deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-5862
Published: 2017-08-16
Description: When a control related to codec is issued from userspace in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, the type casting is done to the container structure instead of the codec's individual structure, resulting in a device restart after kernel crash occurs.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/98194; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=4199451e83729a3add781eeafaee32994ff65b04
CVE: CVE-2016-5863
Published: 2017-08-16
Description: In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, several sanity checks are missing which can lead to out-of-bounds accesses.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/99465; https://source.android.com/security/bulletin/2017-07-01; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=daf0acd54a6a80de227baef9a06285e4aa5f8c93
CVE: CVE-2016-5864
Published: 2017-08-16
Description: In an audio driver function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, some parameters are from userspace, and if they are set to a large value, integer overflow is possible followed by buffer overflow. In another function, a missing check for a lower bound may result in an out of bounds memory access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=cbc21ceb69cb7bca0643423a7ca982abce3ce50a
CVE: CVE-2016-5867
Published: 2017-08-16
Description: In a sound driver in Android for MSM, Firefox OS for MSM, QRD Android, some variables are from userspace and values can be chosen that could result in stack overflow.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/98170; https://source.android.com/security/bulletin/2017-05-01; https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=065360da7147003aed8f59782b7652d565f56be5
CVE: CVE-2017-6421
Published: 2017-08-16
Description: In the touch controller function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a variable may be controlled by the user and can lead to a buffer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=be42c7ff1f[PII_REDACTED]451fd18f47144c8f1b6b
CVE: CVE-2017-8243
Published: 2017-08-16
Description: A buffer overflow can occur in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android when processing a firmware image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99465/references; https://source.android.com/security/bulletin/2017-07-01; http://www.securityfocus.com/bid/99465/references
CVE: CVE-2017-8248
Published: 2017-08-16
Description: A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2017/Jul/34; http://www.securityfocus.com/bid/106128; http://www.securityfocus.com/bid/99891
CVE: CVE-2017-7546
Published: 2017-08-16
Description: PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.debian.org/security/2017/dsa-3935; http://www.debian.org/security/2017/dsa-3936; http://www.securityfocus.com/bid/100278
CVE: CVE-2017-7547
Published: 2017-08-16
Description: PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://www.debian.org/security/2017/dsa-3935; http://www.debian.org/security/2017/dsa-3936; http://www.securityfocus.com/bid/100275
CVE: CVE-2017-7548
Published: 2017-08-16
Description: PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.debian.org/security/2017/dsa-3935; http://www.debian.org/security/2017/dsa-3936; http://www.securityfocus.com/bid/100276
CVE: CVE-2017-7551
Published: 2017-08-16
Description: 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-209, CWE-640
References: https://access.redhat.com/errata/RHSA-2017:2569; https://pagure.io/389-ds-base/issue/49336; https://access.redhat.com/errata/RHSA-2017:2569
CVE: CVE-2017-12892
Published: 2017-08-16
Description: Foxit PDF Compressor installers from versions from 7.0.0.183 to 7.7.2.10 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/100414; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securityfocus.com/bid/100414
CVE: CVE-2011-0469
Published: 2017-08-17
Description: Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://bugzilla.suse.com/show_bug.cgi?id=679325; https://github.com/openSUSE/open-build-service/commit/23c8d21c75242999e29379e6ca8418a14c8725c6; https://github.com/openSUSE/open-build-service/commit/76b0ab003f34435ca90d943e02dd22279cdeec2a
CVE: CVE-2017-11661
Published: 2017-08-17
Description: The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/12; https://www.exploit-db.com/exploits/42433/; http://seclists.org/fulldisclosure/2017/Aug/12
CVE: CVE-2017-11662
Published: 2017-08-17
Description: The _WM_ParseNewMidi function in f_midi.c in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/12; https://www.exploit-db.com/exploits/42433/; http://seclists.org/fulldisclosure/2017/Aug/12
CVE: CVE-2017-11663
Published: 2017-08-17
Description: The _WM_SetupMidiEvent function in internal_midi.c:2315 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/12; https://www.exploit-db.com/exploits/42433/; http://seclists.org/fulldisclosure/2017/Aug/12
CVE: CVE-2017-11664
Published: 2017-08-17
Description: The _WM_SetupMidiEvent function in internal_midi.c:2122 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) via a crafted mid file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/12; https://github.com/Mindwerks/wildmidi/commit/ad6d7cf88d6673167ca1f517248af9409a9f1be1; https://www.exploit-db.com/exploits/42433/
