deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2258
Published: 2017-08-29
Description: Directory traversal vulnerability in Cybozu Garoon 4.2.4 to 4.2.5 allows an attacker to read arbitrary files via Garoon SOAP API "WorkflowHandleApplications".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN63564682/index.html; https://support.cybozu.com/ja-jp/article/9846; https://jvn.jp/en/jp/JVN63564682/index.html
CVE: CVE-2017-3746
Published: 2017-08-29
Description: ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerability that could allow a local user to execute arbitrary code with administrative or system level privileges.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100520; https://support.lenovo.com/us/en/product_security/LEN-9896; http://www.securityfocus.com/bid/100520
CVE: CVE-2017-3757
Published: 2017-08-29
Description: An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://support.lenovo.com/us/en/product_security/LEN-14390; https://support.lenovo.com/us/en/product_security/LEN-14390
CVE: CVE-2017-13685
Published: 2017-08-29
Description: The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg105314.html; http://www.securityfocus.com/bid/100521; https://usn.ubuntu.com/4019-1/
CVE: CVE-2017-13726
Published: 2017-08-29
Description: There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://bugzilla.maptools.org/show_bug.cgi?id=2727; http://www.securityfocus.com/bid/100524; https://usn.ubuntu.com/3602-1/
CVE: CVE-2017-13727
Published: 2017-08-29
Description: There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://bugzilla.maptools.org/show_bug.cgi?id=2728; http://www.securityfocus.com/bid/100524; https://usn.ubuntu.com/3602-1/
CVE: CVE-2017-13728
Published: 2017-08-29
Description: There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=1484274; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-13729
Published: 2017-08-29
Description: There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1484276; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-13730
Published: 2017-08-29
Description: There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1484284; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-13731
Published: 2017-08-29
Description: There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1484285; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-13732
Published: 2017-08-29
Description: There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1484287; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-13733
Published: 2017-08-29
Description: There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1484290; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-13734
Published: 2017-08-29
Description: There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1484291; https://security.gentoo.org/glsa/201804-13; https://bugzilla.redhat.com/show_bug.cgi?id=1484291
CVE: CVE-2017-13735
Published: 2017-08-29
Description: There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1483988; https://bugzilla.redhat.com/show_bug.cgi?id=1483988
CVE: CVE-2017-13736
Published: 2017-08-29
Description: There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100513; https://bugzilla.redhat.com/show_bug.cgi?id=1484192; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/
CVE: CVE-2017-13737
Published: 2017-08-29
Description: There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/3db9449e3d6a/; http://openwall.com/lists/oss-security/2017/08/29/4; http://www.securityfocus.com/bid/100518
CVE: CVE-2017-13738
Published: 2017-08-29
Description: There is an illegal address access in the _lou_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100607; https://access.redhat.com/errata/RHSA-2017:3111; https://bugzilla.redhat.com/show_bug.cgi?id=1484297
CVE: CVE-2017-13739
Published: 2017-08-29
Description: There is a heap-based buffer overflow that causes a more than two thousand bytes out-of-bounds write in Liblouis 3.2.0, triggered in the function resolveSubtable() in compileTranslationTable.c. It will lead to denial of service or remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100607; https://bugzilla.redhat.com/show_bug.cgi?id=1484299; http://www.securityfocus.com/bid/100607
CVE: CVE-2017-13740
Published: 2017-08-29
Description: There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function parseChars() in compileTranslationTable.c, that will lead to denial of service or possibly unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100607; https://access.redhat.com/errata/RHSA-2017:3111; https://bugzilla.redhat.com/show_bug.cgi?id=1484306
CVE: CVE-2017-13741
Published: 2017-08-29
Description: There is a use-after-free in the function compileBrailleIndicator() in compileTranslationTable.c in Liblouis 3.2.0 that will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://www.securityfocus.com/bid/100607; https://access.redhat.com/errata/RHSA-2017:3111; https://bugzilla.redhat.com/show_bug.cgi?id=1484332
CVE: CVE-2017-13742
Published: 2017-08-29
Description: There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function includeFile() in compileTranslationTable.c, that will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100607; https://access.redhat.com/errata/RHSA-2017:3111; https://bugzilla.redhat.com/show_bug.cgi?id=1484334
CVE: CVE-2017-13743
Published: 2017-08-29
Description: There is a buffer overflow in Liblouis 3.2.0, triggered in the function _lou_showString() in utils.c, that will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100607; https://access.redhat.com/errata/RHSA-2017:3111; https://bugzilla.redhat.com/show_bug.cgi?id=1484335
CVE: CVE-2017-13744
Published: 2017-08-29
Description: There is an illegal address access in the function _lou_getALine() in compileTranslationTable.c:343 in Liblouis 3.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100607; https://access.redhat.com/errata/RHSA-2017:3111; https://bugzilla.redhat.com/show_bug.cgi?id=1484338
CVE: CVE-2017-13745
Published: 2017-08-29
Description: There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack by triggering an unexpected jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.securityfocus.com/bid/100514; https://bugzilla.redhat.com/show_bug.cgi?id=1485274; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
CVE: CVE-2017-13746
Published: 2017-08-29
Description: There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.securityfocus.com/bid/100514; https://bugzilla.redhat.com/show_bug.cgi?id=1485286; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
CVE: CVE-2017-13747
