deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7244
Published: 2017-03-23
Description: The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97067; https://access.redhat.com/errata/RHSA-2018:2486; https://blogs.gentoo.org/ago/2017/03/20/libpcre-invalid-memory-read-in-_pcre32_xclass-pcre_xclass-c/
CVE: CVE-2017-7245
Published: 2017-03-23
Description: Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97067; https://access.redhat.com/errata/RHSA-2018:2486; https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/
CVE: CVE-2017-7246
Published: 2017-03-23
Description: Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97067; https://access.redhat.com/errata/RHSA-2018:2486; https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/
CVE: CVE-2017-7247
Published: 2017-03-23
Description: Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data (torrents, size) passed to the 'Gazelle-master/sections/tools/managers/multiple_freeleech.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97063; https://github.com/WhatCD/Gazelle/issues/114; https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS
CVE: CVE-2017-7248
Published: 2017-03-23
Description: A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (type) passed to the 'Gazelle-master/sections/better/transcode.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97063; https://github.com/WhatCD/Gazelle/issues/111; https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS
CVE: CVE-2017-7249
Published: 2017-03-23
Description: Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data (action, userid) passed to the 'Gazelle-master/sections/tools/data/ocelot_info.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97063; https://github.com/WhatCD/Gazelle/issues/112; https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS
CVE: CVE-2017-7250
Published: 2017-03-23
Description: A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (action) passed to the 'Gazelle-master/sections/tools/finances/bitcoin_balance.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97063; https://github.com/WhatCD/Gazelle/issues/113; https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS
CVE: CVE-2017-7251
Published: 2017-03-23
Description: A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the "pi-develop/www/script/editor/markitup/preview/markdown.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97061; https://github.com/pi-engine/pi/issues/1523; http://www.securityfocus.com/bid/97061
CVE: CVE-2017-5198
Published: 2017-03-24
Description: SolarWinds LEM (aka SIEM) before 6.3.1 has an incorrect sudo configuration, which allows local users to obtain root access by editing /usr/local/contego/scripts/hostname.sh.
CVSS Score: 8.8 (HIGH)
References: http://blog.0xlabs.com/2017/03/solarwinds-lem-ssh-jailbreak-and.html; http://www.securityfocus.com/bid/97094; http://blog.0xlabs.com/2017/03/solarwinds-lem-ssh-jailbreak-and.html
CVE: CVE-2017-5199
Published: 2017-03-24
Description: The editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated users to execute arbitrary code by editing /usr/local/contego/scripts/mgrconfig.pl.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://blog.0xlabs.com/2017/03/solarwinds-lem-ssh-jailbreak-and.html; http://www.securityfocus.com/bid/97090; http://blog.0xlabs.com/2017/03/solarwinds-lem-ssh-jailbreak-and.html
CVE: CVE-2017-6507
Published: 2017-03-24
Description: An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269
References: http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3647; http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3648; http://www.securityfocus.com/bid/97223
CVE: CVE-2017-2577
Published: 2017-03-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-6369
Published: 2017-03-24
Description: Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://tracker.firebirdsql.org/browse/CORE-5474; http://www.debian.org/security/2017/dsa-3824; http://www.securityfocus.com/bid/97070
CVE: CVE-2015-8556
Published: 2017-03-24
Description: Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-362
References: http://packetstormsecurity.com/files/134948/Gentoo-QEMU-Local-Privilege-Escalation.html; https://security.gentoo.org/glsa/201602-01; https://www.exploit-db.com/exploits/39010/
CVE: CVE-2015-8678
Published: 2017-03-24
Description: The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows remote attackers to cause a denial of service (crash) via a crafted application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160105-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160105-01-smartphone-en
CVE: CVE-2016-10149
