deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wiki.onosproject.org/display/ONOS/Security+advisories; https://wiki.onosproject.org/display/ONOS/Security+advisories
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Linux foundation ONOS 1.9.0 is vulnerable to a DoS.
CVSS Score: 7.5 (HIGH)
References: https://wiki.onosproject.org/display/ONOS/Security+advisories; https://wiki.onosproject.org/display/ONOS/Security+advisories
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.
CVSS Score: 7.5 (HIGH)
References: https://wiki.onosproject.org/display/ONOS/Security+advisories; https://wiki.onosproject.org/display/ONOS/Security+advisories
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://wiki.onosproject.org/display/ONOS/Security+advisories; https://wiki.onosproject.org/display/ONOS/Security+advisories
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the backup directory, if present. Upgrading from before 1.498 will no longer create a backup directory. Administrators relying on file access permissions in their manually created backups are advised to check them for the directory $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it if present.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2017-02-01/; https://jenkins.io/security/advisory/2017-02-01/
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array in the following code, by appending many (>LP_NO) 'lp=none' arguments to the command line.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3945; http://www.securityfocus.com/bid/98651; https://alephsecurity.com/vulns/aleph-2017023
CVE: CVE-2017-10601
Published: 2017-07-17
Description: A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a password while trying to login through console, ssh, ftp, telnet or su, etc., This issue relies upon a device configuration precondition to occur. Typically, device configurations are the result of a trusted administrative change to the system's running configuration. The following error messages may be seen when this failure occurs: mgd: error: commit failed: (statements constraint check failed) Warning: Commit failed, activating partial configuration. Warning: Edit the router configuration to fix these errors. If the administrative changes are not made that result in such a failure, then this issue is not seen. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 12.3 prior to 12.3R10, 12.3R11; 12.3X48 prior to 12.3X48-D20; 13.2 prior to 13.2R8; 13.3 prior to 13.3R7; 14.1 prior to 14.1R4-S12, 14.1R5, 14.1R6; 14.1X53 prior to 14.1X53-D30; 14.2 prior to 14.2R4; 15.1 prior to 15.1F2, 15.1F3, 15.1R2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securitytracker.com/id/1038902; https://kb.juniper.net/JSA10802; http://www.securitytracker.com/id/1038902
CVE: CVE-2017-10602
Published: 2017-07-17
Description: A buffer overflow vulnerability in Junos OS CLI may allow a local authenticated user with read only privileges and access to Junos CLI, to execute code with root privileges. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D46 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 14.1X53 versions prior to 14.1X53-D130 on QFabric System; 14.2 versions prior to 14.2R4-S9, 14.2R6; 15.1 versions prior to 15.1F5, 15.1R3; 15.1X49 versions prior to 15.1X49-D40 on SRX Series; 15.1X53 versions prior to 15.1X53-D47 on NFX150, NFX250; 15.1X53 versions prior to 15.1X53-D65 on QFX10000 Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5110, QFX5200.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100323; http://www.securitytracker.com/id/1038900; https://kb.juniper.net/JSA10803
CVE: CVE-2017-10603
Published: 2017-07-17
Description: An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15.1 prior to 15.1R3. Junos versions prior to 15.1 are not affected. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 7.0 (HIGH)
CWE: CWE-91
References: http://www.securitytracker.com/id/1038901; https://kb.juniper.net/JSA10805; http://www.securitytracker.com/id/1038901
CVE: CVE-2017-10604
Published: 2017-07-17
Description: When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect password can trigger a lockout of the root account. When an SRX Series device is in cluster mode, and a cluster sync or failover operation occurs, then there will be errors associated with synch or failover while the root account is locked out. Administrators can confirm if the root account is locked out via the following command root@device> show system login lockout user root User Lockout start Lockout end root 1995-01-01 01:00:01 PDT 1995-11-01 01:31:01 PDT Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D65 on SRX series; 12.3X48 prior to 12.3X48-D45 on SRX series; 15.1X49 prior to 15.1X49-D75 on SRX series.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: http://www.securitytracker.com/id/1038886; https://kb.juniper.net/JSA10806; http://www.securitytracker.com/id/1038886
