deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6019
Published: 2017-04-07
Description: An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the device may cause it to reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-052-01; http://www.securityfocus.com/bid/96543; https://ics-cert.us-cert.gov/advisories/ICSA-17-061-02
CVE: CVE-2017-6033
Published: 2017-04-07
Description: A DLL Hijacking issue was discovered in Schneider Electric Interactive Graphical SCADA System (IGSS) Software, Version 12 and previous versions. The software will execute a malicious file if it is named the same as a legitimate file and placed in a location that is earlier in the search path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-090-01; http://www.securityfocus.com/bid/97389; https://ics-cert.us-cert.gov/advisories/ICSA-17-094-01
CVE: CVE-2017-7589
Published: 2017-04-09
Description: In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by the "anonymous" user, as demonstrated by responses with a 200 HTTP status code and a JSON object containing IP address strings. This is related to a missing access-control check in bin/defaults/script/info/login.js.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.rootlabs.com.br/information-disclosure-forgerock-openidm-4-0-0-and-4-5-0/; https://backstage.forgerock.com/knowledge/kb/article/a92936505; http://www.rootlabs.com.br/information-disclosure-forgerock-openidm-4-0-0-and-4-5-0/
CVE: CVE-2017-7590
Published: 2017-04-09
Description: OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by a crafted Managed Object Name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.rootlabs.com.br/forgerock-persistent-and-reflected-cross-site-scripting-xss/; http://www.securityfocus.com/bid/98044; https://backstage.forgerock.com/knowledge/kb/article/a92936505
CVE: CVE-2017-7591
Published: 2017-04-09
Description: OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.rootlabs.com.br/forgerock-persistent-and-reflected-cross-site-scripting-xss/; https://backstage.forgerock.com/knowledge/kb/article/a92936505; http://www.rootlabs.com.br/forgerock-persistent-and-reflected-cross-site-scripting-xss/
CVE: CVE-2017-7592
Published: 2017-04-09
Description: The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://bugzilla.maptools.org/show_bug.cgi?id=2658; http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97510
CVE: CVE-2017-7593
Published: 2017-04-09
Description: tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2651; http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97502
CVE: CVE-2017-7594
Published: 2017-04-09
Description: The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: http://bugzilla.maptools.org/show_bug.cgi?id=2659; http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97503
CVE: CVE-2017-7595
Published: 2017-04-09
Description: The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97501; https://blogs.gentoo.org/ago/2017/04/01/libtiff-divide-by-zero-in-jpegsetupencode-tiff_jpeg-c
CVE: CVE-2017-7596
Published: 2017-04-09
Description: LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97506; https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes
CVE: CVE-2017-7597
Published: 2017-04-09
Description: tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97504; https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes
CVE: CVE-2017-7598
Published: 2017-04-09
Description: tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-369
References: http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97499; https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes
CVE: CVE-2017-7599
Published: 2017-04-09
Description: LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97505; http://www.securityfocus.com/bid/97508
CVE: CVE-2017-7600
Published: 2017-04-09
Description: LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3844; https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes; https://security.gentoo.org/glsa/201709-27
CVE: CVE-2017-7601
Published: 2017-04-09
Description: LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97511; https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes
CVE: CVE-2017-7602
Published: 2017-04-09
Description: LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3844; http://www.securityfocus.com/bid/97500; https://blogs.gentoo.org/ago/2017/04/01/libtiff-multiple-ubsan-crashes
CVE: CVE-2017-7603
Published: 2017-04-09
Description: au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/; https://security.gentoo.org/glsa/202209-13; https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/
CVE: CVE-2017-7604
Published: 2017-04-09
Description: au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/; https://security.gentoo.org/glsa/202209-13; https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/
CVE: CVE-2017-7605
Published: 2017-04-09
Description: aacplusenc.c in HE-AAC+ Codec (aka libaacplus) 2.0.2 has an assertion failure, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-617
References: https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/; https://security.gentoo.org/glsa/202209-13; https://blogs.gentoo.org/ago/2017/04/01/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure/
CVE: CVE-2017-7606
Published: 2017-04-09
Description: coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98685; https://blogs.gentoo.org/ago/2017/04/02/imagemagick-undefined-behavior-in-codersrle-c/
CVE: CVE-2017-7607
Published: 2017-04-09
