deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6029
Published: 2017-05-06
Description: A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/97479; https://ics-cert.us-cert.gov/advisories/ICSA-17-096-01A; http://www.securityfocus.com/bid/97479
CVE: CVE-2017-6031
Published: 2017-05-06
Description: A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-644, CWE-74
References: http://www.securityfocus.com/bid/97479; https://ics-cert.us-cert.gov/advisories/ICSA-17-096-01A; http://www.securityfocus.com/bid/97479
CVE: CVE-2017-7909
Published: 2017-05-06
Description: A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScript to check client authentication and redirect unauthorized users. Attackers may intercept requests and bypass authentication to access restricted web pages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-603, CWE-287
References: http://www.securityfocus.com/bid/98257; https://ics-cert.us-cert.gov/advisories/ICSA-17-122-03; http://www.securityfocus.com/bid/98257
CVE: CVE-2017-7911
Published: 2017-05-06
Description: A Code Injection issue was discovered in CyberVision Kaa IoT Platform, Version 0.7.4. An insufficient-encapsulation vulnerability has been identified, which may allow remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-485, CWE-94
References: http://www.securityfocus.com/bid/98256; https://ics-cert.us-cert.gov/advisories/ICSA-17-122-02; https://www.tenable.com/security/research/tra-2017-19
CVE: CVE-2017-7921
Published: 2017-05-06
Description: An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.hikvision.com/us/about_10805.html; http://www.securityfocus.com/bid/98313; https://ghostbin.com/paste/q2vq2
CVE: CVE-2017-7923
Published: 2017-05-06
Description: A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The password in configuration file vulnerability could allow a malicious user to escalate privileges or assume the identity of another user and access sensitive information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-260, CWE-200
References: http://www.hikvision.com/us/about_10807.html; http://www.securityfocus.com/bid/98313; https://ghostbin.com/paste/q2vq2
CVE: CVE-2017-7925
Published: 2017-05-06
Description: A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-260, CWE-522
References: http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php; http://www.securityfocus.com/bid/98312; https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02
CVE: CVE-2017-7927
Published: 2017-05-06
Description: A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The use of password hash instead of password for authentication vulnerability was identified, which could allow a malicious user to bypass authentication without obtaining the actual password.
CVSS Score: 7.3 (HIGH)
CWE: CWE-836, CWE-798
References: http://us.dahuasecurity.com/en/us/Security-Bulletin_030617.php; http://www.securityfocus.com/bid/98312; https://ics-cert.us-cert.gov/advisories/ICSA-17-124-02
CVE: CVE-2017-7929
Published: 2017-05-06
Description: An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an attacker to traverse the file system to access restricted files or directories.
CVSS Score: 7.1 (HIGH)
CWE: CWE-36, CWE-22
References: http://www.securityfocus.com/bid/98311; https://ics-cert.us-cert.gov/advisories/ICSA-17-124-03; http://www.securityfocus.com/bid/98311
CVE: CVE-2017-8391
Published: 2017-05-06
Description: The OS Installation Management component in CA Client Automation r12.9, r14.0, and r14.0 SP1 places an encrypted password into a readable local file during operating system installation, which allows local users to obtain sensitive information by reading this file after operating system installation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/98344; http://www.securitytracker.com/id/1038410; https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20170504-01-security-notice-for-ca-client-automation-os-installation-mgmt.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9847.  Reason: This candidate is a reservation duplicate of CVE-2016-9847.  Notes: All CVE users should reference CVE-2016-9847 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9848.  Reason: This candidate is a reservation duplicate of CVE-2016-9848.  Notes: All CVE users should reference CVE-2016-9848 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9849.  Reason: This candidate is a reservation duplicate of CVE-2016-9849.  Notes: All CVE users should reference CVE-2016-9849 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9850.  Reason: This candidate is a reservation duplicate of CVE-2016-9850.  Notes: All CVE users should reference CVE-2016-9850 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9851.  Reason: This candidate is a reservation duplicate of CVE-2016-9851.  Notes: All CVE users should reference CVE-2016-9851 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, CVE-2016-9855.  Reason: This candidate is a reservation duplicate of CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, and CVE-2016-9855.  Notes: All CVE users should reference CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, and/or CVE-2016-9855 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9856, CVE-2016-9857.  Reason: This candidate is a reservation duplicate of CVE-2016-9856 and CVE-2016-9857.  Notes: All CVE users should reference CVE-2016-9856 and/or CVE-2016-9857 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9858, CVE-2016-9859, CVE-2016-9860.  Reason: This candidate is a reservation duplicate of CVE-2016-9858, CVE-2016-9859, and CVE-2016-9860.  Notes: All CVE users should reference CVE-2016-9858, CVE-2016-9859, and/or CVE-2016-9860 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9861.  Reason: This candidate is a reservation duplicate of CVE-2016-9861.  Notes: All CVE users should reference CVE-2016-9861 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9862.  Reason: This candidate is a reservation duplicate of CVE-2016-9862.  Notes: All CVE users should reference CVE-2016-9862 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9863.  Reason: This candidate is a reservation duplicate of CVE-2016-9863.  Notes: All CVE users should reference CVE-2016-9863 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9864.  Reason: This candidate is a reservation duplicate of CVE-2016-9864.  Notes: All CVE users should reference CVE-2016-9864 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9865.  Reason: This candidate is a reservation duplicate of CVE-2016-9865.  Notes: All CVE users should reference CVE-2016-9865 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-9866.  Reason: This candidate is a reservation duplicate of CVE-2016-9866.  Notes: All CVE users should reference CVE-2016-9866 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-8784
