deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-0959
Published: 2017-06-27
Description: Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe Flash Player for Google Chrome before 20.0.0.267, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 before 20.0.0.267, Adobe Flash Player for Internet Explorer 10 and 11 before 20.0.0.267, Adobe Flash Player for Linux before 11.2.202.559, AIR Desktop Runtime before 20.0.0.233, AIR SDK before 20.0.0.233, AIR SDK & Compiler before 20.0.0.233, AIR for Android before 20.0.0.233.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2015-2697.html; https://bugzilla.redhat.com/show_bug.cgi?id=1294580; https://helpx.adobe.com/security/products/flash-player/apsb16-01.html
CVE: CVE-2016-4383
Published: 2017-06-27
Description: The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/93106; https://bugs.launchpad.net/glance/+bug/1593799/; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05273584
CVE: CVE-2016-5414
Published: 2017-06-27
Description: FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/attachment.cgi?id=1184610; https://bugzilla.redhat.com/show_bug.cgi?id=1360757; https://bugzilla.redhat.com/attachment.cgi?id=1184610
CVE: CVE-2016-6342
Published: 2017-06-27
Description: elog 3.1.1 allows remote attackers to post data as any username in the logbook.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1371328; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ZQOPXSMJAJIXH5MRPQS2ZISYJPSLQK/; https://bugzilla.redhat.com/show_bug.cgi?id=1371328
CVE: CVE-2016-7062
Published: 2017-06-27
Description: rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as cleartext.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.securityfocus.com/bid/93796; http://www.securitytracker.com/id/1037062; https://access.redhat.com/errata/RHSA-2016:2082
CVE: CVE-2017-2491
Published: 2017-06-27
Description: Use after free vulnerability in the String.replace method JavaScriptCore in Apple Safari in iOS before 10.3 allows remote attackers to execute arbitrary code via a crafted web page, or a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98316; http://www.zerodayinitiative.com/advisories/ZDI-17-321; https://support.apple.com/en-us/HT207617
CVE: CVE-2017-6086
Published: 2017-06-27
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (2) remove an administrator user via a crafted GET request to <vimbadmin directory>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (4) add a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (5) delete a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (6) archive a mailbox address via a crafted GET request to <vimbadmin directory>/application/controllers/ArchiveController.php, (7) add an alias address via a crafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address via a crafted GET request to <vimbadmin directory>/application/controllers/AliasController.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2017/05/03/7; https://www.exploit-db.com/exploits/41967/; http://www.openwall.com/lists/oss-security/2017/05/03/7
CVE: CVE-2017-9445
Published: 2017-06-28
Description: In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://openwall.com/lists/oss-security/2017/06/27/8; http://www.securityfocus.com/bid/99302; http://www.securitytracker.com/id/1038806
CVE: CVE-2017-9984
Published: 2017-06-28
Description: The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=20e2b791796bd68816fa115f12be5320de2b8021; http://www.securityfocus.com/bid/99314; https://bugzilla.kernel.org/show_bug.cgi?id=196131
CVE: CVE-2017-9985
Published: 2017-06-28
Description: The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=20e2b791796bd68816fa115f12be5320de2b8021; http://www.securityfocus.com/bid/99335; https://bugzilla.kernel.org/show_bug.cgi?id=196133
CVE: CVE-2017-9986
Published: 2017-06-28
Description: The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/99336; https://bugzilla.kernel.org/show_bug.cgi?id=196135; http://www.securityfocus.com/bid/99336
CVE: CVE-2017-9987
Published: 2017-06-28
Description: There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input can lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://bugzilla.libav.org/show_bug.cgi?id=1067; https://lists.debian.org/debian-lts-announce/2019/09/msg00000.html; https://bugzilla.libav.org/show_bug.cgi?id=1067
CVE: CVE-2017-9988
Published: 2017-06-28
Description: The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/libming/libming/issues/85; https://lists.debian.org/debian-lts-announce/2017/11/msg00022.html; https://security.gentoo.org/glsa/201904-24
CVE: CVE-2017-9989
Published: 2017-06-28
Description: util/outputtxt.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/libming/libming/issues/86; https://lists.debian.org/debian-lts-announce/2017/11/msg00022.html; https://security.gentoo.org/glsa/201904-24
CVE: CVE-2017-9990
Published: 2017-06-28
Description: Stack-based buffer overflow in the color_string_to_rgba function in libavcodec/xpmdec.c in FFmpeg 3.3 before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99313; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1466; https://github.com/FFmpeg/FFmpeg/commit/cb243972b121b1ae6b60a78ff55a0506c69f3879
CVE: CVE-2017-9991
Published: 2017-06-28
Description: Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99316; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1399; https://github.com/FFmpeg/FFmpeg/commit/441026fcb13ac23aa10edc312bdacb6445a0ad06
CVE: CVE-2017-9992
Published: 2017-06-28
Description: Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-4012; http://www.securityfocus.com/bid/99319; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1345
CVE: CVE-2017-9993
Published: 2017-06-28
Description: FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.debian.org/security/2017/dsa-3957; http://www.securityfocus.com/bid/99315; https://github.com/FFmpeg/FFmpeg/commit/189ff[PII_REDACTED]bdfa7bab28dfedaee4d6d4021
CVE: CVE-2017-9994
Published: 2017-06-28
Description: libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file, related to the vp8_decode_mb_row_no_filter and pred8x8_128_dc_8_c functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99317; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1434; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1435
CVE: CVE-2017-9995
Published: 2017-06-28
Description: libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99320; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1478; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1519
CVE: CVE-2017-9996
Published: 2017-06-28
Description: The cdxl_decode_frame function in libavcodec/cdxl.c in FFmpeg 2.8.x before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not exclude the CHUNKY format, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99323; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1378; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1427
