deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0795
Published: 2018-01-10
Description: Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Remote Code Execution Vulnerability".
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102356; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0795
CVE: CVE-2018-0796
Published: 2018-01-10
Description: Microsoft Excel in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Excel Remote Code Execution Vulnerability".
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102372; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0796
CVE: CVE-2018-0797
Published: 2018-01-10
Description: Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF content is handled, aka "Microsoft Word Memory Corruption Vulnerability".
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102406; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0797
CVE: CVE-2018-0798
Published: 2018-01-10
Description: Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/102370; http://www.securitytracker.com/id/1040153; https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html
CVE: CVE-2018-0799
Published: 2018-01-10
Description: Microsoft Access in Microsoft SharePoint Enterprise Server 2013 and Microsoft SharePoint Enterprise Server 2016 allows a cross-site-scripting (XSS) vulnerability due to the way image field values are handled, aka "Microsoft Access Tampering Vulnerability".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102411; http://www.securitytracker.com/id/1040157; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0799
CVE: CVE-2018-0801
Published: 2018-01-10
Description: Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Remote Code Execution Vulnerability".
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102348; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0801
CVE: CVE-2018-0802
Published: 2018-01-10
Description: Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/102347; http://www.securitytracker.com/id/1040153; https://0patch.blogspot.com/2018/01/the-bug-that-killed-equation-editor-how.html
CVE: CVE-2018-0804
Published: 2018-01-10
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102457; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0804
CVE: CVE-2018-0805
Published: 2018-01-10
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0804, CVE-2018-0806, and CVE-2018-0807
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102459; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0805
CVE: CVE-2018-0806
Published: 2018-01-10
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0804, CVE-2018-0805, and CVE-2018-0807.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102460; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0806
CVE: CVE-2018-0807
Published: 2018-01-10
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0804, CVE-2018-0805, and CVE-2018-0806.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/102461; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0807
CVE: CVE-2018-0812
Published: 2018-01-10
Description: Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Memory Corruption Vulnerability".
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102463; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0812
CVE: CVE-2018-0818
Published: 2018-01-10
Description: Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka "Scripting Engine Security Feature Bypass".
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/102412; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0818; http://www.securityfocus.com/bid/102412
CVE: CVE-2018-0819
Published: 2018-01-10
Description: Microsoft Office 2016 for Mac allows an attacker to send a specially crafted email attachment to a user in an attempt to launch a social engineering attack, such as phishing, due to how Outlook for Mac displays encoded email addresses, aka "Spoofing Vulnerability in Microsoft Office for Mac."
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/102464; http://www.securitytracker.com/id/1040153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0819
CVE: CVE-2016-10256
Published: 2018-01-10
Description: The Symantec ProxySG 6.5 (prior to 6.5.10.6), 6.6, and 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to inject arbitrary JavaScript code into the management console web client application. This is a separate vulnerability from CVE-2016-10257.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102451; http://www.securitytracker.com/id/1040138; https://www.symantec.com/security-center/network-protection-security-advisories/SA155
CVE: CVE-2016-10257
Published: 2018-01-10
Description: The Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 (prior to 6.7.2.1), ProxySG 6.5 (prior to 6.5.10.6), ProxySG 6.6, and ProxySG 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to inject arbitrary JavaScript code into the management console web client application. This is a separate vulnerability from CVE-2016-10256.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102447; http://www.securitytracker.com/id/1040138; https://www.symantec.com/security-center/network-protection-security-advisories/SA155
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-10
Description: flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatCore/flatCore-CMS/issues/35; https://github.com/flatCore/flatCore-CMS/issues/35
CVE: CVE-2017-12622
Published: 2018-01-10
Description: When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: https://lists.apache.org/thread.html/560578479dabbdc93d0ee8746b7c857549202ef82f43aa22496aa589%40%3Cuser.geode.apache.org%3E; https://lists.apache.org/thread.html/560578479dabbdc93d0ee8746b7c857549202ef82f43aa22496aa589%40%3Cuser.geode.apache.org%3E
CVE: CVE-2017-9795
Published: 2018-01-10
Description: When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102488; https://lists.apache.org/thread.html/0fc5ea3c1ea06fe7058a0ab56d593914b05f728a6c93c5a6755956c7%40%3Cuser.geode.apache.org%3E; https://lists.apache.org/thread.html/232d[PII_REDACTED]0d2fe6ba6bd4265fb58b4fe4d9d8d62eb2fd97256c%40%3Cdev.geode.apache.org%3E
CVE: CVE-2017-9796
Published: 2018-01-10
Description: When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://lists.apache.org/thread.html/e580d22195b6b61ff9cf866ac6dd6fe16e790ff0e14a3b1a22cd20b1%40%3Cuser.geode.apache.org%3E; https://lists.apache.org/thread.html/e580d22195b6b61ff9cf866ac6dd6fe16e790ff0e14a3b1a22cd20b1%40%3Cuser.geode.apache.org%3E
CVE: CVE-2017-18026
Published: 2018-01-10
Description: Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.
