deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14385
Published: 2017-12-20
Description: An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to 6.0.2.9; EMC Data Domain DD OS 6.1 family, versions prior to 6.1.0.21; EMC Data Domain Virtual Edition 2.0 family, all versions; EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1; and EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2. EMC Data Domain DD OS contains a memory overflow vulnerability in SMBv1 which may potentially be exploited by an unauthenticated remote attacker. An attacker may completely shut down both the SMB service and active directory authentication. This may also allow remote code injection and execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2017/Dec/79; http://www.securityfocus.com/bid/102289; http://www.securitytracker.com/id/1040027
CVE: CVE-2017-14387
Published: 2017-12-20
Description: The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the NFS export security flavor for authentication) that can be leveraged by current and future NFS exports. This NFS service contained a flaw that did not properly propagate changes made to the default security flavor to all new and existing NFS exports that are configured to use default NFS export settings and that are mounted after those changes are made. This flaw may potentially allow NFS clients to access affected NFS exports using the default and potentially weaker security flavor even if a more secure one was selected to be used by the OneFS administrator, aka an "NFS Export Security Setting Fallback Vulnerability."
CVSS Score: 6.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2017/Dec/78; http://www.securityfocus.com/bid/102292; http://seclists.org/fulldisclosure/2017/Dec/78
CVE: CVE-2017-17805
Published: 2017-12-20
Description: The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ecaaab5649781c5a0effdaf298a[PII_REDACTED]00e; http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
CVE: CVE-2017-17806
Published: 2017-12-20
Description: The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1; http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
CVE: CVE-2017-17807
Published: 2017-12-20
Description: The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4dca6ea1d9432052afb06baf2e3ae78188a4410b; http://www.securityfocus.com/bid/102301; https://github.com/torvalds/linux/commit/4dca6ea1d9432052afb06baf2e3ae78188a4410b
CVE: CVE-2017-17809
Published: 2017-12-20
Description: In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forcing the VyprVPN application to load a malicious dynamic library every time a new connection is made.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2017-007.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2017-007.md
CVE: CVE-2017-17810
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://repo.or.cz/nasm.git/commit/59ce1c67b16967c652765e62aa130b7e43f21dd4; https://bugzilla.nasm.us/show_bug.cgi?id=3392431; https://usn.ubuntu.com/3694-1/
CVE: CVE-2017-17811
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392432; https://usn.ubuntu.com/3694-1/; https://bugzilla.nasm.us/show_bug.cgi?id=3392432
CVE: CVE-2017-17812
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://repo.or.cz/nasm.git/commit/9b7ee09abfd426b99aa1ea81d19a3b2818eeabf9; https://bugzilla.nasm.us/show_bug.cgi?id=3392424; https://usn.ubuntu.com/3694-1/
CVE: CVE-2017-17813
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a remote denial of service attack, related to mishandling of line-syntax errors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392429; https://usn.ubuntu.com/3694-1/; https://bugzilla.nasm.us/show_bug.cgi?id=3392429
CVE: CVE-2017-17814
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a remote denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392430; https://usn.ubuntu.com/3694-1/; https://bugzilla.nasm.us/show_bug.cgi?id=3392430
CVE: CVE-2017-17815
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause a remote denial of service attack, because of a missing check for the relationship between minimum and maximum parameter counts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: http://repo.or.cz/nasm.git/commit/c9244eaadd05b27637cde06021bac3fa1d920aa3; https://bugzilla.nasm.us/show_bug.cgi?id=3392436; https://usn.ubuntu.com/3694-1/
CVE: CVE-2017-17816
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a remote denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392426; https://usn.ubuntu.com/3694-1/; https://bugzilla.nasm.us/show_bug.cgi?id=3392426
CVE: CVE-2017-17817
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_verror in asm/preproc.c that will cause a remote denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392427; https://usn.ubuntu.com/3694-1/; https://bugzilla.nasm.us/show_bug.cgi?id=3392427
CVE: CVE-2017-17818
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a while loop in paste_tokens in asm/preproc.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392428; https://usn.ubuntu.com/3694-1/; https://bugzilla.nasm.us/show_bug.cgi?id=3392428
CVE: CVE-2017-17819
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find_cc() in asm/preproc.c that will cause a remote denial of service attack, because pointers associated with skip_white_ calls are not validated.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://repo.or.cz/nasm.git/commit/7524cfd91492e6e3719b959498be584a9ced13af; https://bugzilla.nasm.us/show_bug.cgi?id=3392435; https://usn.ubuntu.com/3694-1/
CVE: CVE-2017-17820
Published: 2017-12-21
Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_list_one_macro in asm/preproc.c that will lead to a remote denial of service attack, related to mishandling of operand-type errors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392433; https://usn.ubuntu.com/3694-1/; https://bugzilla.nasm.us/show_bug.cgi?id=3392433
CVE: CVE-2017-17821
Published: 2017-12-21
Description: WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function (in WTF/wtf/FastBitVector.cpp) for a purpose other than initializing a bitvector size, and resizeSlow mishandles cases where the old array length is greater than the new array length.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugs.webkit.org/show_bug.cgi?id=181020; https://github.com/dwfault/PoCs/blob/master/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF.md; https://bugs.webkit.org/show_bug.cgi?id=181020