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-7263.  Reason: This candidate is a reservation duplicate of CVE-2017-7263.  Notes: All CVE users should reference CVE-2017-7263 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-8804
Published: 2017-05-07
Description: The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00049.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-10220. Reason: This candidate is a reservation duplicate of CVE-2016-10220. Notes: All CVE users should reference CVE-2016-10220 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-5938.  Reason: This candidate is a reservation duplicate of CVE-2017-5938.  Notes: All CVE users should reference CVE-2017-5938 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-7853.  Reason: This candidate is a reservation duplicate of CVE-2017-7853.  Notes: All CVE users should reference CVE-2017-7853 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2017-05-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-7271.  Reason: This candidate is a reservation duplicate of CVE-2017-7271.  Notes: All CVE users should reference CVE-2017-7271 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-8827
Published: 2017-05-08
Description: forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct Arbitrary User Password Reset attacks via a series of requests.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/semplon/GeniXCMS/issues/75; https://github.com/semplon/GeniXCMS/issues/75
CVE: CVE-2017-8829
Published: 2017-05-08
Description: Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted YAML file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://bugs.debian.org/861958; https://bugs.debian.org/861958
CVE: CVE-2017-8830
Published: 2017-05-08
Description: In ImageMagick 7.0.5-6, the ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98687; https://github.com/ImageMagick/ImageMagick/issues/467
CVE: CVE-2017-8831
Published: 2017-05-08
Description: The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/archive/1/540770/30/0/threaded; http://www.securityfocus.com/bid/99619; https://bugzilla.kernel.org/show_bug.cgi?id=195559
CVE: CVE-2017-8832
Published: 2017-05-08
Description: Allen Disk 1.6 has XSS in the id parameter to downfile.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/s3131212/allendisk/commit/37b6a63b85d5ab3ed81141cadc47489d7571664b; https://github.com/s3131212/allendisk/commit/37b6a63b85d5ab3ed81141cadc47489d7571664b
CVE: CVE-2017-8833
Published: 2017-05-08
Description: Zen Cart 1.6.0 has XSS in the main_page parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zencart/zencart/issues/1431; https://github.com/zencart/zencart/issues/1431
CVE: CVE-2017-8842
Published: 2017-05-08
Description: The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://blogs.gentoo.org/ago/2017/05/07/lrzip-divide-by-zero-in-bufreadget-libzpaq-h/; https://github.com/ckolivas/lrzip/issues/66; https://security.gentoo.org/glsa/202005-01
CVE: CVE-2017-8843
Published: 2017-05-08
Description: The join_pthread function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/05/07/lrzip-null-pointer-dereference-in-join_pthread-stream-c/; https://github.com/ckolivas/lrzip/issues/69; https://security.gentoo.org/glsa/202005-01
CVE: CVE-2017-8844
Published: 2017-05-08
Description: The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/05/07/lrzip-heap-based-buffer-overflow-write-in-read_1g-stream-c/; https://github.com/ckolivas/lrzip/issues/70; https://lists.debian.org/debian-lts-announce/2021/08/msg00001.html
CVE: CVE-2017-8845
Published: 2017-05-08
Description: The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/05/07/lrzip-invalid-memory-read-in-lzo_decompress_buf-stream-c/; https://github.com/ckolivas/lrzip/issues/68; https://security.gentoo.org/glsa/202005-01
CVE: CVE-2017-8846
Published: 2017-05-08
Description: The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://blogs.gentoo.org/ago/2017/05/07/lrzip-use-after-free-in-read_stream-stream-c/; https://github.com/ckolivas/lrzip/issues/71; https://lists.debian.org/debian-lts-announce/2021/08/msg00001.html
CVE: CVE-2017-8847
Published: 2017-05-08
Description: The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/05/07/lrzip-null-pointer-dereference-in-bufreadget-libzpaq-h/; https://github.com/ckolivas/lrzip/issues/67; https://security.gentoo.org/glsa/202005-01
CVE: CVE-2017-8825
Published: 2017-05-08
Description: A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/dinhviethoa/libetpan/commit/1fe8fbc032ccda1db9af66d93016b49c16c1f22d; https://github.com/dinhviethoa/libetpan/issues/274; https://github.com/dinhviethoa/libetpan/releases/tag/1.8
CVE: CVE-2017-6051
Published: 2017-05-08
Description: An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: http://www.securityfocus.com/bid/98031; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-01; http://www.securityfocus.com/bid/98031
CVE: CVE-2017-6953
Published: 2017-05-08
Description: Gemalto SmartDiag Diagnosis Tool v2.5 has a stack-based Buffer Overflow with SEH Overwrite via long "Register a new card" input fields. There may be a risk of local code execution with untrusted input to SmartDiag.exe or SymDiag.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/41972/; https://www.exploit-db.com/exploits/41972/
CVE: CVE-2017-8848
Published: 2017-05-08
Description: Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/s3131212/allendisk/issues/16; https://github.com/s3131212/allendisk/issues/16
CVE: CVE-2016-10369
Published: 2017-05-08
Description: unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://bugs.debian.org/862098; https://git.lxde.org/gitweb/?p=lxde/lxterminal.git%3Ba=commit%3Bh=f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648; https://unix.stackexchange.com/questions/333539/lxterminal-in-the-netstat-output/333578
CVE: CVE-2016-8202
Published: 2017-05-08
Description: A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected versions, non-root users can gain root access with a combination of shell commands and parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/98332; http://www.securitytracker.com/id/1038401; https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03739en_us
CVE: CVE-2016-8209
Published: 2017-05-08
Description: Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: http://www.securitytracker.com/id/1038402; https://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2017-315.htm; http://www.securitytracker.com/id/1038402