Published: 2017-08-29
Description: There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.securityfocus.com/bid/100514; https://bugzilla.redhat.com/show_bug.cgi?id=1485282; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
CVE: CVE-2017-13748
Published: 2017-08-29
Description: There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100514; https://bugzilla.redhat.com/show_bug.cgi?id=1485287; https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html
CVE: CVE-2017-13749
Published: 2017-08-29
Description: There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.securityfocus.com/bid/100514; https://bugzilla.redhat.com/show_bug.cgi?id=1485285; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
CVE: CVE-2017-13750
Published: 2017-08-29
Description: There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.securityfocus.com/bid/100514; https://bugzilla.redhat.com/show_bug.cgi?id=1485280; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
CVE: CVE-2017-13751
Published: 2017-08-29
Description: There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.securityfocus.com/bid/100514; https://bugzilla.redhat.com/show_bug.cgi?id=1485283; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
CVE: CVE-2017-13752
Published: 2017-08-29
Description: There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.securityfocus.com/bid/100514; https://bugzilla.redhat.com/show_bug.cgi?id=1485276; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
CVE: CVE-2017-13753
Published: 2017-08-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9396.  Reason: This candidate is a duplicate of CVE-2016-9396.  Notes: All CVE users should reference CVE-2016-9396 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-10950
Published: 2017-08-29
Description: This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Bitdefender Total Security 21.0.24.62. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within processing of the 0x8000E038 IOCTL in the bdfwfpf driver. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker could leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4776.
CVSS Score: 7.0 (HIGH)
CWE: CWE-415, CWE-415
References: http://www.securityfocus.com/bid/100418; https://zerodayinitiative.com/advisories/ZDI-17-693; http://www.securityfocus.com/bid/100418
CVE: CVE-2017-10951
Published: 2017-08-29
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within app.launchURL method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4724.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/100409; http://www.securitytracker.com/id/1039213; https://zerodayinitiative.com/advisories/ZDI-17-691
CVE: CVE-2017-10952
Published: 2017-08-29
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.2051. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs JavaScript function. The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-4518.
CVSS Score: 8.8 (HIGH)
CWE: CWE-693, CWE-20
References: http://www.securityfocus.com/bid/100412; http://www.securitytracker.com/id/1039212; https://0patch.blogspot.com/2017/08/0patching-foxit-readers-saveas-0day-cve.html
CVE: CVE-2015-3653
Published: 2017-08-29
Description: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to write to arbitrary files within the underlying operating system and consequently cause a denial of service or gain privileges by leveraging incorrect permission checking.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt; http://www.securityfocus.com/bid/100593; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt
CVE: CVE-2015-3654
Published: 2017-08-29
Description: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-4649.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt; http://www.securityfocus.com/bid/100602; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt
CVE: CVE-2015-3655
Published: 2017-08-29
Description: Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt; http://www.securityfocus.com/bid/100594; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt
CVE: CVE-2015-3656
Published: 2017-08-29
Description: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks.
CVSS Score: 7.2 (HIGH)
CWE: CWE-285
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt; http://www.securityfocus.com/bid/100597; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt
CVE: CVE-2015-3657
Published: 2017-08-29
Description: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain "Super Admin" privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt; http://www.securityfocus.com/bid/100600; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt
CVE: CVE-2015-4649
Published: 2017-08-29
Description: Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-3654.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt; http://www.securityfocus.com/bid/100539; http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt
CVE: CVE-2015-5209
Published: 2017-08-29
Description: Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/82550; http://www.securitytracker.com/id/1033908; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2015-6588
Published: 2017-08-29
Description: Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134529/MODX-2.3.5-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/134529/MODX-2.3.5-Cross-Site-Scripting.html
CVE: CVE-2015-6942
Published: 2017-08-29
Description: Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Nov/100; http://seclists.org/fulldisclosure/2015/Nov/100
CVE: CVE-2015-7255
Published: 2017-08-29
Description: ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/566724; https://github.com/sec-consult/houseofkeys/search?p=3&q=zte&type=&utf8=%E2%9C%93; https://www.kb.cert.org/vuls/id/BLUU-A2NQYR
CVE: CVE-2015-7517
Published: 2017-08-29
Description: Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in public/includes/.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://permalink.gmane.org/gmane.comp.security.oss.general/18255; http://www.securityfocus.com/bid/78220; http://www.vapidlabs.com/advisory.php?v=157
CVE: CVE-2015-8299
Published: 2017-08-29
Description: Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP UDP packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/134524/KNX-ETS-4.1.5-Build-3246-Buffer-Overflow.html; https://github.com/sbaresearch/advisories/tree/public/2015/knAx_20150101; http://packetstormsecurity.com/files/134524/KNX-ETS-4.1.5-Build-3246-Buffer-Overflow.html
CVE: CVE-2015-8334
Published: 2017-08-29
Description: SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-463072.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-463072.htm