deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-10058
Published: 2017-03-23
Description: Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95212; https://bugzilla.redhat.com/show_bug.cgi?id=1410467
CVE: CVE-2016-10059
Published: 2017-03-23
Description: Buffer overflow in coders/tiff.c in ImageMagick before 6.9.4-1 allows remote attackers to cause a denial of service (application crash) or have unspecified other impact via a crafted TIFF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00028.html; http://www.openwall.com/lists/oss-security/2016/12/26/9; http://www.securityfocus.com/bid/95206
CVE: CVE-2016-8885
Published: 2017-03-23
Description: The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/10/23/1; http://www.openwall.com/lists/oss-security/2016/10/23/5; http://www.openwall.com/lists/oss-security/2016/10/23/9
CVE: CVE-2016-8886
Published: 2017-03-23
Description: The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which triggers a memory allocation failure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/10/23/2; http://www.openwall.com/lists/oss-security/2016/10/25/11; http://www.securityfocus.com/bid/93839
CVE: CVE-2016-8887
Published: 2017-03-23
Description: The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/10/23/3; http://www.openwall.com/lists/oss-security/2016/10/23/6; http://www.securityfocus.com/bid/93835
CVE: CVE-2016-9011
Published: 2017-03-23
Description: The wmf_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/10/25/1; http://www.securityfocus.com/bid/93860; https://blogs.gentoo.org/ago/2016/10/18/libwmf-memory-allocation-failure-in-wmf_malloc-api-c
CVE: CVE-2016-9262
Published: 2017-03-23
Description: Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/11/10/4; http://www.securityfocus.com/bid/94224; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9264
Published: 2017-03-23
Description: Buffer overflow in the printMP3Headers function in listmp3.c in Libming 0.4.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mp3 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/11/10/9; http://www.securityfocus.com/bid/94251; https://blogs.gentoo.org/ago/2016/11/07/libming-listmp3-global-buffer-overflow-in-printmp3headers-listmp3-c/
CVE: CVE-2016-9265
Published: 2017-03-23
Description: The printMP3Headers function in listmp3.c in Libming 0.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp3 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.openwall.com/lists/oss-security/2016/11/10/10; http://www.securityfocus.com/bid/94252; https://blogs.gentoo.org/ago/2016/11/09/libming-listmp3-divide-by-zero-in-printmp3headers-list
CVE: CVE-2016-9266
Published: 2017-03-23
Description: listmp3.c in libming 0.4.7 allows remote attackers to unspecified impact via a crafted mp3 file, which triggers an invalid left shift.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189
References: http://www.openwall.com/lists/oss-security/2016/11/10/11; http://www.securityfocus.com/bid/94254; https://blogs.gentoo.org/ago/2016/11/09/libming-listmp3-left-shift-in-listmp3-c
CVE: CVE-2016-9275
Published: 2017-03-23
Description: Heap-based buffer overflow in the _dwarf_skim_forms function in libdwarf/dwarf_macro5.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/11/11/7; http://www.securityfocus.com/bid/94284; https://blogs.gentoo.org/ago/2016/11/07/libdwarf-heap-based-buffer-overflow-in-_dwarf_skim_forms-dwarf_macro5-c
CVE: CVE-2016-9276
Published: 2017-03-23
Description: The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/11/11/9; http://www.securityfocus.com/bid/94284; https://blogs.gentoo.org/ago/2016/11/07/libdwarf-heap-based-buffer-overflow-in-dwarf_get_aranges_list-dwarf_arange-c
CVE: CVE-2016-9387
Published: 2017-03-23
Description: Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94374; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9388
Published: 2017-03-23
Description: The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94371; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9389
Published: 2017-03-23
Description: The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure).
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94371; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9390
Published: 2017-03-23
Description: The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94371; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9391
Published: 2017-03-23
Description: The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94371; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9392
Published: 2017-03-23
Description: The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94377; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9393
Published: 2017-03-23
Description: The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94377; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9394
Published: 2017-03-23
Description: The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94372; https://access.redhat.com/errata/RHSA-2017:1208
CVE: CVE-2016-9395
Published: 2017-03-23
Description: The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00009.html; http://www.openwall.com/lists/oss-security/2016/11/17/1
CVE: CVE-2016-9396
Published: 2017-03-23
Description: The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html; http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94379
CVE: CVE-2016-9397
Published: 2017-03-23
Description: The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2016/11/17/1; http://www.securityfocus.com/bid/94373; https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure
CVE: CVE-2016-9398
Published: 2017-03-23
Description: The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html
CVE: CVE-2016-9399
Published: 2017-03-23
Description: The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html; http://www.openwall.com/lists/oss-security/2016/11/17/1
CVE: CVE-2016-9556
Published: 2017-03-23
Description: The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00040.html; http://www.debian.org/security/2016/dsa-3726; http://www.openwall.com/lists/oss-security/2016/11/23/1
CVE: CVE-2016-9557
Published: 2017-03-23
Description: Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/11/23/2; http://www.securityfocus.com/bid/94490; https://blogs.gentoo.org/ago/2016/11/19/jasper-signed-integer-overflow-in-jas_image-c
CVE: CVE-2017-7242
Published: 2017-03-23
Description: Multiple Cross-Site Scripting (XSS) were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/checkout_item.php, bibliography/dl_print.php, bibliography/item.php, bibliography/item_barcode_generator.php, bibliography/printed_card.php, circulation/loan_rules.php, master_file/author.php, master_file/coll_type.php, and master_file/doc_language.php and the quickReturnID field to circulation/ajax_action.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.daimacn.com/post/10.html; http://www.securityfocus.com/bid/97062; http://www.daimacn.com/post/10.html
CVE: CVE-2013-6446
Published: 2017-03-23
Description: The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs.
