deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-13051
Published: 2017-09-14
Description: The RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvp_obj_print().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13052
Published: 2017-09-14
Description: The CFM parser in tcpdump before 4.9.2 has a buffer over-read in print-cfm.c:cfm_print().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13053
Published: 2017-09-14
Description: The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_rt_routing_info().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13054
Published: 2017-09-14
Description: The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_private_8023_print().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13055
Published: 2017-09-14
Description: The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_is_reach_subtlv().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13687
Published: 2017-09-14
Description: The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13688
Published: 2017-09-14
Description: The OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13689
Published: 2017-09-14
Description: The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13690
Published: 2017-09-14
Description: The IKEv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13725
Published: 2017-09-14
Description: The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3971; http://www.securitytracker.com/id/1039307; http://www.tcpdump.org/tcpdump-changes.txt
CVE: CVE-2017-13779
Published: 2017-09-14
Description: GSTN_offline_tool in India Goods and Services Tax Network (GSTN) Offline Utility tool before 1.2 executes winstart-server.vbs from the "C:\GST Offline Tool" directory, which has insecure permissions. This allows local users to gain privileges by replacing winstart-server.vbs with arbitrary VBScript code. For example, a local user could create VBScript code for a TCP reverse shell, and use that later for Remote Command Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://tink2hack.blogspot.in/2017/09/writeup-of-cve-2017-13779-remote.html; https://tink2hack.blogspot.in/2017/09/writeup-of-cve-2017-13779-remote.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/96899; http://www.securityfocus.com/bid/96905; http://www.vapidlabs.com/advisory.php?v=179
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.vapidlabs.com/advisory.php?v=180; https://wordpress.org/plugins-wp/mobile-app-builder-by-wappress/; https://www.exploit-db.com/exploits/41540/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/96906; http://www.vapidlabs.com/advisory.php?v=181; https://wordpress.org/plugins-wp/webapp-builder/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/96908; http://www.vapidlabs.com/advisory.php?v=182; https://wordpress.org/plugins-wp/wp2android-turn-wp-site-into-android-app/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96781; http://www.vapidlabs.com/advisory.php?v=183; https://wordpress.org/plugins/dtracker/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96781; http://www.vapidlabs.com/advisory.php?v=183; https://wordpress.org/plugins/dtracker/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/96890; http://www.vapidlabs.com/advisory.php?v=186; https://wordpress.org/plugins/dtracker/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/96890; http://www.vapidlabs.com/advisory.php?v=186; https://wordpress.org/plugins/dtracker/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.vapidlabs.com/advisory.php?v=187; https://wordpress.org/plugins/membership-simplified-for-oap-members-only; https://wpvulndb.com/vulnerabilities/8777
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://membership.officeautopilot.com/get-it-now/; http://www.vapidlabs.com/advisory.php?v=188; http://membership.officeautopilot.com/get-it-now/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://membership.officeautopilot.com/get-it-now/; http://www.vapidlabs.com/advisory.php?v=188; http://membership.officeautopilot.com/get-it-now/
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.vapidlabs.com/advisory.php?v=189; https://wordpress.org/plugins/image-gallery-with-slideshow/; http://www.vapidlabs.com/advisory.php?v=189
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=189; https://wordpress.org/plugins/image-gallery-with-slideshow/; http://www.vapidlabs.com/advisory.php?v=189
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=189; https://wordpress.org/plugins/image-gallery-with-slideshow/; http://www.vapidlabs.com/advisory.php?v=189
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=189; https://wordpress.org/plugins/image-gallery-with-slideshow/; http://www.vapidlabs.com/advisory.php?v=189
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=189; https://wordpress.org/plugins/image-gallery-with-slideshow/; http://www.vapidlabs.com/advisory.php?v=189
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.vapidlabs.com/advisory.php?v=190; https://wordpress.org/plugins/flickr-picture-backup/; http://www.vapidlabs.com/advisory.php?v=190
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.vapidlabs.com/advisory.php?v=191; https://wordpress.org/plugins/gift-certificate-creator/; http://www.vapidlabs.com/advisory.php?v=191
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=192; https://wordpress.org/plugins/eventr/; http://www.vapidlabs.com/advisory.php?v=192
