deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9367
Published: 2017-02-13
Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  The amount of resources requested by a malicious actor is not restricted, leading to a denial-of-service caused by resource exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/85965; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02; http://www.securityfocus.com/bid/85965
CVE: CVE-2016-9369
Published: 2017-02-13
Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  Firmware can be updated over the network without authentication, which may allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/85965; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02; http://www.securityfocus.com/bid/85965
CVE: CVE-2016-9371
Published: 2017-02-13
Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4.  User-controlled input is not neutralized before being output to web page (CROSS-SITE SCRIPTING).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/85965; https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02; http://www.securityfocus.com/bid/85965
CVE: CVE-2017-5139
Published: 2017-02-13
Description: An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://www.securityfocus.com/bid/95971; https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01; http://www.securityfocus.com/bid/95971
CVE: CVE-2017-5140
Published: 2017-02-13
Description: An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://www.securityfocus.com/bid/95971; https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01; http://www.securityfocus.com/bid/95971
CVE: CVE-2017-5141
Published: 2017-02-13
Description: An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated sessions (SESSION FIXATION).
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-384
References: http://www.securityfocus.com/bid/95971; https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01; http://www.securityfocus.com/bid/95971
CVE: CVE-2017-5142
Published: 2017-02-13
Description: An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: http://www.securityfocus.com/bid/95971; https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01; http://www.securityfocus.com/bid/95971
CVE: CVE-2017-5143
Published: 2017-02-13
Description: An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authenticating can make a directory traversal attack by accessing a specific URL.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/95971; https://ics-cert.us-cert.gov/advisories/ICSA-17-033-01; http://www.securityfocus.com/bid/95971
CVE: CVE-2017-5144
Published: 2017-02-13
Description: An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. The access control flaw allows access to most application functions without authentication.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/95411; https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03; http://www.securityfocus.com/bid/95411
CVE: CVE-2017-5145
Published: 2017-02-13
Description: An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-352
References: http://www.securityfocus.com/bid/95411; https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03; http://www.securityfocus.com/bid/95411
CVE: CVE-2017-5146
Published: 2017-02-13
Description: An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Sensitive information is stored in clear-text.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95411; https://ics-cert.us-cert.gov/advisories/ICSA-17-012-03; http://www.securityfocus.com/bid/95411
CVE: CVE-2017-5151
Published: 2017-02-13
Description: An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow remote code execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95416; https://ics-cert.us-cert.gov/advisories/ICSA-17-012-02; http://www.securityfocus.com/bid/95416
CVE: CVE-2017-5152
Published: 2017-02-13
Description: An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access pages unrestricted (AUTHENTICATION BYPASS).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/95410; https://ics-cert.us-cert.gov/advisories/ICSA-17-012-01; https://www.tenable.com/security/research/tra-2017-04
CVE: CVE-2017-5153
Published: 2017-02-13
Description: An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords to become exposed for the affected services, potentially leading to unauthorized shutdown of the affected PI services as well as potential reuse of domain credentials.
CVSS Score: 7.8 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/95355; https://ics-cert.us-cert.gov/advisories/ICSA-17-010-01; http://www.securityfocus.com/bid/95355
CVE: CVE-2017-5154
Published: 2017-02-13
Description: An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to the WebAccess software. Successful attack could result in administrative access to the application and its data files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95410; https://ics-cert.us-cert.gov/advisories/ICSA-17-012-01; https://www.tenable.com/security/research/tra-2017-04
CVE: CVE-2017-5155
Published: 2017-02-13
Description: An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, which can allow a malicious entity to compromise Historian databases. In some installation scenarios, resources beyond those created by Wonderware Historian may be compromised as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1188
References: http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000115/; http://www.securityfocus.com/bid/95766; http://www.securitytracker.com/id/1037808
CVE: CVE-2017-5157
Published: 2017-02-13
Description: An issue was discovered in Schneider Electric homeLYnk Controller, LSS100100, all versions prior to V1.5.0. The homeLYnk controller is susceptible to a cross-site scripting attack. User inputs can be manipulated to cause execution of JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95665; https://ics-cert.us-cert.gov/advisories/ICSA-17-019-01; http://www.securityfocus.com/bid/95665
CVE: CVE-2017-5159
Published: 2017-02-13
Description: An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-99
References: http://www.securityfocus.com/bid/95648; https://ics-cert.us-cert.gov/advisories/ICSA-17-017-01; http://www.securityfocus.com/bid/95648
CVE: CVE-2017-5161
Published: 2017-02-13
Description: An issue was discovered in Sielco Sistemi Winlog Lite SCADA Software, versions prior to Version 3.02.01, and Winlog Pro SCADA Software, versions prior to Version 3.02.01. An uncontrolled search path element (DLL Hijacking) vulnerability has been identified. Exploitation of this vulnerability could give an attacker access to the system with the same level of privilege as the application that utilizes the malicious DLL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/96119; https://ics-cert.us-cert.gov/advisories/ICSA-17-038-01; http://www.securityfocus.com/bid/96119
CVE: CVE-2017-5162
Published: 2017-02-13
Description: An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for remote service gives access to application set up and configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/93028; https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A; http://www.securityfocus.com/bid/93028
CVE: CVE-2017-5163
Published: 2017-02-13
Description: An issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. After an administrator downloads a configuration file, a copy of the configuration file, which includes hashes of user passwords, is saved to a location that is accessible without authentication by path traversal.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/95815; https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02; http://www.securityfocus.com/bid/95815
CVE: CVE-2017-5164
Published: 2017-02-13
Description: An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Input sent from a malicious client is not properly verified by the server. An attacker can execute arbitrary script code in another user's browser session (CROSS-SITE SCRIPTING).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93028; https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A; http://www.securityfocus.com/bid/93028
CVE: CVE-2017-5165
Published: 2017-02-13
Description: An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. There is no CSRF Token generated per page and/or per (sensitive) function. Successful exploitation of this vulnerability can allow silent execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/93028; https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A; http://www.securityfocus.com/bid/93028
CVE: CVE-2017-5166
Published: 2017-02-13
Description: An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. An INFORMATION EXPOSURE flaw can be used to gain privileged access to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93028; https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A; http://www.securityfocus.com/bid/93028
CVE: CVE-2017-5167
Published: 2017-02-13
Description: An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users do not have any option to change their own passwords.