CVE: CVE-2017-12441
Published: 2017-08-17
Description: The row_is_empty function in base/4bitmap.c:274 in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/15; http://www.securityfocus.com/bid/100419; http://seclists.org/fulldisclosure/2017/Aug/15
CVE: CVE-2017-12442
Published: 2017-08-17
Description: The row_is_empty function in base/4bitmap.c:272 in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/15; http://www.securityfocus.com/bid/100421; http://seclists.org/fulldisclosure/2017/Aug/15
CVE: CVE-2017-12443
Published: 2017-08-17
Description: The mdjvu_bitmap_pack_row function in base/4bitmap.c in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/15; http://www.securityfocus.com/bid/100422; http://seclists.org/fulldisclosure/2017/Aug/15
CVE: CVE-2017-12444
Published: 2017-08-17
Description: The mdjvu_bitmap_get_bounding_box function in base/4bitmap.c in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/15; http://www.securityfocus.com/bid/100416; http://seclists.org/fulldisclosure/2017/Aug/15
CVE: CVE-2017-12445
Published: 2017-08-17
Description: The JB2BitmapCoder::code_row_by_refinement function in jb2/bmpcoder.cpp in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/15; http://www.securityfocus.com/bid/100423; http://seclists.org/fulldisclosure/2017/Aug/15
CVE: CVE-2017-7555
Published: 2017-08-17
Description: Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-119
References: http://www.debian.org/security/2017/dsa-3949; http://www.securityfocus.com/bid/100378; https://access.redhat.com/errata/RHSA-2017:2788
CVE: CVE-2017-7556
Published: 2017-08-17
Description: Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/100411; https://bugzilla.redhat.com/show_bug.cgi?id=1480060; http://www.securityfocus.com/bid/100411
CVE: CVE-2017-12907
Published: 2017-08-17
Description: Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the url path to usersearch.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lu4n.com/cve/7.txt; http://lu4n.com/cve/7.txt
CVE: CVE-2017-12908
Published: 2017-08-17
Description: SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lu4n.com/cve/8.txt; http://lu4n.com/cve/8.txt
CVE: CVE-2017-12909
Published: 2017-08-17
Description: SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lu4n.com/cve/9.txt; http://lu4n.com/cve/9.txt
CVE: CVE-2017-12910
Published: 2017-08-17
Description: SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lu4n.com/cve/10.txt; http://lu4n.com/cve/10.txt
CVE: CVE-2017-6710
Published: 2017-08-17
Description: A vulnerability in the Cisco Virtual Network Function (VNF) Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to specify arbitrary commands that will run as root on the server. An attacker could use this setting to elevate privileges and run commands in the context of the root user on the server. Cisco Bug IDs: CSCvc76670. Known Affected Releases: prior to 5.0.4 and 5.1.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/100362; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-em; http://www.securityfocus.com/bid/100362
CVE: CVE-2017-6767
Published: 2017-08-17
Description: A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to gain higher privileges than the account is assigned. The attacker will be granted the privileges of the last user to log in, regardless of whether those privileges are higher or lower than what should have been granted. The attacker cannot gain root-level privileges. The vulnerability is due to a limitation with how Role-Based Access Control (RBAC) grants privileges to remotely authenticated users when login occurs via SSH directly to the local management interface of the APIC. An attacker could exploit this vulnerability by authenticating to the targeted device. The attacker's privilege level will be modified to match that of the last user to log in via SSH. An exploit could allow the attacker to gain elevated privileges and perform CLI commands that should be restricted by the attacker's configured role. Cisco Bug IDs: CSCvc34335. Known Affected Releases: 1.0(1e), 1.0(1h), 1.0(1k), 1.0(1n), 1.0(2j), 1.0(2m), 1.0(3f), 1.0(3i), 1.0(3k), 1.0(3n), 1.0(4h), 1.0(4o); 1.1(0.920a), 1.1(1j), 1.1(3f); 1.2 Base, 1.2(2), 1.2(3), 1.2.2; 1.3(1), 1.3(2), 1.3(2f); 2.0 Base, 2.0(1).
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/100400; http://www.securitytracker.com/id/1039180; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-apic1
CVE: CVE-2017-6768
Published: 2017-08-17
Description: A vulnerability in the build procedure for certain executable system files installed at boot time on Cisco Application Policy Infrastructure Controller (APIC) devices could allow an authenticated, local attacker to gain root-level privileges. The vulnerability is due to a custom executable system file that was built to use relative search paths for libraries without properly validating the library to be loaded. An attacker could exploit this vulnerability by authenticating to the device and loading a malicious library that can escalate the privilege level. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. The attacker must have valid user credentials to log in to the device. Cisco Bug IDs: CSCvc96087. Known Affected Releases: 1.1(0.920a), 1.1(1j), 1.1(3f); 1.2 Base, 1.2(2), 1.2(3), 1.2.2; 1.3(1), 1.3(2), 1.3(2f); 2.0 Base, 2.0(1).