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=192; https://wordpress.org/plugins/eventr/; http://www.vapidlabs.com/advisory.php?v=192
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=193; https://wordpress.org/plugins/surveys/; https://wpvulndb.com/vulnerabilities/8833
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=193; https://wordpress.org/plugins/surveys/; https://wpvulndb.com/vulnerabilities/8833
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=193; https://wordpress.org/plugins/surveys/; https://wpvulndb.com/vulnerabilities/8833
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=194; https://wordpress.org/plugins/easy-team-manager/; http://www.vapidlabs.com/advisory.php?v=194
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upload files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://kindeditor.org; http://www.vapidlabs.com/advisory.php?v=195; https://github.com/kindsoft/kindeditor
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=196; https://wordpress.org/plugins/add-edit-delete-listing-for-member-module/; http://www.vapidlabs.com/advisory.php?v=196
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=197; https://wordpress.org/plugins/event-espresso-free/; http://www.vapidlabs.com/advisory.php?v=197
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=198; https://wordpress.org/plugins/rk-responsive-contact-form/; https://wpvulndb.com/vulnerabilities/8889
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapidlabs.com/advisory.php?v=199; https://wordpress.org/plugins/wordpress-gallery-transformation/; https://wpvulndb.com/vulnerabilities/8888
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/kubernetes/kubernetes/issues/47611; https://groups.google.com/d/msg/kubernetes-security-announce/n3VBg_WJZic/-ddIqKXqAAAJ; https://github.com/kubernetes/kubernetes/issues/47611
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/fedora-infra/python-fedora/commit/b27f38a67573f4c989710c9bfb726dd4c1eeb929; https://github.com/fedora-infra/python-fedora/commit/b27f38a67573f4c989710c9bfb726dd4c1eeb929.patch; https://github.com/fedora-infra/python-fedora/commit/b27f38a67573f4c989710c9bfb726dd4c1eeb929
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-14
Description: Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization
CVSS Score: 7.5 (HIGH)
CWE: CWE-285, CWE-862
References: https://pagure.io/pagure/c/c92108097e8ae4702c115ae4702b63d960838e75.patch; https://pagure.io/pagure/pull-request/2426; https://pagure.io/pagure/c/c92108097e8ae4702c115ae4702b63d960838e75.patch
CVE: CVE-2017-1490
Published: 2017-09-14
Description: An unspecified vulnerability in the Lifecycle Query Engine of Jazz Reporting Service 6.0 through 6.0.4 could disclose highly sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22008253; http://www.securityfocus.com/bid/100835; https://exchange.xforce.ibmcloud.com/vulnerabilities/128688
CVE: CVE-2017-13067
Published: 2017-09-14
Description: QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.
CVSS Score: 9.8 (CRITICAL)
References: https://www.qnap.com/zh-hk/releasenotes/; https://www.qnap.com/zh-hk/releasenotes/
CVE: CVE-2017-14113
Published: 2017-09-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-13067.  Reason: This candidate is a reservation duplicate of CVE-2017-13067.  Notes: All CVE users should reference CVE-2017-13067 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-7429
Published: 2017-09-14
Description: The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-91
References: http://seclists.org/fulldisclosure/2013/Jul/158; http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.html; http://www.openwall.com/lists/oss-security/2015/02/26/11
CVE: CVE-2015-7553
Published: 2017-09-14
Description: Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1288934; https://bugzilla.redhat.com/show_bug.cgi?id=1288934
CVE: CVE-2017-14482
Published: 2017-09-14
Description: GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
CVSS Score: 8.8 (HIGH)
References: http://www.debian.org/security/2017/dsa-3975; http://www.openwall.com/lists/oss-security/2017/09/11/1; https://access.redhat.com/errata/RHSA-2017:2771
CVE: CVE-2017-13761
Published: 2017-09-14
Description: The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.fastly.com/security-advisories/vulnerability-fastly-open-source-cdn-module-intended-be-integrated-magento2; https://www.fastly.com/security-advisories/vulnerability-fastly-open-source-cdn-module-intended-be-integrated-magento2
CVE: CVE-2017-0781
Published: 2017-09-14
Description: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146105.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/100810; https://source.android.com/security/bulletin/2017-09-01
CVE: CVE-2017-0782
Published: 2017-09-14
Description: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146237.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/100822; https://source.android.com/security/bulletin/2017-09-01
CVE: CVE-2017-0783
Published: 2017-09-14
Description: A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63145701.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/100811; https://source.android.com/security/bulletin/2017-09-01
CVE: CVE-2017-0785
Published: 2017-09-14
Description: A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146698.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/100812