CVSS Score: 3.1 (LOW)
CWE: CWE-264
References: http://www.securityfocus.com/bid/97068; https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_mfb_qpm_4n; http://www.securityfocus.com/bid/97068
CVE: CVE-2014-0229
Published: 2017-03-23
Description: Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_i1q_xvk_2r; https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_i1q_xvk_2r
CVE: CVE-2015-0855
Published: 2017-03-23
Description: The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2015/12/23/8; http://www.securityfocus.com/bid/97283; https://bugs.launchpad.net/ubuntu/+source/pitivi/+bug/1495272
CVE: CVE-2015-2263
Published: 2017-03-23
Description: Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0_3; https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0_3
CVE: CVE-2015-4078
Published: 2017-03-23
Description: Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_o1q_wrm_js; https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_o1q_wrm_js
CVE: CVE-2015-4166
Published: 2017-03-23
Description: Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-320
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_jpc_mwm_js; https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_jpc_mwm_js
CVE: CVE-2015-5729
Published: 2017-03-23
Description: The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, which makes it easier for remote attackers to obtain sensitive information or bypass authentication via a brute-force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://kaoticoneutral.blogspot.com.ar/2015/12/samsung-smarttv-and-printers-weak.html; http://packetstormsecurity.com/files/134976/Samsung-SoftAP-Weak-Password.html; http://seclists.org/fulldisclosure/2015/Dec/79
CVE: CVE-2015-8622
Published: 2017-03-23
Description: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/12/21/8; http://www.openwall.com/lists/oss-security/2015/12/23/7; https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
CVE: CVE-2015-8623
Published: 2017-03-23
Description: The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/12/21/8; http://www.openwall.com/lists/oss-security/2015/12/23/7; https://gerrit.wikimedia.org/r/#/c/156336/5/includes/User.php
CVE: CVE-2015-8624
Published: 2017-03-23
Description: The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/12/21/8; http://www.openwall.com/lists/oss-security/2015/12/23/7; https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
CVE: CVE-2015-8625
Published: 2017-03-23
Description: MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/12/21/8; http://www.openwall.com/lists/oss-security/2015/12/23/7; https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
CVE: CVE-2015-8626
Published: 2017-03-23
Description: The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.openwall.com/lists/oss-security/2015/12/21/8; http://www.openwall.com/lists/oss-security/2015/12/23/7; https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
CVE: CVE-2015-8627
Published: 2017-03-23
Description: MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2015/12/21/8; http://www.openwall.com/lists/oss-security/2015/12/23/7; https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
CVE: CVE-2015-8628
Published: 2017-03-23
Description: The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/12/21/8; http://www.openwall.com/lists/oss-security/2015/12/23/7; https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
CVE: CVE-2015-8687
Published: 2017-03-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2016/Jan/0; http://seclists.org/fulldisclosure/2016/Jan/0
CVE: CVE-2017-6517
Published: 2017-03-23
Description: Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge.The specific flaw exists within the handling of DLL (api-ms-win-core-winrt-string-l1-1-0.dll) loading by the Skype.exe process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-427
References: http://packetstormsecurity.com/files/141650/Skype-7.16.0.102-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2017/Mar/44; http://www.securityfocus.com/bid/96969
CVE: CVE-2017-6895
Published: 2017-03-23
Description: USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://packetstormsecurity.com/files/141652/USB-Pratirodh-XXE-Injection.html; http://seclists.org/fulldisclosure/2017/Mar/42; http://www.securityfocus.com/bid/96936
CVE: CVE-2017-6911
Published: 2017-03-23
Description: USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with physical access to the system can modify the file according his own requirements that may aid in further attack.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-922
References: http://packetstormsecurity.com/files/141651/USB-Pratirodh-Insecure-Password-Storage.html; http://seclists.org/fulldisclosure/2017/Mar/43; http://www.securityfocus.com/archive/1/540289/100/0/threaded
CVE: CVE-2017-6950
Published: 2017-03-23
Description: SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy restrictions and execute arbitrary code via a crafted ABAP code, aka SAP Security Note 2407616.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://www.securityfocus.com/bid/96872; http://www.securitytracker.com/id/1038122; https://erpscan.io/advisories/erpscan-17-011-sap-gui-versions-remote-code-execution-bypass-security-policy/