deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9901
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to "Data from Faulting Address controls subsequent Write Address starting at Xfpx!gffGetFormatInfo+0x[PII_REDACTED]02bfd5."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9901; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9901
CVE: CVE-2017-9902
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to "Data from Faulting Address controls Code Flow starting at Xfpx!gffGetFormatInfo+0x[PII_REDACTED]020e91."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9902; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9902
CVE: CVE-2017-9903
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to "Data from Faulting Address controls Code Flow starting at Xfpx+0x[PII_REDACTED]0117ff."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9903; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9903
CVE: CVE-2017-9904
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlpLowFragHeapFree+0x[PII_REDACTED]00001f."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9904; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9904
CVE: CVE-2017-9905
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Data from Faulting Address controls Branch Selection starting at Xfpx!gffGetFormatInfo+0x[PII_REDACTED]0228e8."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9905; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9905
CVE: CVE-2017-9906
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at Xfpx!gffGetFormatInfo+0x[PII_REDACTED]028508."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9906; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9906
CVE: CVE-2017-9907
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Possible Stack Corruption starting at Xfpx!gffGetFormatInfo+0x[PII_REDACTED]022e1f."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9907; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9907
CVE: CVE-2017-9908
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to a "Read Access Violation starting at Xfpx+0x[PII_REDACTED]00d6da."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9908; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9908
CVE: CVE-2017-9909
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlAddAccessAllowedAce+0x[PII_REDACTED]00027a."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9909; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9909
CVE: CVE-2017-9910
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to an "Error Code (0xc000041d) starting at wow64!Wow64NotifyDebugger+0x[PII_REDACTED]00001d."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9910; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9910
CVE: CVE-2017-9911
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at Xfpx+0x[PII_REDACTED]010e81."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9911; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9911
CVE: CVE-2017-9912
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlpFreeHeap+0x[PII_REDACTED]000393."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9912; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9912
CVE: CVE-2017-9913
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!TpAllocCleanupGroup+0x[PII_REDACTED]0003d7."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9913; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9913
CVE: CVE-2017-9914
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .bie file, related to a "Read Access Violation on Block Data Move starting at Xjbig+0x[PII_REDACTED]00121b."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9914; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9914
CVE: CVE-2017-9915
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS plugin 4.50 allows attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "Read Access Violation on Block Data Move starting at ntdll_77df0000!memcpy+0x[PII_REDACTED]000033."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9915; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9915
CVE: CVE-2017-9916
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS Plugin 4.50 might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlFreeHandle+0x[PII_REDACTED]0001b6."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9916; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9916
CVE: CVE-2017-9917
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS Plugin 4.50 might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at ntdll_77df0000!RtlFreeHandle+0x[PII_REDACTED]000218."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9917; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9917
CVE: CVE-2017-9918
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS Plugin 4.50 might allow attackers to cause a denial of service or execute arbitrary code via a crafted file, related to "Data from Faulting Address controls Branch Selection starting at KERNELBASE!QueryOptionalDelayLoadedAPI+0x[PII_REDACTED]000c42."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9918; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9918
CVE: CVE-2017-9919
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS Plugin 4.50 might allow attackers to cause a denial of service or execute arbitrary code via a crafted file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!LdrpResCompareResourceNames+0x[PII_REDACTED]000087."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9919; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9919
CVE: CVE-2017-9920
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS Plugin 4.50 might allow attackers to cause a denial of service or execute arbitrary code via a crafted file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!LdrpResSearchResourceInsideDirectory+0x[PII_REDACTED]00029e."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9920; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9920
CVE: CVE-2017-9921
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS Plugin 4.50 might allow attackers to cause a denial of service or execute arbitrary code via a crafted file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!LdrpResGetMappingSize+0x[PII_REDACTED]0003cc."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9921; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9921
CVE: CVE-2017-9922
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS Plugin 4.50 might allow attackers to cause a denial of service or execute arbitrary code via a crafted file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!LdrpCompareResourceNames_U+0x[PII_REDACTED]000062."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9922; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9922
CVE: CVE-2017-9923
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) with TOOLS Plugin 4.50 might allow attackers to cause a denial of service or execute arbitrary code via a crafted file, related to "Data from Faulting Address controls Branch Selection starting at KERNELBASE!EnumResourceTypesInternal+0x[PII_REDACTED]000589."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9923; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9923
CVE: CVE-2017-9924
Published: 2017-07-05
Description: In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "User Mode Write AV starting at image00000000_00400000+0x[PII_REDACTED]01b72a."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9924; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9924
CVE: CVE-2017-9925
Published: 2017-07-05