CVSS Score: 8.8 (HIGH)
References: https://github.com/redmine/redmine/commit/58ed8655136ff2fe5ff7796859bf6a399c76c678; https://github.com/redmine/redmine/commit/9d797400eaec5f9fa7ba9507c82d9c18cb91d02e; https://github.com/redmine/redmine/commit/ca87bf766cdc70179cb2dce03015d78ec9c13ebd
CVE: CVE-2018-5331
Published: 2018-01-10
Description: Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php, as demonstrated by a mod=space do=poll request to home.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.whsgwl.net/text.php?textid=32; http://www.whsgwl.net/text.php?textid=32
CVE: CVE-2017-15704
Published: 2018-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-15717
Published: 2018-01-10
Description: A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://s.apache.org/CVE-2017-15717; https://s.apache.org/CVE-2017-15717
CVE: CVE-2016-6810
Published: 2018-01-10
Description: In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://activemq.apache.org/security-advisories.data/CVE-2016-6810-announcement.txt; http://www.securityfocus.com/bid/94882; http://www.securitytracker.com/id/1037475
CVE: CVE-2017-12169
Published: 2018-01-10
Description: It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in disclosure of password hashes belonging to active standard users. NOTE: some developers feel that this report is a suggestion for a design change to Stage User activation, not a statement of a vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/102136; https://bugzilla.redhat.com/show_bug.cgi?id=1487697; http://www.securityfocus.com/bid/102136
CVE: CVE-2017-7536
Published: 2018-01-10
Description: In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
CVSS Score: 7.0 (HIGH)
CWE: CWE-592, CWE-470
References: http://www.securityfocus.com/bid/101048; http://www.securitytracker.com/id/1039744; https://access.redhat.com/errata/RHSA-2017:2808
CVE: CVE-2017-7559
Published: 2018-01-10
Description: In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://access.redhat.com/errata/RHSA-2017:3454; https://access.redhat.com/errata/RHSA-2017:3455; https://access.redhat.com/errata/RHSA-2017:3456
CVE: CVE-2016-9722
Published: 2018-01-10
Description: IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 119737.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg22012293; https://exchange.xforce.ibmcloud.com/vulnerabilities/119737; https://www.exploit-db.com/exploits/45005/
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-14601.  Reason: This candidate is a reservation duplicate of CVE-2017-14601.  Notes: All CVE users should reference CVE-2017-14601 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2018-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-14931.  Reason: This candidate is a reservation duplicate of CVE-2017-14931.  Notes: All CVE users should reference CVE-2017-14931 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-1459
Published: 2018-01-10
Description: IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 128378.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-732
References: http://www.ibm.com/support/docview.wss?uid=swg22012331; http://www.securitytracker.com/id/1040170; https://exchange.xforce.ibmcloud.com/vulnerabilities/128378
CVE: CVE-2017-1533
Published: 2018-01-10
Description: IBM Security Access Manager Appliance 9.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130675.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012327; http://www.securityfocus.com/bid/102496; http://www.securitytracker.com/id/1040168
CVE: CVE-2017-1534
Published: 2018-01-10
Description: IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 130676.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22008936; http://www.securityfocus.com/bid/102509; http://www.securitytracker.com/id/1040169
CVE: CVE-2017-1623
Published: 2018-01-10
Description: IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133121.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012344; http://www.securityfocus.com/bid/102476; https://exchange.xforce.ibmcloud.com/vulnerabilities/133121
CVE: CVE-2017-16514
Published: 2018-01-10
Description: Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (Site Title) in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/anonymous/13df19c04c7e86c0f5256b91376d593a; https://gist.github.com/anonymous/13df19c04c7e86c0f5256b91376d593a
CVE: CVE-2014-4991
Published: 2018-01-10
Description: (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/07/8; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.securityfocus.com/bid/68733
CVE: CVE-2014-4992
Published: 2018-01-10
Description: lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/07/9; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.vapid.dhs.org/advisories/cap-strap-0.1.5.html
CVE: CVE-2014-4993
Published: 2018-01-10
Description: (1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/07/11; http://www.openwall.com/lists/oss-security/2014/07/07/12; http://www.openwall.com/lists/oss-security/2014/07/17/5
CVE: CVE-2014-4994
Published: 2018-01-10
Description: lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/07/07/13; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.vapid.dhs.org/advisories/gyazo-1.0.0.html
CVE: CVE-2014-4995
Published: 2018-01-10
Description: Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.
CVSS Score: 7.0 (HIGH)
CWE: CWE-200, CWE-362
References: http://www.openwall.com/lists/oss-security/2014/07/07/14; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.securityfocus.com/bid/68729
CVE: CVE-2014-4996
Published: 2018-01-10
Description: lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.#{target_host}.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2014/07/07/14; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.securityfocus.com/bid/68731
CVE: CVE-2014-4997
Published: 2018-01-10
Description: lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/07/16; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.securityfocus.com/bid/68735
CVE: CVE-2014-4998
Published: 2018-01-10
Description: test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/07/07/18; http://www.openwall.com/lists/oss-security/2014/07/17/5; http://www.vapid.dhs.org/advisories/lean-ruport-0.3.8.html