Description: The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html; http://www.securityfocus.com/bid/98608; https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c
CVE: CVE-2017-7608
Published: 2017-04-09
Description: The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html; http://www.securityfocus.com/bid/98609; https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c
CVE: CVE-2017-7609
Published: 2017-04-09
Description: elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html; https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-__libelf_decompress-elf_compress-c; https://security.gentoo.org/glsa/201710-10
CVE: CVE-2017-7610
Published: 2017-04-09
Description: The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html; https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c; https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
CVE: CVE-2017-7611
Published: 2017-04-09
Description: The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html; https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c; https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
CVE: CVE-2017-7612
Published: 2017-04-09
Description: The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html; https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c; https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
CVE: CVE-2017-7613
Published: 2017-04-09
Description: elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html; https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c; https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
CVE: CVE-2017-7614
Published: 2017-04-09
Description: elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/04/05/binutils-two-null-pointer-dereference-in-elflink-c/; https://security.gentoo.org/glsa/201709-02; https://blogs.gentoo.org/ago/2017/04/05/binutils-two-null-pointer-dereference-in-elflink-c/
CVE: CVE-2014-2960
Published: 2017-04-10
Description: Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and configuration files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.visioncritical.com/customer-advisory-vision-critical-cto/; https://www.visioncritical.com/customer-advisory-vision-critical-cto/
CVE: CVE-2015-2880
Published: 2017-04-10
Description: TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-2881
Published: 2017-04-10
Description: Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-2882
Published: 2017-04-10
Description: Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M[PII_REDACTED] for the backdoor user account, and a password of M[PII_REDACTED] for the backdoor admin account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-2883
Published: 2017-04-10
Description: Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-2884
Published: 2017-04-10
Description: Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97683; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; http://www.securityfocus.com/bid/97683
CVE: CVE-2015-2885
Published: 2017-04-10
Description: Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-2886
Published: 2017-04-10
Description: iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-2887
Published: 2017-04-10
Description: iBaby M3S has a password of admin for the backdoor admin account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-2888
Published: 2017-04-10
Description: Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-2889
Published: 2017-04-10
Description: Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via manual entry of a Settings URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors; https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors
CVE: CVE-2015-6021
Published: 2017-04-10
Description: Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems; https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems
CVE: CVE-2015-6027
Published: 2017-04-10
Description: Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems; https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems
CVE: CVE-2015-6028
Published: 2017-04-10
Description: Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems; https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems
CVE: CVE-2015-6035
Published: 2017-04-10
Description: Opsview before 2015-11-06 has XSS via SNMP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems; https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems
CVE: CVE-2015-7260
Published: 2017-04-10
Description: Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://stealthsploit.com/2015/10/27/vulnerability-disclosures/; https://stealthsploit.com/2015/10/27/vulnerability-disclosures/
CVE: CVE-2015-7263
Published: 2017-04-10
Description: The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs; https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs
CVE: CVE-2015-7264
Published: 2017-04-10
Description: The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs; https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs
CVE: CVE-2015-7265
Published: 2017-04-10
Description: Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs; https://groups.google.com/forum/#%21topic/facebook-proxygen/K8wCXbW4ihs
CVE: CVE-2015-7270
Published: 2017-04-10
Description: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20441859; http://www.securityfocus.com/bid/97521; http://en.community.dell.com/techcenter/extras/m/white_papers/20441859
CVE: CVE-2015-7271
Published: 2017-04-10
Description: Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20441859; http://www.securityfocus.com/bid/97561; http://en.community.dell.com/techcenter/extras/m/white_papers/20441859