CVSS Score: 8.6 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/bid/93028; https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A; http://www.securityfocus.com/bid/93028
CVE: CVE-2017-5168
Published: 2017-02-13
Description: An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a malicious page, an attacker can gain access to arbitrary files on the server. Smart Security Manager Versions 1.4 and prior to 1.31 are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/96147; https://ics-cert.us-cert.gov/advisories/ICSA-17-040-01; http://www.securityfocus.com/bid/96147
CVE: CVE-2017-5169
Published: 2017-02-13
Description: An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Post requests, an attacker can gain system level access to a remote shell session. Smart Security Manager Versions 1.5 and prior are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/96147; https://ics-cert.us-cert.gov/advisories/ICSA-17-040-01; http://www.securityfocus.com/bid/96147
CVE: CVE-2016-8355
Published: 2017-02-13
Description: An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and delete users, and change user permissions. According to Smiths-Medical, physical access to the pump is required to install drug library updates.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/94630; https://ics-cert.us-cert.gov/advisories/ICSMA-16-306-01; http://www.securityfocus.com/bid/94630
CVE: CVE-2016-8358
Published: 2017-02-13
Description: An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. The affected software does not verify the identities at communication endpoints, which may allow a man-in-the-middle attacker to gain access to the communication channel between endpoints.
CVSS Score: 8.5 (HIGH)
CWE: CWE-346
References: http://www.securityfocus.com/bid/94630; https://ics-cert.us-cert.gov/advisories/ICSMA-16-306-01; http://www.securityfocus.com/bid/94630
CVE: CVE-2016-8375
Published: 2017-02-13
Description: An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7, and 8000 PC unit. An unauthorized user with physical access to an affected Alaris PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling the PC unit and accessing the device's flash memory. The Alaris 8015 PC unit, Version 9.7, and the 8000 PC unit store wireless network authentication credentials and other sensitive technical data on internal flash memory. Accessing the internal flash memory of the affected device would require special tools to extract data and carrying out this attack at a healthcare facility would increase the likelihood of detection.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-255
References: http://www.securityfocus.com/bid/96113; https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-01; https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02
CVE: CVE-2016-9355
Published: 2017-02-13
Description: An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash memory. Older software versions of the Alaris 8015 PC unit, Version 9.5 and prior versions, store wireless network authentication credentials and other sensitive technical data on the affected device's removable flash memory. Being able to remove the flash memory from the affected device reduces the risk of detection, allowing an attacker to extract stored data at the attacker's convenience.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-255
References: http://www.securityfocus.com/bid/96116; https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02; http://www.securityfocus.com/bid/96116
CVE: CVE-2017-1121
Published: 2017-02-13
Description: IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997743
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21997743; http://www.securityfocus.com/bid/96164; http://www.securitytracker.com/id/1037806
CVE: CVE-2017-5149
Published: 2017-02-13
Description: An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability). The identities of the endpoints for the communication channel between the transmitter and St. Jude Medical's web site, Merlin.net, are not verified. This may allow a man-in-the-middle attacker to access or influence communications between the identified endpoints.
CVSS Score: 8.9 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/95331; https://ics-cert.us-cert.gov/advisories/ICSMA-17-009-01A; http://www.securityfocus.com/bid/95331
CVE: CVE-2016-10223
Published: 2017-02-14
Description: An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://github.com/bigtreecms/BigTree-CMS/blob/master/README.md; https://github.com/bigtreecms/BigTree-CMS/commit/59ebef5978f80e2fdc7b4db4a28b668c5a39fbc3; https://github.com/bigtreecms/BigTree-CMS/blob/master/README.md
CVE: CVE-2017-5967
Published: 2017-02-14
Description: The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the __timer_stats_timer_set_start_info function in kernel/time/timer.c.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?id=dfb4357da6ddbdf57d583ba64361c9d792b0e0b1; http://www.securityfocus.com/bid/96271; https://bugzilla.kernel.org/show_bug.cgi?id=193921
CVE: CVE-2017-5970
Published: 2017-02-14
Description: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b2cef20f19c87999fff3da4071e66937db9644; http://www.debian.org/security/2017/dsa-3791; http://www.openwall.com/lists/oss-security/2017/02/12/3
CVE: CVE-2017-5972
Published: 2017-02-14
Description: The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://seclists.org/oss-sec/2017/q1/573; http://www.securityfocus.com/bid/96231; https://access.redhat.com/security/cve/cve-2017-5972
CVE: CVE-2017-2968
Published: 2017-02-15
Description: Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/96197; https://helpx.adobe.com/security/products/campaign/apsb17-03.html; https://helpx.adobe.com/security/products/campaign/apsb17-06.html
CVE: CVE-2017-2969
Published: 2017-02-15
Description: Adobe Campaign versions 16.4 Build 8724 and earlier have a cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96200; https://helpx.adobe.com/security/products/campaign/apsb17-03.html; http://www.securityfocus.com/bid/96200
CVE: CVE-2017-2973
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96192; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html
CVE: CVE-2017-2974
Published: 2017-02-15
Description: Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96195; http://www.securitytracker.com/id/1037816; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-05.html