CVE: CVE-2017-17822
Published: 2017-12-21
Description: The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user_list_backend.php sSortDir_0 parameter. An attacker can exploit this to gain access to the data in a connected MySQL database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/commit/33a03e9afb8fb00c9d8f480424d549311fe03d40; https://github.com/Piwigo/Piwigo/issues/823; https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md
CVE: CVE-2017-17823
Published: 2017-12-21
Description: The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/commit/91ef7909a5c51203f330cbecf986472900b60983; https://github.com/Piwigo/Piwigo/issues/826; https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md
CVE: CVE-2017-17824
Published: 2017-12-21
Description: The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/commit/f7c8e0a947a857ff5d31dafd03842df41959b84c; https://github.com/Piwigo/Piwigo/issues/825; https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md
CVE: CVE-2017-17825
Published: 2017-12-21
Description: The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Stored%20XSS%20Vulnerabilities%20in%20Piwigo%202.9.2.md; https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Stored%20XSS%20Vulnerabilities%20in%20Piwigo%202.9.2.md
CVE: CVE-2017-17826
Published: 2017-12-21
Description: The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration&section=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Stored%20XSS%20Vulnerabilities%20in%20Piwigo%202.9.2.md; https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Stored%20XSS%20Vulnerabilities%20in%20Piwigo%202.9.2.md
CVE: CVE-2017-17827
Published: 2017-12-21
Description: Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Piwigo/Piwigo/commit/c3b4c6f7f0ddeaea492080fb8211d7b4cfedaf6f; https://github.com/Piwigo/Piwigo/issues/822; https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Cross%20Site%20Request%20Forgery%20in%20Piwigo%202.9.2.md
CVE: CVE-2017-17828
Published: 2017-12-21
Description: Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md
CVE: CVE-2017-17829
Published: 2017-12-21
Description: Bus Booking Script has SQL Injection via the admin/view_seatseller.php sp_id parameter or the admin/view_member.php memid parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md
CVE: CVE-2017-17830
Published: 2017-12-21
Description: Bus Booking Script has CSRF via admin/new_master.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md
CVE: CVE-2017-17831
Published: 2017-12-21
Description: GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://blog.recurity-labs.com/2017-08-10/scm-vulns; http://www.securityfocus.com/bid/102926; https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
CVE: CVE-2017-17408
Published: 2017-12-21
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5101.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://zerodayinitiative.com/advisories/ZDI-17-942; https://zerodayinitiative.com/advisories/ZDI-17-942
CVE: CVE-2017-17409
Published: 2017-12-21
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within emulator 0x10A in cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5102.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://zerodayinitiative.com/advisories/ZDI-17-943; https://zerodayinitiative.com/advisories/ZDI-17-943
CVE: CVE-2017-17410
Published: 2017-12-21
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within emulator 0x102 in cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5116.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://zerodayinitiative.com/advisories/ZDI-17-944; https://zerodayinitiative.com/advisories/ZDI-17-944
CVE: CVE-2017-17411
Published: 2017-12-21
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/102212; https://github.com/rapid7/metasploit-framework/pull/9336; https://www.exploit-db.com/exploits/43363/
CVE: CVE-2015-4100
Published: 2017-12-21
Description: Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master, aka a "Certificate Authority Reverse Proxy Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://puppet.com/security/cve/CVE-2015-4100; https://puppet.com/security/cve/CVE-2015-4100
CVE: CVE-2015-7224
Published: 2017-12-21
Description: puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://puppet.com/security/cve/CVE-2015-7224; https://puppet.com/security/cve/CVE-2015-7224
CVE: CVE-2017-17027
Published: 2017-12-21
Description: A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040018; https://www.qnap.com/zh-tw/security-advisory/nas-201712-15; http://www.securitytracker.com/id/1040018
CVE: CVE-2017-17028
Published: 2017-12-21
Description: A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040018; https://www.qnap.com/zh-tw/security-advisory/nas-201712-15; http://www.securitytracker.com/id/1040018
CVE: CVE-2017-17029
Published: 2017-12-21
Description: A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040018; https://www.qnap.com/zh-tw/security-advisory/nas-201712-15; http://www.securitytracker.com/id/1040018
CVE: CVE-2017-17030
Published: 2017-12-21
Description: A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040018; https://www.qnap.com/zh-tw/security-advisory/nas-201712-15; http://www.securitytracker.com/id/1040018
CVE: CVE-2017-17031
Published: 2017-12-21
Description: A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040018; https://www.qnap.com/zh-tw/security-advisory/nas-201712-15; http://www.securitytracker.com/id/1040018
CVE: CVE-2017-17032
Published: 2017-12-21
Description: A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040018; https://www.qnap.com/zh-tw/security-advisory/nas-201712-15; http://www.securitytracker.com/id/1040018
CVE: CVE-2017-17033
Published: 2017-12-21
Description: A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id/1040018; https://www.qnap.com/zh-tw/security-advisory/nas-201712-15; http://www.securitytracker.com/id/1040018
CVE: CVE-2017-0301
Published: 2017-12-21
Description: In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application resources and backend servers are unaffected.
CVSS Score: 7.6 (HIGH)
References: http://www.securitytracker.com/id/1040040; https://support.f5.com/csp/article/K54358225; http://www.securitytracker.com/id/1040040