deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12237
Published: 2017-09-29
Description: A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain IKEv2 packets. An attacker could exploit this vulnerability by sending specific IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause high CPU utilization, traceback messages, or a reload of the affected device that leads to a DoS condition. This vulnerability affects Cisco devices that have the Internet Security Association and Key Management Protocol (ISAKMP) enabled. Although only IKEv2 packets can be used to trigger this vulnerability, devices that are running Cisco IOS Software or Cisco IOS XE Software are vulnerable when ISAKMP is enabled. A device does not need to be configured with any IKEv2-specific features to be vulnerable. Many features use IKEv2, including different types of VPNs such as the following: LAN-to-LAN VPN; Remote-access VPN, excluding SSL VPN; Dynamic Multipoint VPN (DMVPN); and FlexVPN. Cisco Bug IDs: CSCvc41277.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/101037; http://www.securitytracker.com/id/1039460; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ike
CVE: CVE-2017-12238
Published: 2017-09-29
Description: A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service (DoS) condition. The vulnerability is due to a memory management issue in the affected software. An attacker could exploit this vulnerability by creating a large number of VPLS-generated MAC entries in the MAC address table of an affected device. A successful exploit could allow the attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a DoS condition. This vulnerability affects Cisco Catalyst 6800 Series Switches that are running a vulnerable release of Cisco IOS Software and have a Cisco C6800-16P10G or C6800-16P10G-XL line card in use with Supervisor Engine 6T. To be vulnerable, the device must also be configured with VPLS and the C6800-16P10G or C6800-16P10G-XL line card needs to be the core-facing MPLS interfaces. Cisco Bug IDs: CSCva61927.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/101040; http://www.securitytracker.com/id/1039453; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-vpls
CVE: CVE-2017-12239
Published: 2017-09-29
Description: A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, physical attacker to access an affected device's operating system. The vulnerability exists because an engineering console port is available on the motherboard of the affected line cards. An attacker could exploit this vulnerability by physically connecting to the console port on the line card. A successful exploit could allow the attacker to gain full access to the affected device's operating system. This vulnerability affects only Cisco ASR 1000 Series Routers that have removable line cards and Cisco cBR-8 Converged Broadband Routers, if they are running certain Cisco IOS XE 3.16 through 16.5 releases. Cisco Bug IDs: CSCvc65866, CSCve77132.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264, CWE-798
References: http://www.securityfocus.com/bid/101042; http://www.securitytracker.com/id/1039454; http://www.securitytracker.com/id/1039455
CVE: CVE-2017-12240
Published: 2017-09-29
Description: The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a buffer overflow condition in the DHCP relay subsystem of the affected software. An attacker could exploit this vulnerability by sending a crafted DHCP Version 4 (DHCPv4) packet to an affected system. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a DoS condition. Cisco Bug IDs: CSCsm45390, CSCuw77959.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-119
References: http://www.securityfocus.com/bid/101034; http://www.securitytracker.com/id/1039445; https://quickview.cloudapps.cisco.com/quickview/bug/CSCsm45390
CVE: CVE-2017-14507
Published: 2017-09-29
Description: Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpvulndb.com/vulnerabilities/8921; https://www.exploit-db.com/exploits/42794/; https://wpvulndb.com/vulnerabilities/8921
CVE: CVE-2017-14857
Published: 2017-09-29
Description: In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that leads to a Segmentation fault. A crafted input will lead to a denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1495043; https://bugzilla.redhat.com/show_bug.cgi?id=1495043
CVE: CVE-2017-14858
Published: 2017-09-29
Description: There is a heap-based buffer overflow in the Exiv2::l2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494782; https://bugzilla.redhat.com/show_bug.cgi?id=1494782
CVE: CVE-2017-14859
Published: 2017-09-29
Description: An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494780; https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html; https://usn.ubuntu.com/3852-1/
CVE: CVE-2017-14860
Published: 2017-09-29
Description: There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494776; https://bugzilla.redhat.com/show_bug.cgi?id=1494776
CVE: CVE-2017-14861
Published: 2017-09-29
Description: There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-674
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494787; https://bugzilla.redhat.com/show_bug.cgi?id=1494787
CVE: CVE-2017-14862
Published: 2017-09-29
Description: An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494786; https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html; https://usn.ubuntu.com/3852-1/
CVE: CVE-2017-14863
Published: 2017-09-29
Description: A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494443; https://bugzilla.redhat.com/show_bug.cgi?id=1494443
CVE: CVE-2017-14864
Published: 2017-09-29
Description: An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494467; https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html; https://usn.ubuntu.com/3852-1/
CVE: CVE-2017-14865
Published: 2017-09-29
Description: There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494778; https://bugzilla.redhat.com/show_bug.cgi?id=1494778
CVE: CVE-2017-14866
Published: 2017-09-29
Description: There is a heap-based buffer overflow in the Exiv2::s2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1494781; https://bugzilla.redhat.com/show_bug.cgi?id=1494781
CVE: CVE-2017-14867
Published: 2017-09-29
Description: Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2017/09/26/9; http://www.securityfocus.com/bid/101060; http://www.securitytracker.com/id/1039431
CVE: CVE-2017-7552
Published: 2017-09-29
Description: A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be executed as well as created. An attacker could use this flaw to compromise other users or teams projects stored in source control management of the RHMAP Core installation.
