deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8515
Published: 2017-06-15
Description: Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an unauthenticated attacker to send a specially crafted kernel mode request to cause a denial of service on the target system, aka "Windows VAD Cloning Denial of Service Vulnerability".
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/98833; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8515; http://www.securityfocus.com/bid/98833
CVE: CVE-2017-8517
Published: 2017-06-15
Description: Microsoft browsers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engines fail to render when handling objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8522 and CVE-2017-8524.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98895; http://www.securitytracker.com/id/1038673; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8517
CVE: CVE-2017-8519
Published: 2017-06-15
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8547.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98899; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8519; http://www.securityfocus.com/bid/98899
CVE: CVE-2017-8520
Published: 2017-06-15
Description: Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the Edge JavaScript scripting engine fails to handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8499, CVE-2017-8521, CVE-2017-8548, and CVE-2017-8549.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98924; http://www.securitytracker.com/id/1038661; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8520
CVE: CVE-2017-8521
Published: 2017-06-15
Description: Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the Edge JavaScript scripting engine fails to handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8499, CVE-2017-8520, CVE-2017-8548, and CVE-2017-8549.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98925; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8521; http://www.securityfocus.com/bid/98925
CVE: CVE-2017-8522
Published: 2017-06-15
Description: Microsoft browsers in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engines fail to render when handling objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8517 and CVE-2017-8524.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98926; http://www.securitytracker.com/id/1038673; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8522
CVE: CVE-2017-8523
Published: 2017-06-15
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when Microsoft Edge fails to correctly apply Same Origin Policy for HTML elements present in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-8530 and CVE-2017-8555.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: http://www.securityfocus.com/bid/98928; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8523; http://www.securityfocus.com/bid/98928
CVE: CVE-2017-8524
Published: 2017-06-15
Description: Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engines fail to render when handling objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8517 and CVE-2017-8522.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98930; http://www.securitytracker.com/id/1038673; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8524
CVE: CVE-2017-8527
Published: 2017-06-15
Description: Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way it handles objects in memory, aka "Windows Graphics Remote Code Execution Vulnerability".
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98933; http://www.securitytracker.com/id/1038680; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8527
CVE: CVE-2017-8528
Published: 2017-06-15
Description: Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows a remote code execution vulnerability due to the way it handles objects in memory, aka "Windows Uniscribe Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0283.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98949; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8528; http://www.securityfocus.com/bid/98949
CVE: CVE-2017-8529
Published: 2017-06-15
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in memory, aka "Microsoft Browser Information Disclosure Vulnerability".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98953; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8529; http://www.securityfocus.com/bid/98953
CVE: CVE-2017-8530
Published: 2017-06-15
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when Microsoft Edge does not properly enforce same-origin policies, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-8523 and CVE-2017-8555.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-346
References: http://www.securityfocus.com/bid/98863; http://www.securitytracker.com/id/1038661; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8530
CVE: CVE-2017-8531
Published: 2017-06-15
Description: Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 Service Pack 3, and Microsoft Office 2010 Service Pack 2 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8532, and CVE-2017-8533.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98819; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8531; http://www.securityfocus.com/bid/98819
CVE: CVE-2017-8532
Published: 2017-06-15
Description: Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, and CVE-2017-8533.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98820; http://www.securitytracker.com/id/1038662; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8532
CVE: CVE-2017-8533
Published: 2017-06-15
Description: Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, and CVE-2017-8532.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98821; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8533; https://www.zerodayinitiative.com/advisories/ZDI-19-581/
CVE: CVE-2017-8534
Published: 2017-06-15
Description: Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents, aka "Windows Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0282, CVE-2017-0284, and CVE-2017-0285.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98822; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8534; http://www.securityfocus.com/bid/98822
CVE: CVE-2017-8543
Published: 2017-06-15
Description: Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-281
References: http://www.securityfocus.com/bid/98824; http://www.securitytracker.com/id/1038667; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8543
CVE: CVE-2017-8544
Published: 2017-06-15
Description: Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to obtain information to further compromise the user's system when Windows Search fails to handle objects in memory, aka "Windows Search Information Disclosure Vulnerability".
