload-sql-injection-in-clipbucket/index.html; http://lists.openwall.net/full-disclosure/2018/02/27/1
CVE: CVE-2018-7667
Published: 2018-03-05
Description: Adminer through 4.3.1 has SSRF via the server parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt; https://lists.debian.org/debian-lts-announce/2018/03/msg00014.html; http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt
CVE: CVE-2018-7668
Published: 2018-03-05
Description: TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.openwall.net/full-disclosure/2018/02/28/1; http://lists.openwall.net/full-disclosure/2018/02/28/1
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-05
Description: Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://access.redhat.com/errata/RHBA-2018:2140; https://access.redhat.com/errata/RHSA-2018:1593; https://access.redhat.com/errata/RHSA-2018:1627
CVE: CVE-2018-1316
Published: 2018-03-05
Description: The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was addressed in Apache ODE 1.3.3 which was released in 2009, however the incorrect name CVE-2008-2370 was used on the advisory by mistake.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://mail-archives.apache.org/mod_mbox/www-announce/200908.mbox/%3Cfbdc6a[PII_REDACTED]41w20a7a9d9ka1f896ad8073dffb%40mail.gmail.com%3E; https://lists.apache.org/thread.html/ce416ddfba1a87f4b8e2d8125f1c3b45d1f0b350af29a4d0405e213b%40%3Cuser.ode.apache.org%3E; http://mail-archives.apache.org/mod_mbox/www-announce/200908.mbox/%3Cfbdc6a[PII_REDACTED]41w20a7a9d9ka1f896ad8073dffb%40mail.gmail.com%3E
CVE: CVE-2018-7644
Published: 2018-03-05
Description: The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://simplesamlphp.org/security/201802-01; https://simplesamlphp.org/security/201802-01
CVE: CVE-2018-0490
Published: 2018-03-05
Description: An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915; https://trac.torproject.org/projects/tor/ticket/25074; https://www.debian.org/security/2018/dsa-4183
CVE: CVE-2018-0491
Published: 2018-03-05
Description: A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915; https://trac.torproject.org/projects/tor/ticket/24700; https://trac.torproject.org/projects/tor/ticket/25117
CVE: CVE-2009-2413
Published: 2018-03-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2009.  Notes: none
CVE: CVE-2017-7427
Published: 2018-03-05
Description: Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector, via vdtData in the Version discovery and via nextFrame in the Object Inspector and via Host GUID in the System details plugins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.suse.com/show_bug.cgi?id=1033828; https://www.novell.com/support/kb/doc.php?id=7021423; https://bugzilla.suse.com/show_bug.cgi?id=1033828
CVE: CVE-2017-7437
Published: 2018-03-05
Description: NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.suse.com/show_bug.cgi?id=1001069; https://www.netiq.com/documentation/privileged-account-manager-3/npam3103-release-notes/data/npam3103-release-notes.html; https://bugzilla.suse.com/show_bug.cgi?id=1001069
CVE: CVE-2017-7633
Published: 2018-03-05
Description: QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.qnap.com/zh-tw/security-advisory/nas-201802-27; https://www.qnap.com/zh-tw/security-advisory/nas-201802-27