Description: In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to execute arbitrary code or cause a denial of service via a crafted file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x[PII_REDACTED]00001d."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9925; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9925
CVE: CVE-2017-9926
Published: 2017-07-05
Description: In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to a "Read Access Violation starting at image00000000_00400000+0x[PII_REDACTED]01b596."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9926; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9926
CVE: CVE-2017-9927
Published: 2017-07-05
Description: In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to a "Read Access Violation starting at image00000000_00400000+0x[PII_REDACTED]01b5fe."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9927; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9927
CVE: CVE-2017-6707
Published: 2017-07-06
Description: A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0, 5500 Series, and 5700 Series devices and Cisco Virtualized Packet Core (VPC) Software could allow an authenticated, local attacker to break from the StarOS CLI of an affected system and execute arbitrary shell commands as a Linux root user on the system, aka Command Injection. The vulnerability exists because the affected operating system does not sufficiently sanitize commands before inserting them into Linux shell commands. An attacker could exploit this vulnerability by submitting a crafted CLI command for execution in a Linux shell command as a root user. Cisco Bug IDs: CSCvc69329, CSCvc72930.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/99462; http://www.securitytracker.com/id/1038818; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-asrcmd
CVE: CVE-2017-6708
Published: 2017-07-06
Description: A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulnerability is due to the absence of validation checks for the input that is used to create symbolic links. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76654.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/99512; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf1; http://www.securityfocus.com/bid/99512
CVE: CVE-2017-6709
Published: 2017-07-06
Description: A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller (ESC) and Cisco OpenStack deployments in an affected system. The vulnerability exists because the affected software logs administrative credentials in clear text for Cisco ESC and Cisco OpenStack deployment purposes. An attacker could exploit this vulnerability by accessing the AutoVNF URL for the location where the log files are stored and subsequently accessing the administrative credentials that are stored in clear text in those log files. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76659.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-522, CWE-532
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf2
CVE: CVE-2017-6711
Published: 2017-07-06
Description: A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device. The vulnerability is due to an insecure default configuration of the Apache ZooKeeper service used by the affected software. An attacker could exploit this vulnerability by accessing the affected device through the orchestrator network. An exploit could allow the attacker to gain access to ZooKeeper data nodes (znodes) and influence the behavior of the system's high-availability feature. This vulnerability affects all releases of Cisco Ultra Services Framework UAS prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvd29395.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/99440; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-uas; http://www.securityfocus.com/bid/99440
CVE: CVE-2017-6712
Published: 2017-07-06
Description: A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76634.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/99461; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-esc1; http://www.securityfocus.com/bid/99461
CVE: CVE-2017-6713
Published: 2017-07-06
Description: A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacker who can extract the static credentials from an existing installation of Cisco ESC could generate an admin session token that allows access to all instances of the ESC web UI. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76627.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264, CWE-770
References: http://www.securityfocus.com/bid/99437; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-esc2; http://www.securityfocus.com/bid/99437
CVE: CVE-2017-6714
Published: 2017-07-06
Description: A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The vulnerability is due to improper shell invocations. An attacker could exploit this vulnerability by crafting CLI command inputs to execute Linux shell commands as the root user. This vulnerability affects all releases of Cisco Ultra Services Framework Staging Server prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76673.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/99436; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf3; http://www.securityfocus.com/bid/99436
CVE: CVE-2016-10396
Published: 2017-07-06
Description: The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in a particular order such that the worst-case computational complexity is realized in the algorithm utilized to determine if reassembly of the fragments can take place.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c.diff?r1=1.5&r2=1.5.36.1; http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c?only_with_tag=MAIN; https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682
CVE: CVE-2017-10970
Published: 2017-07-06
Description: Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1038908; https://github.com/Cacti/cacti/issues/838; http://www.securitytracker.com/id/1038908
CVE: CVE-2017-10971
Published: 2017-07-06
Description: In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3905; http://www.securityfocus.com/bid/99546; https://bugzilla.suse.com/show_bug.cgi?id=1035283
CVE: CVE-2017-10972
Published: 2017-07-06
Description: Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-665
References: http://www.debian.org/security/2017/dsa-3905; http://www.securityfocus.com/bid/99543; https://bugzilla.suse.com/show_bug.cgi?id=1035283
CVE: CVE-2017-10975
Published: 2017-07-06
Description: Cross-site scripting (XSS) vulnerability in Lutim before 0.8 might allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in an upload notification and in the myfiles component, if the attacker can convince the victim to proceed with an upload despite the appearance of an XSS payload in the filename.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://framagit.org/luc/lutim/issues/40; https://framagit.org/luc/lutim/issues/40
CVE: CVE-2017-1236
Published: 2017-07-06
Description: IBM WebSphere MQ 9.0.2 could allow an authenticated user to potentially cause a denial of service by saving an incorrect channel status inquiry. IBM X-Force ID: 124354
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22003510; http://www.securityfocus.com/bid/99505; https://exchange.xforce.ibmcloud.com/vulnerabilities/124354
CVE: CVE-2017-10976
Published: 2017-07-06
Description: When SWFTools 0.9.2 processes a crafted file in ttftool, it can lead to a heap-based buffer over-read in the readBlock() function in lib/ttf.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/matthiaskramm/swftools/issues/28; https://github.com/matthiaskramm/swftools/issues/28
CVE: CVE-2016-4000
Published: 2017-07-06
Description: Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://bugs.jython.org/issue2454; http://www.debian.org/security/2017/dsa-3893; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html