CVSS Score: 9.8 (CRITICAL)
References: https://access.redhat.com/errata/RHSA-2017:2674; https://access.redhat.com/errata/RHSA-2017:2675; https://bugzilla.redhat.com/show_bug.cgi?id=1477797
CVE: CVE-2017-7553
Published: 2017-09-29
Description: The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://access.redhat.com/errata/RHSA-2017:2674; https://access.redhat.com/errata/RHSA-2017:2675; https://bugzilla.redhat.com/show_bug.cgi?id=1478792
CVE: CVE-2017-7554
Published: 2017-09-29
Description: It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute a stored XSS attack on an application administrator using App Studio.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2017:2674; https://access.redhat.com/errata/RHSA-2017:2675; https://bugzilla.redhat.com/show_bug.cgi?id=1478770
CVE: CVE-2017-7687
Published: 2017-09-29
Description: When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/101027; https://lists.apache.org/thread.html/2c9ed2b07c2b2831a11d21db3cf8408a71fcf2c300d73ca01bad89df%40%3Cdev.mesos.apache.org%3E; http://www.securityfocus.com/bid/101027
CVE: CVE-2017-8444
Published: 2017-09-29
Description: The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the middle (MITM) the traffic between the client-forwarder and ZooKeeper they could potentially obtain sensitive data.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247; https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247
CVE: CVE-2017-8447
Published: 2017-09-29
Description: An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster, they may be able to issue both delete and index requests against that index.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-269
References: https://discuss.elastic.co/t/x-pack-security-5-6-0-and-5-5-3-security-update/100089; https://discuss.elastic.co/t/x-pack-security-5-6-0-and-5-5-3-security-update/100089
CVE: CVE-2017-8448
Published: 2017-09-29
Description: An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-269
References: https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884; https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884
CVE: CVE-2017-9790
Published: 2017-09-29
Description: When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/101023; https://lists.apache.org/thread.html/cc1e7a69ea78da0511f5b54b6be7aa6e3c78edad5aaff430e7de028b%40%3Cdev.mesos.apache.org%3E; http://www.securityfocus.com/bid/101023
CVE: CVE-2015-9233
Published: 2017-09-30
Description: The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2015/Jul/49; http://seclists.org/oss-sec/2015/q3/88; https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers
CVE: CVE-2015-9234
Published: 2017-09-30
Description: The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2015/Jul/49; http://seclists.org/oss-sec/2015/q3/88; https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers
CVE: CVE-2016-10512
Published: 2017-09-30
Description: MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: https://packetstormsecurity.com/files/139844/Multitech-RightFax-Faxfinder-Credential-Disclosure.html; https://packetstormsecurity.com/files/139844/Multitech-RightFax-Faxfinder-Credential-Disclosure.html
CVE: CVE-2016-4434
Published: 2017-09-30
Description: Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
CVSS Score: 7.8 (HIGH)
CWE: CWE-611
References: http://rhn.redhat.com/errata/RHSA-2017-0248.html; http://rhn.redhat.com/errata/RHSA-2017-0249.html; http://rhn.redhat.com/errata/RHSA-2017-0272.html
CVE: CVE-2017-13684
Published: 2017-09-30
Description: Unisys Libra 64xx and 84xx and FS601 class systems with MCP-FIRMWARE before 43.211 allow remote authenticated users to cause a denial of service (program crash) or have unspecified other impact via vectors related to incorrect literal handling, which trigger CPM stack corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=44; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=44
CVE: CVE-2017-13982
Published: 2017-09-30
Description: A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows users to upload unrestricted files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: http://www.securityfocus.com/bid/101199; http://www.zerodayinitiative.com/advisories/ZDI-17-719/; https://softwaresupport.hpe.com/km/KM02942065