CVE: CVE-2017-10605
Published: 2017-07-17
Description: On all vSRX and SRX Series devices, when the DHCP or DHCP relay is configured, specially crafted packet might cause the flowd process to crash, halting or interrupting traffic from flowing through the device(s). Repeated crashes of the flowd process may constitute an extended denial of service condition for the device(s). If the device is configured in high-availability, the RG1+ (data-plane) will fail-over to the secondary node. If the device is configured in stand-alone, there will be temporary traffic interruption until the flowd process is restored automatically. Sustained crafted packets may cause the secondary failover node to fail back, or fail completely, potentially halting flowd on both nodes of the cluster or causing flip-flop failovers to occur. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D67 on vSRX or SRX Series; 12.3X48 prior to 12.3X48-D50 on vSRX or SRX Series; 15.1X49 prior to 15.1X49-D91, 15.1X49-D100 on vSRX or SRX Series.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1038891; https://kb.juniper.net/JSA10789; http://www.securitytracker.com/id/1038891
CVE: CVE-2017-11311
Published: 2017-07-17
Description: soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for arbitrary code execution via a crafted PSM File that triggers use of the same sample slot for two samples.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://bugs.debian.org/867579; https://lib.openmpt.org/libopenmpt/md_announce-2017-07-07.html; https://source.openmpt.org/browse/openmpt/branches/OpenMPT-1.26/?op=revision&rev=8438
CVE: CVE-2017-11318
Published: 2017-07-17
Description: Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed. In addition, the attacker can execute system commands remotely by abusing pre-backup events.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://www.tarlogic.com/advisories/Tarlogic-2017-002.txt; https://www.tarlogic.com/advisories/Tarlogic-2017-002.txt
CVE: CVE-2017-11328
Published: 2017-07-17
Description: Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a crafted .NET file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/VirusTotal/yara/commit/4a342f01e5439b9bb901aff1c6c23c536baeeb3f; https://github.com/VirusTotal/yara/commit/4a342f01e5439b9bb901aff1c6c23c536baeeb3f
CVE: CVE-2017-11329
Published: 2017-07-17
Description: GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/issues/2456; https://github.com/glpi-project/glpi/releases/tag/9.1.5; https://github.com/glpi-project/glpi/issues/2456
CVE: CVE-2017-11335
Published: 2017-07-17
Description: There is a heap based buffer overflow in tools/tiff2pdf.c of LibTIFF 4.0.8 via a PlanarConfig=Contig image, which causes a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://bugzilla.maptools.org/show_bug.cgi?id=2715; https://usn.ubuntu.com/3602-1/; https://www.debian.org/security/2018/dsa-4100
CVE: CVE-2017-11336
Published: 2017-07-17
Description: There is a heap-based buffer over-read in the Image::printIFDStructure function in image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1470729; https://bugzilla.redhat.com/show_bug.cgi?id=1470729
CVE: CVE-2017-11337
Published: 2017-07-17
Description: There is an invalid free in the Action::TaskFactory::cleanup function of actions.cpp in Exiv2 0.26. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1470737; https://bugzilla.redhat.com/show_bug.cgi?id=1470737
CVE: CVE-2017-11338
Published: 2017-07-17
Description: There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.26. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=1470913; https://bugzilla.redhat.com/show_bug.cgi?id=1470913
CVE: CVE-2017-11339
Published: 2017-07-17
Description: There is a heap-based buffer overflow in the Image::printIFDStructure function of image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1470946; https://bugzilla.redhat.com/show_bug.cgi?id=1470946
CVE: CVE-2017-11340
Published: 2017-07-17
Description: There is a Segmentation fault in the XmpParser::terminate() function in Exiv2 0.26, related to an exit call. A Crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1470950; https://bugzilla.redhat.com/show_bug.cgi?id=1470950
CVE: CVE-2017-11341
Published: 2017-07-17
Description: There is a heap based buffer over-read in lexer.hpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1470714; https://bugzilla.redhat.com/show_bug.cgi?id=1470714
CVE: CVE-2017-11342