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/100363; http://www.securitytracker.com/id/1039179; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-apic2
CVE: CVE-2017-6771
Published: 2017-08-17
Description: A vulnerability in the AutoVNF automation tool of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to acquire sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by browsing to a specific URL of an affected device. An exploit could allow the attacker to view sensitive configuration information about the deployment. Cisco Bug IDs: CSCvd29358. Known Affected Releases: 21.0.v0.65839.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100385; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-usf; http://www.securityfocus.com/bid/100385
CVE: CVE-2017-6772
Published: 2017-08-17
Description: A vulnerability in Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and navigating to certain configuration files. An exploit could allow the attacker to view sensitive system configuration files. Cisco Bug IDs: CSCvd29408. Known Affected Releases: 2.3(2).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100388; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc1; http://www.securityfocus.com/bid/100388
CVE: CVE-2017-6773
Published: 2017-08-17
Description: A vulnerability in the CLI of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, local attacker to bypass the CLI restrictions and execute commands on the underlying operating system. The vulnerability is due to insufficient input sanitization of user-supplied input at the CLI. An attacker could exploit this vulnerability by crafting a script on the device that will allow them to bypass built-in restrictions. An exploit could allow the unauthorized user to launch the CLI directly from a command shell. Cisco Bug IDs: CSCvd47722. Known Affected Releases: 21.0.v0.65839.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100376; http://www.securitytracker.com/id/1039181; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-staros1
CVE: CVE-2017-6774
Published: 2017-08-17
Description: A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify sensitive system files. The vulnerability is due to the inclusion of sensitive system files within specific FTP subdirectories. An attacker could exploit this vulnerability by overwriting sensitive configuration files through FTP. An exploit could allow the attacker to overwrite configuration files on an affected system. Cisco Bug IDs: CSCvd47739. Known Affected Releases: 21.0.v0.65839.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-552
References: http://www.securityfocus.com/bid/100386; http://www.securitytracker.com/id/1039182; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-staros2
CVE: CVE-2017-6775
Published: 2017-08-17
Description: A vulnerability in the CLI of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, local attacker to elevate their privileges to admin-level privileges. The vulnerability is due to incorrect permissions that are given to a set of users. An attacker could exploit this vulnerability by logging in to the shell of an affected device and elevating their privileges by modifying environment variables. An exploit could allow the attacker to gain admin-level privileges and take control of the affected device. Cisco Bug IDs: CSCvd47741. Known Affected Releases: 21.0.v0.65839.
CVSS Score: 5.7 (MEDIUM)
References: http://www.securityfocus.com/bid/100381; http://www.securitytracker.com/id/1039183; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-staros3
CVE: CVE-2017-6776
Published: 2017-08-17
Description: A vulnerability in the web framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by convincing a user to access a malicious link or by intercepting a user request and injecting malicious code into the request. An exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd76324. Known Affected Releases: 2.2(9.76) and 2.3(1).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100370; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc2; http://www.securityfocus.com/bid/100370
CVE: CVE-2017-6777
Published: 2017-08-17
Description: A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to acquire sensitive system information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerability by logging into the ConfD server and executing certain commands. An exploit could allow an unprivileged user to view configuration parameters that can be maliciously used. Cisco Bug IDs: CSCvd76409. Known Affected Releases: 2.3, 2.3(2).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100390; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc3; http://www.securityfocus.com/bid/100390
CVE: CVE-2017-6778
Published: 2017-08-17
Description: A vulnerability in the Elastic Services Controller (ESC) web interface of the Cisco Ultra Services Platform could allow an authenticated, remote attacker to acquire sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. An exploit could allow the attacker to view information regarding the Ultra Services Platform deployment. Cisco Bug IDs: CSCvd76406. Known Affected Releases: 21.0.v0.65839.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100380; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-usp; http://www.securityfocus.com/bid/100380
CVE: CVE-2017-6781
Published: 2017-08-17
Description: A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker to gain elevated privileges on an affected system. The affected privilege level is not at the root level. The vulnerability is due to incorrect role-based access control (RBAC) for shell user accounts. An attacker could exploit this vulnerability by authenticating to an affected appliance and providing crafted user input via the CLI. A successful exploit could allow the attacker to acquire a higher privilege level than should have been granted. To exploit this vulnerability, the attacker must log in to the appliance with valid credentials. Cisco Bug IDs: CSCve37724. Known Affected Releases: 9.0.0, 9.1.0, 10.0.0, 11.0.0, 12.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/100365; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-cps; http://www.securityfocus.com/bid/100365