Published: 2017-03-24
Description: XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://www.debian.org/security/2017/dsa-3759; http://www.openwall.com/lists/oss-security/2017/01/19/5; http://www.securityfocus.com/bid/97692
CVE: CVE-2017-5644
Published: 2017-03-24
Description: Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-776
References: http://poi.apache.org/#20+March+2017+-+CVE-2017-5644+-+Possible+DOS+%28Denial+of+Service%29+in+Apache+POI+versions+prior+to+3.15; http://www.securityfocus.com/bid/96983; https://www.oracle.com/security-alerts/cpuoct2020.html
CVE: CVE-2017-5869
Published: 2017-03-24
Description: Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. (dot dot) in the X-File-Name header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2017/03/23/6; http://www.securityfocus.com/bid/97083; https://sysdream.com/news/lab/2017-03-23-cve-2017-5869-nuxeo-platform-remote-code-execution/
CVE: CVE-2017-6087
Published: 2017-03-24
Description: EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2017/03/23/5; http://www.securityfocus.com/bid/97109; https://github.com/EyesOfNetworkCommunity/eonweb/commit/196729cc045ef93ceeddd1de505a1de8f9cdf74d
CVE: CVE-2016-10128
Published: 2017-03-24
Description: Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html
CVE: CVE-2016-10129
Published: 2017-03-24
Description: The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html
CVE: CVE-2016-10130
Published: 2017-03-24
Description: The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html; http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html
CVE: CVE-2016-10132
Published: 2017-03-24
Description: regexp.c in Artifex Software, Inc. MuJS allows attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to regular expression compilation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://git.ghostscript.com/?p=mujs.git%3Bh=fd003eceda531e13fbdd1aeb6e9c73156496e569; http://www.openwall.com/lists/oss-security/2017/01/12/9; http://www.openwall.com/lists/oss-security/2017/01/13/1
CVE: CVE-2016-10133
Published: 2017-03-24
Description: Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software, Inc. MuJS allows attackers to have unspecified impact by leveraging an error when dropping extra arguments to lightweight functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://git.ghostscript.com/?p=mujs.git%3Ba=commit%3Bh=77ab465f1c394bb77f00966cd950650f3f53cb24; http://www.openwall.com/lists/oss-security/2017/01/12/9; http://www.openwall.com/lists/oss-security/2017/01/13/1
CVE: CVE-2016-10144
Published: 2017-03-24
Description: coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.debian.org/security/2017/dsa-3799; http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5
CVE: CVE-2016-10145
Published: 2017-03-24
Description: Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-189
References: http://www.debian.org/security/2017/dsa-3799; http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5
CVE: CVE-2016-10146
Published: 2017-03-24
Description: Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.debian.org/security/2017/dsa-3799; http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5
CVE: CVE-2016-2224
Published: 2017-03-24
Description: The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vectors involving compressed items in a reply.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://repo.or.cz/uclibc-ng.git/commit/d9c3a16dcab57d6b56225b9a67e9119cc9e2e4ac; http://www.openwall.com/lists/oss-security/2016/02/05/2; http://www.openwall.com/lists/oss-security/2016/02/05/3
CVE: CVE-2016-2225
Published: 2017-03-24
Description: The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://repo.or.cz/uclibc-ng.git/commit/6932f2282ba0578d6ca2f21eead920d6b78bc93c; http://www.openwall.com/lists/oss-security/2016/02/05/2; http://www.openwall.com/lists/oss-security/2016/02/05/3
CVE: CVE-2016-3178
Published: 2017-03-24
Description: The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (out-of-bounds memory access and daemon crash) via vectors involving a negative length value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://speirofr.appspot.com/files/advisory/SPADV-2016-02.md; http://www.openwall.com/lists/oss-security/2016/03/16/13; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816759
CVE: CVE-2016-3179
Published: 2017-03-24
Description: The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (invalid free and daemon crash) via vectors related to error handling.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://speirofr.appspot.com/files/advisory/SPADV-2016-02.md; http://www.openwall.com/lists/oss-security/2016/03/16/13; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816759