Published: 2017-07-17
Description: There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1470722; https://bugzilla.redhat.com/show_bug.cgi?id=1470722
CVE: CVE-2017-11343
Published: 2017-07-17
Description: Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in O(n) lookup time.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407
References: http://lists.gnu.org/archive/html/chicken-announce/2017-07/msg00000.html; http://lists.gnu.org/archive/html/chicken-announce/2017-07/msg00000.html
CVE: CVE-2017-11344
Published: 2017-07-17
Description: Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to write shellcode at any address in the heap; this can be used to execute arbitrary code on the router by hosting a crafted device description XML document at a URL specified within a Location header in an SSDP response.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/07/14/3; https://asuswrt.lostrealm.ca/changelog; http://www.openwall.com/lists/oss-security/2017/07/14/3
CVE: CVE-2017-11345
Published: 2017-07-17
Description: Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by hosting a crafted device description XML document (that includes a serviceType element) at a URL specified within a Location header in an SSDP response.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/07/14/3; https://asuswrt.lostrealm.ca/changelog; http://www.openwall.com/lists/oss-security/2017/07/14/3
CVE: CVE-2017-11346
Published: 2017-07-17
Description: Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.exploit-db.com/exploits/42358/; https://www.manageengine.com/products/desktop-central/remote-code-execution.html; https://www.exploit-db.com/exploits/42358/
CVE: CVE-2017-11347
Published: 2017-07-17
Description: Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php.
CVSS Score: 8.8 (HIGH)
References: https://github.com/imp0wd3r/MetInfo_Vuln/blob/master/README.md; https://github.com/imp0wd3r/MetInfo_Vuln/blob/master/README.md
CVE: CVE-2017-11348
Published: 2017-07-17
Description: In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22
References: https://github.com/OctopusDeploy/Issues/issues/3654; https://github.com/OctopusDeploy/Issues/issues/3654
CVE: CVE-2017-11349
Published: 2017-07-17
Description: dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes such as sending e-mail messages or making outbound connections to FTP servers for uploading data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://nullku7.github.io/stuff/exposure/industrial/2017/05/02/Thermofisher-dataTaker.html; https://twitter.com/nullku7/status/[PII_REDACTED]59609344; https://nullku7.github.io/stuff/exposure/industrial/2017/05/02/Thermofisher-dataTaker.html
CVE: CVE-2017-11352
Published: 2017-07-17
Description: In ImageMagick before 7.0.5-10, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-9144.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/99600; https://bugs.debian.org/868469; https://github.com/ImageMagick/ImageMagick/issues/502
CVE: CVE-2017-11353
Published: 2017-07-17
Description: yadm (yet another dotfile manager) 1.10.0 has a race condition (related to the behavior of git commands in setting permissions for new files and directories), which potentially allows access to SSH and PGP keys.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://bugs.debian.org/868300; https://github.com/TheLocehiliosan/yadm/issues/74; https://bugs.debian.org/868300
CVE: CVE-2017-11354
Published: 2017-07-17
Description: Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in editing or adding a tag name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/FiyoCMS/FiyoCMS/issues/4; https://github.com/FiyoCMS/FiyoCMS/issues/4
CVE: CVE-2017-11360
Published: 2017-07-17
Description: The ReadRLEImage function in coders\rle.c in ImageMagick 7.0.6-1 has a large loop vulnerability via a crafted rle file that triggers a huge number_pixels value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: https://github.com/ImageMagick/ImageMagick/issues/518; https://github.com/ImageMagick/ImageMagick/issues/518
CVE: CVE-2017-11362
Published: 2017-07-17
Description: In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact within International Components for Unicode (ICU) for C/C++ via a long first argument to the msgfmt_parse_message function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2018:1296; https://bugs.php.net/bug.php?id=73473; https://security.gentoo.org/glsa/201709-21
CVE: CVE-2017-1181
Published: 2017-07-17
Description: IBM Tivoli Monitoring Portal V6 client could allow a local attacker to gain elevated privileges for IBM Tivoli Monitoring, caused by the default console connection not being encrypted. IBM X-Force ID: 123487.