CVE: CVE-2017-13983
Published: 2017-09-30
Description: An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.zerodayinitiative.com/advisories/ZDI-17-722/; https://softwaresupport.hpe.com/km/KM02942065; https://www.auscert.org.au/bulletins/52154
CVE: CVE-2017-13984
Published: 2017-09-30
Description: An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.zerodayinitiative.com/advisories/ZDI-17-720/; https://softwaresupport.hpe.com/km/KM02942065; https://www.auscert.org.au/bulletins/52154
CVE: CVE-2017-13985
Published: 2017-09-30
Description: An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to traverse directory leading to disclosure of information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://zerodayinitiative.com/advisories/ZDI-17-721/; https://softwaresupport.hpe.com/km/KM02942065; https://www.auscert.org.au/bulletins/52154
CVE: CVE-2017-13986
Published: 2017-09-30
Description: A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100935; https://softwaresupport.hpe.com/km/KM02944672; http://www.securityfocus.com/bid/100935
CVE: CVE-2017-13987
Published: 2017-09-30
Description: An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows an unauthorized user to download log files.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/100935; https://softwaresupport.hpe.com/km/KM02944672; http://www.securityfocus.com/bid/100935
CVE: CVE-2017-13988
Published: 2017-09-30
Description: An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to alter the maximum size of storage groups and enable/disable the setting for the 'follow schedule' function.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/100935; https://softwaresupport.hpe.com/km/KM02944672; http://www.securityfocus.com/bid/100935
CVE: CVE-2017-13989
Published: 2017-09-30
Description: An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to retrieve or modify storage information.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/100935; https://softwaresupport.hpe.com/km/KM02944672; http://www.securityfocus.com/bid/100935
CVE: CVE-2017-13990
Published: 2017-09-30
Description: An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of Apache Tomcat application server version.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100935; https://softwaresupport.hpe.com/km/KM02944672; http://www.securityfocus.com/bid/100935
CVE: CVE-2017-13991
Published: 2017-09-30
Description: An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100935; https://softwaresupport.hpe.com/km/KM02944672; http://www.securityfocus.com/bid/100935
CVE: CVE-2017-14349
Published: 2017-09-30
Description: An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://www.securityfocus.com/bid/100989; https://softwaresupport.hpe.com/km/KM02948051; https://www.auscert.org.au/bulletins/52758
CVE: CVE-2017-14350
Published: 2017-09-30
Description: A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, 9.40. The vulnerability could be remotely exploited to allow code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/100988; http://www.zerodayinitiative.com/advisories/ZDI-17-825/; https://softwaresupport.hpe.com/km/KM02960811
CVE: CVE-2017-14351
Published: 2017-09-30
Description: A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabilities could be remotely exploited to allow code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://softwaresupport.hpe.com/km/KM02968622; https://www.tenable.com/security/research/tra-2017-32; https://softwaresupport.hpe.com/km/KM02968622
CVE: CVE-2017-14352
Published: 2017-09-30
Description: A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabilities could be remotely exploited to allow cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101154; https://softwaresupport.hpe.com/km/KM02968622; http://www.securityfocus.com/bid/101154
CVE: CVE-2017-14582
Published: 2017-09-30
Description: The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/101091; https://wwws.nightwatchcybersecurity.com/2017/09/27/zoho-site24x7-mobile-network-poller-for-android-didnt-properly-validate-ssl-cve-2017-14582/; http://www.securityfocus.com/bid/101091