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98826; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8544; http://www.securityfocus.com/bid/98826
CVE: CVE-2017-8545
Published: 2017-06-15
Description: A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98917; http://www.securitytracker.com/id/1038664; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8545
CVE: CVE-2017-8547
Published: 2017-06-15
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8519.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98932; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8547; http://www.securityfocus.com/bid/98932
CVE: CVE-2017-8548
Published: 2017-06-15
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system when Microsoft Edge improperly handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".  This CVE ID is unique from CVE-2017-8499, CVE-2017-8520, CVE-2017-8521, and CVE-2017-8549.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98954; http://www.securitytracker.com/id/1038676; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8548
CVE: CVE-2017-8549
Published: 2017-06-15
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system when Microsoft Edge improperly handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".  This CVE ID is unique from CVE-2017-8499, CVE-2017-8520, CVE-2017-8521, and CVE-2017-8548.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98955; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8549; http://www.securityfocus.com/bid/98955
CVE: CVE-2017-8550
Published: 2017-06-15
Description: A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98916; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8550; https://www.exploit-db.com/exploits/42316/
CVE: CVE-2017-8551
Published: 2017-06-15
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98913; http://www.securitytracker.com/id/1038663; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8551
CVE: CVE-2017-8552
Published: 2017-06-15
Description: A kernel-mode driver in Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows 8 allows an elevation of privilege when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE is unique from CVE-2017-0263.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8552; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8552
CVE: CVE-2017-8553
Published: 2017-06-15
Description: An information disclosure vulnerability exists in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows Server 2016 when the Windows kernel improperly handles objects in memory, aka "GDI Information Disclosure Vulnerability".
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98940; http://www.securitytracker.com/id/1038662; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8553
CVE: CVE-2017-8555
Published: 2017-06-15
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to trick a user into loading a page with malicious content when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-8523 and CVE-2017-8530.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98956; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8555; http://www.securityfocus.com/bid/98956
CVE: CVE-2017-9606
Published: 2017-06-15
Description: Infotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file in the update folder. The attack succeeds because of incorrect folder permissions in conjunction with a lack of integrity and authenticity checks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-345, CWE-354, CWE-732
References: https://github.com/Houl777/CVE-2017-9606; https://github.com/Houl777/CVE-2017-9606
CVE: CVE-2017-1197
Published: 2017-06-15
Description: IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 123672.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: http://www.ibm.com/support/docview.wss?uid=swg22004170; https://exchange.xforce.ibmcloud.com/vulnerabilities/123672; http://www.ibm.com/support/docview.wss?uid=swg22004170
CVE: CVE-2017-1379
Published: 2017-06-15
Description: IBM API Connect 5.0.0.0 could allow a remote attacker to obtain sensitive information, caused by improper handling of requests to the Developer Portal. IBM X-Force ID: 127002.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22004714; http://www.securityfocus.com/bid/99063; https://exchange.xforce.ibmcloud.com/vulnerabilities/127002
CVE: CVE-2017-9670
Published: 2017-06-15
Description: An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://sourceforge.net/p/gnuplot/bugs/1933/; https://sourceforge.net/p/gnuplot/bugs/1933/
CVE: CVE-2015-7732
Published: 2017-06-15
Description: The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.info-sec.ca/advisories/Avira-Mobile-Security.html; https://www.info-sec.ca/advisories/Avira-Mobile-Security.html
CVE: CVE-2017-5244
Published: 2017-06-15
Description: Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update[PII_REDACTED]), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.
CVSS Score: 3.5 (LOW)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/99082; https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixed; https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/
CVE: CVE-2016-10395
Published: 2017-06-15
Description: In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform, a boundary error related to a named pipe within the FlexNet Publisher Licensing Service can be exploited to cause an out-of-bounds memory read access and subsequently execute arbitrary code with SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01; https://secuniaresearch.flexerasoftware.com/advisories/76368/; https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager
CVE: CVE-2017-9505
Published: 2017-06-15
Description: Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it even if they do not have permission to view the page itself.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.securityfocus.com/bid/99086; https://jira.atlassian.com/browse/CONFSERVER-52560; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170613-0_Atlassian_Confluence_Access_Restriction_Bypass_v10.txt
CVE: CVE-2017-9613
Published: 2017-06-15
Description: Stored Cross-site scripting (XSS) vulnerability in SAP SuccessFactors before b[PII_REDACTED] allows remote authenticated users to inject arbitrary web script or HTML via the file upload functionality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/bugtraq/2017/Jun/27; http://www.securityfocus.com/archive/1/540731/100/0/threaded; http://www.securityfocus.com/bid/99072
CVE: CVE-2017-9673
Published: 2017-06-15
Description: In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account (via the index.php/user/new URI) or change its settings (via the index.php/user/1 URI), including its password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://packetstormsecurity.com/files/142944/SimpleCE-2.3.0-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/142944/SimpleCE-2.3.0-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2017-9674
Published: 2017-06-15
Description: In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?return_url=[XSS] exploitable as a regular or admin user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/142944/SimpleCE-2.3.0-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/142944/SimpleCE-2.3.0-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2017-9419
Published: 2017-06-15
Description: Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8848; https://wpvulndb.com/vulnerabilities/8848
CVE: CVE-2017-9675
Published: 2017-06-15
Description: On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-605L/REVB/DIR-605L_REVB_RELEASE_NOTES_v2.08UIBETAB01_EN.pdf; http://www.securityfocus.com/bid/99084; https://www.exploit-db.com/exploits/43147/
CVE: CVE-2017-7629
Published: 2017-06-15
Description: QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: https://www.qnap.com/en-us/releasenotes/; https://www.qnap.com/en-us/releasenotes/