CVSS Score: 7.0 (HIGH)
CWE: CWE-319
References: http://www.ibm.com/support/docview.wss?uid=swg22003402; http://www.securityfocus.com/bid/99596; http://www.securitytracker.com/id/1038913
CVE: CVE-2017-1182
Published: 2017-07-17
Description: IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the system, when default client-server default communications, HTTP, are being used. IBM X-Force ID: 123493.
CVSS Score: 7.5 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22003402; http://www.securitytracker.com/id/1038913; https://exchange.xforce.ibmcloud.com/vulnerabilities/123493
CVE: CVE-2017-1183
Published: 2017-07-17
Description: IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to modify SQL commands to the Portal Server, when default client-server communications, HTTP, are being used. IBM X-Force ID: 123494.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg22003402; http://www.securityfocus.com/bid/99610; http://www.securitytracker.com/id/1038913
CVE: CVE-2017-2240
Published: 2017-07-17
Description: Directory traversal vulnerability in AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to read arbitrary files via "File Transfer Web Service".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/vu/JVNVU93377948/index.html; https://www.hammock.jp/assetview/info/170714.html; http://jvn.jp/en/vu/JVNVU93377948/index.html
CVE: CVE-2017-2241
Published: 2017-07-17
Description: SQL injection vulnerability in the AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to execute arbitrary SQL commands via "File Transfer Web Service".
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: http://jvn.jp/en/vu/JVNVU93377948/index.html; https://www.hammock.jp/assetview/info/170714.html; http://jvn.jp/en/vu/JVNVU93377948/index.html
CVE: CVE-2017-2246
Published: 2017-07-17
Description: Untrusted search path vulnerability in Installer of Lhaz version 2.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://chitora.com/jvn21369452.html; https://jvn.jp/en/jp/JVN21369452/index.html; http://chitora.com/jvn21369452.html
CVE: CVE-2017-2247
Published: 2017-07-17
Description: Untrusted search path vulnerability in Self-extracting archive files created by Lhaz version 2.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://chitora.com/jvn21369452.html; https://jvn.jp/en/jp/JVN21369452/index.html; http://chitora.com/jvn21369452.html
CVE: CVE-2017-2248
Published: 2017-07-17
Description: Untrusted search path vulnerability in Installer of Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://chitora.com/jvn21369452.html; https://jvn.jp/en/jp/JVN21369452/index.html; http://chitora.com/jvn21369452.html
CVE: CVE-2017-2249
Published: 2017-07-17
Description: Untrusted search path vulnerability in Self-extracting archive files created by Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://chitora.com/jvn21369452.html; https://jvn.jp/en/jp/JVN21369452/index.html; http://chitora.com/jvn21369452.html
CVE: CVE-2017-2252
Published: 2017-07-17
Description: Untrusted search path vulnerability in self-extracting archive files created by File Compact Ver.5 version 5.10 and earlier, Ver.6 version 6.02 and earlier, Ver.7 version 7.02 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN29939155/index.html; https://jvn.jp/en/jp/JVN29939155/index.html
CVE: CVE-2017-2253
Published: 2017-07-17
Description: Untrusted search path vulnerability in Installer of Yahoo! Toolbar (for Internet explorer) v8.0.0.6 and earlier, with its timestamp prior to June 13, 2017, 18:18:55 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN02852421/index.html; https://jvn.jp/en/jp/JVN02852421/index.html