CVE: CVE-2017-9998
Published: 2017-06-28
Description: The _dwarf_decode_s_leb128_chk function in dwarf_leb.c in libdwarf through 2017-06-28 allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99310; https://bugzilla.redhat.com/show_bug.cgi?id=1465756; http://www.securityfocus.com/bid/99310
CVE: CVE-2017-5241
Published: 2017-06-28
Description: Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024 are vulnerable to post-authentication persistent cross-site scripting (XSS) in the "Name" and "Description" fields of a Workspace, as well as the "Description" field of a File Details pane of a file stored in a Workspace. This issue has been resolved in version 5.1.1025.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99341; https://community.rapid7.com/community/infosec/blog/2017/06/27/r7-2017-06-biscom-sftp-xss-cve-2017-5241; https://cve.biscom.com/bis-sft-cv-003/
CVE: CVE-2017-7686
Published: 2017-06-28
Description: Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2017-7686-Apache-Ignite-Information-Disclosure-td19168.html; http://www.securityfocus.com/bid/99292; http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2017-7686-Apache-Ignite-Information-Disclosure-td19168.html
CVE: CVE-2017-1106
Published: 2017-06-28
Description: IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120744.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004580; http://www.securityfocus.com/bid/99306; https://exchange.xforce.ibmcloud.com/vulnerabilities/120744
CVE: CVE-2016-10042
Published: 2017-06-29
Description: Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized reconfiguration of the static routing table via an unauthenticated HTTP request, leading to denial of service and information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2016-10042.txt; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2016-10042.txt
CVE: CVE-2017-10667
Published: 2017-06-29
Description: In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zencart/zencart/issues/1443; https://github.com/zhonghaozhao/zencart/issues/1; https://github.com/zencart/zencart/issues/1443
CVE: CVE-2017-10671
Published: 2017-06-29
Description: Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted filename.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2017/06/15/9; https://github.com/blueness/sthttpd/commit/c0dc63a49d8605649f1d8e4a96c9b468b0bff660; https://github.com/blueness/sthttpd/releases/tag/v2.27.1
CVE: CVE-2017-10672
Published: 2017-06-29
Description: Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://lists.debian.org/debian-lts-announce/2017/11/msg00017.html; https://rt.cpan.org/Public/Bug/Display.html?id=122246; https://www.debian.org/security/2017/dsa-4042
CVE: CVE-2017-10673
Published: 2017-06-29
Description: admin/profile.php in GetSimple CMS 3.x has XSS in a name field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1234; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1234
CVE: CVE-2017-1310
Published: 2017-06-29
Description: IBM Informix Dynamic Server 12.1 could allow an authenticated user to cause a buffer overflow that would write large assertion fail files to the server. Done enough times, this could use large parts of the file system and cause the server to crash. IBM X-Force ID: 125569.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=swg22004930; http://www.securityfocus.com/bid/99309; http://www.securitytracker.com/id/1038803
CVE: CVE-2017-8554
Published: 2017-06-29
Description: The kernel in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an authenticated attacker to obtain memory contents via a specially crafted application.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98942; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8554; http://www.securityfocus.com/bid/98942
CVE: CVE-2017-8558
Published: 2017-06-29
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703 does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99262; http://www.securitytracker.com/id/1038783; http://www.securitytracker.com/id/1038784
CVE: CVE-2017-8575
Published: 2017-06-29
Description: The kernel in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application, aka "Microsoft Graphics Component Information Disclosure Vulnerability."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99215; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8575; http://www.securityfocus.com/bid/99215
CVE: CVE-2017-8576
Published: 2017-06-29
Description: The graphics component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application, aka "Microsoft Graphics Component Elevation of Privilege Vulnerability."
CVSS Score: 7.0 (HIGH)
CWE: CWE-665
References: http://www.securityfocus.com/bid/99210; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8576; http://www.securityfocus.com/bid/99210
CVE: CVE-2017-8579
Published: 2017-06-29
Description: The DirectX component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application, aka "DirectX Elevation of Privilege Vulnerability."
CVSS Score: 7.0 (HIGH)
CWE: CWE-281
References: http://www.securityfocus.com/bid/99212; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8579; http://www.securityfocus.com/bid/99212
CVE: CVE-2017-8613
Published: 2017-06-29
Description: Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: http://www.securityfocus.com/bid/99294; https://technet.microsoft.com/library/security/4033453; http://www.securityfocus.com/bid/99294
CVE: CVE-2017-5528
Published: 2017-06-29
Description: Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.  The impact of this vulnerability includes the theoretical disclosure of sensitive information.  Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017; https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017
CVE: CVE-2017-5529
Published: 2017-06-29
Description: JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; https://www.oracle.com/security-alerts/cpuapr2020.html
CVE: CVE-2017-3747
Published: 2017-06-29
Description: Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not affected) that could allow an attacker with local privileges on a system to alter registry keys.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/99286; https://support.lenovo.com/us/en/product_security/LEN-15046; http://www.securityfocus.com/bid/99286
CVE: CVE-2017-3748
Published: 2017-06-29
Description: On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user (commonly known as 'rooting' or "jail breaking" a device).
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/99295; https://support.lenovo.com/us/en/product_security/LEN-15823; http://www.securityfocus.com/bid/99295
CVE: CVE-2017-3749
Published: 2017-06-29
Description: On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750.
CVSS Score: 6.4 (MEDIUM)
References: https://support.lenovo.com/us/en/product_security/LEN-15823; https://support.lenovo.com/us/en/product_security/LEN-15823