CVE: CVE-2016-6206
Published: 2017-03-24
Description: Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to cause a denial of service or execute arbitrary code via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160713-01-router-en; http://www.securityfocus.com/bid/91774; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160713-01-router-en
CVE: CVE-2016-7797
Published: 2017-03-24
Description: Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://bugs.clusterlabs.org/show_bug.cgi?id=5269; http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html
CVE: CVE-2017-5334
Published: 2017-03-24
Description: Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html; http://www.openwall.com/lists/oss-security/2017/01/10/7; http://www.openwall.com/lists/oss-security/2017/01/11/4
CVE: CVE-2017-5335
Published: 2017-03-24
Description: The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html; http://rhn.redhat.com/errata/RHSA-2017-0574.html; http://www.openwall.com/lists/oss-security/2017/01/10/7
CVE: CVE-2017-5336
Published: 2017-03-24
Description: Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html; http://rhn.redhat.com/errata/RHSA-2017-0574.html; http://www.openwall.com/lists/oss-security/2017/01/10/7
CVE: CVE-2017-5337
Published: 2017-03-24
Description: Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html; http://rhn.redhat.com/errata/RHSA-2017-0574.html; http://www.openwall.com/lists/oss-security/2017/01/10/7
CVE: CVE-2017-5506
Published: 2017-03-24
Description: Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://www.debian.org/security/2017/dsa-3799; http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5
CVE: CVE-2017-5507
Published: 2017-03-24
Description: Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3799; http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5
CVE: CVE-2017-5508
Published: 2017-03-24
Description: Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3799; http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5
CVE: CVE-2017-5509
Published: 2017-03-24
Description: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5; http://www.securityfocus.com/bid/95751
CVE: CVE-2017-5510
Published: 2017-03-24
Description: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3799; http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5
CVE: CVE-2017-5511
Published: 2017-03-24
Description: coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3799; http://www.openwall.com/lists/oss-security/2017/01/16/6; http://www.openwall.com/lists/oss-security/2017/01/17/5
CVE: CVE-2017-7240
Published: 2017-03-24
Description: An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver "PST10 WebServer" typically listens to port 80 and is prone to a directory traversal attack; therefore, an unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks. A Proof of Concept is GET /../../../../../../../../../../../../etc/shadow HTTP/1.1. This affects PG8527 devices 2.02 before 2.12, PG8527 devices 2.51 before 2.61, PG8527 devices 2.52 before 2.62, PG8527 devices 2.54 before 2.64, PG8528 devices 2.02 before 2.12, PG8528 devices 2.51 before 2.61, PG8528 devices 2.52 before 2.62, PG8528 devices 2.54 before 2.64, PG8535 devices 1.00 before 1.10, PG8535 devices 1.04 before 1.14, PG8536 devices 1.10 before 1.20, and PG8536 devices 1.14 before 1.24.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2017/Mar/63; http://www.securityfocus.com/bid/97080; https://ics-cert.us-cert.gov/advisories/ICSA-17-138-01
CVE: CVE-2017-7243
Published: 2017-03-24
Description: Eclipse tinydtls 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sending a "Change cipher spec" packet without pre-handshake.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97193; https://gist.github.com/k1rh4/25dcb124aef2a8a2a5f4677d64d1998b; https://github.com/k1rh4/CVE/blob/master/tinydtls
CVE: CVE-2017-7255
Published: 2017-03-24
Description: XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.03i0.com/index.php/archives/113/; http://www.securityfocus.com/bid/97203; http://www.03i0.com/index.php/archives/113/
CVE: CVE-2017-7256
Published: 2017-03-24
Description: XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.03i0.com/index.php/archives/113/; http://www.securityfocus.com/bid/97204; http://www.03i0.com/index.php/archives/113/
CVE: CVE-2017-7257
Published: 2017-03-24
Description: XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.03i0.com/index.php/archives/113/; http://www.securityfocus.com/bid/97205; http://www.03i0.com/index.php/archives/113/