deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9650
Published: 2017-08-25
Description: An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434, CWE-434
References: http://www.securityfocus.com/bid/100452; https://ics-cert.us-cert.gov/advisories/ICSA-17-234-01; https://www.exploit-db.com/exploits/42544/
CVE: CVE-2017-12816
Published: 2017-08-25
Description: In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used by a malware application to get unauthorized access to the product functionality by using Android IPC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://www.securityfocus.com/bid/100505; https://support.kaspersky.com/vulnerability.aspx?el=12430#090817; http://www.securityfocus.com/bid/100505
CVE: CVE-2017-12817
Published: 2017-08-25
Description: In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: http://www.securityfocus.com/bid/100504; https://support.kaspersky.com/vulnerability.aspx?el=12430#090817; http://www.securityfocus.com/bid/100504
CVE: CVE-2017-7693
Published: 2017-08-26
Description: Directory traversal vulnerability in viewer_script.jsp in Riverbed OPNET App Response Xpert (ARX) version 9.6.1 allows remote authenticated users to inject arbitrary commands to read OS files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://arthrocyber.com/research#finding_5; http://arthrocyber.com/research#finding_5
CVE: CVE-2017-12595
Published: 2017-08-27
Description: The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/qpdf/qpdf/commit/ad527a64f93dca12f6aabab2ca99ae5eb352ab4b; https://github.com/qpdf/qpdf/issues/146; https://usn.ubuntu.com/3638-1/
CVE: CVE-2017-13707
Published: 2017-08-27
Description: Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command execution. The vi program can be accessed through sudo, in order to navigate the filesystem and modify a critical file such as /etc/passwd.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://github.com/Wh1t3Rh1n0/exploits/blob/master/2017-08-25%20Replibit%20Backup%20Manager/README.md; https://github.com/Wh1t3Rh1n0/exploits/blob/master/2017-08-25%20Replibit%20Backup%20Manager/README.md
CVE: CVE-2017-13709
Published: 2017-08-27
Description: In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://sourceforge.net/p/flightgear/flightgear/ci/2a5e3d06b2c0d9f831063afe7e7260bca456d679/; https://sourceforge.net/p/flightgear/flightgear/ci/c7a2aef59979af3e9ff22daabb37bdaadb91cd75/; https://sourceforge.net/p/flightgear/flightgear/ci/2a5e3d06b2c0d9f831063afe7e7260bca456d679/
CVE: CVE-2017-13710
Published: 2017-08-27
Description: The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100499; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=0c54f[PII_REDACTED]1faab9bc5e995111a35672f9b; http://www.securityfocus.com/bid/100499
CVE: CVE-2012-2805
Published: 2017-08-28
Description: Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://vuldb.com/?id.9269; https://www.ffmpeg.org/security.html; https://vuldb.com/?id.9269
CVE: CVE-2013-0870
Published: 2017-08-28
Description: The 'vp3_decode_frame' function in FFmpeg 1.1.4 moves threads check out of header packet type check.
CVSS Score: 9.8 (CRITICAL)
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=14c8ee00ffd9d45e6e0c6f11a957ce7e56f7eb3a; http://www.openwall.com/lists/oss-security/2014/02/08/5; https://www.ffmpeg.org/security.html
CVE: CVE-2014-0141
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1187466; https://bugzilla.redhat.com/show_bug.cgi?id=1187466
CVE: CVE-2014-4925
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in Good for Enterprise for Android 2.8.0.398 and 1.9.0.40.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129864/Good-For-Enterprise-Android-HTML-Injection.html; http://seclists.org/fulldisclosure/2015/Jan/17; https://exchange.xforce.ibmcloud.com/vulnerabilities/99893
CVE: CVE-2014-5301
Published: 2017-08-28
Description: Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/129806/ManageEngine-Shell-Upload-Directory-Traversal.html; http://packetstormsecurity.com/files/130020/ManageEngine-Multiple-Products-Authenticated-File-Upload.html; http://seclists.org/fulldisclosure/2015/Jan/5
CVE: CVE-2014-5302
Published: 2017-08-28
Description: Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote authenticated users to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/129806/ManageEngine-Shell-Upload-Directory-Traversal.html; http://seclists.org/fulldisclosure/2015/Jan/12; http://seclists.org/fulldisclosure/2015/Jan/5
CVE: CVE-2014-8168
Published: 2017-08-28
Description: Red Hat Satellite 6 allows local users to access mongod and delete pulp_database.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1192249; https://bugzilla.redhat.com/show_bug.cgi?id=1192249
CVE: CVE-2014-8426
Published: 2017-08-28
Description: Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/130027/Barracuda-Load-Balancer-ADC-Key-Recovery-Password-Reset.html; http://seclists.org/fulldisclosure/2015/Jan/76; http://packetstormsecurity.com/files/130027/Barracuda-Load-Balancer-ADC-Key-Recovery-Password-Reset.html
CVE: CVE-2014-8428
Published: 2017-08-28
Description: Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://packetstormsecurity.com/files/130027/Barracuda-Load-Balancer-ADC-Key-Recovery-Password-Reset.html; http://seclists.org/fulldisclosure/2015/Jan/76; http://packetstormsecurity.com/files/130027/Barracuda-Load-Balancer-ADC-Key-Recovery-Password-Reset.html
CVE: CVE-2014-8753
Published: 2017-08-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cit-e-Net Cit-e-Access 6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130392/Cit-e-Net-6-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Feb/48; http://www.securityfocus.com/bid/72614
CVE: CVE-2014-8871
Published: 2017-08-28
Description: Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 and earlier, 5.1.1.2 and earlier, 5.2.0.3 and earlier, and 5.3.0.1 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/130444/Hybris-Commerce-Software-Suite-5.x-File-Disclosure-Traversal.html; http://seclists.org/fulldisclosure/2015/Feb/63; http://www.securityfocus.com/archive/1/534722/100/1600/threaded
CVE: CVE-2014-8900
Published: 2017-08-28
Description: Cross-site request forgery (CSRF) vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21695293; http://www.securityfocus.com/bid/72900; http://www-01.ibm.com/support/docview.wss?uid=swg21695293
CVE: CVE-2014-9312
Published: 2017-08-28
Description: Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/130104/Photo-Gallery-1.2.5-Shell-Upload.html; http://packetstormsecurity.com/files/130384/WordPress-Photo-Gallery-1.2.5-Unrestricted-File-Upload.html; http://www.securityfocus.com/bid/72620
CVE: CVE-2014-9469
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130393/vBulletin-5.1.3-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Feb/49; http://www.securityfocus.com/bid/72592
CVE: CVE-2014-9483
Published: 2017-08-28
Description: Emacs 24.4 allows remote attackers to bypass security restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/01/03/15; https://bugzilla.redhat.com/show_bug.cgi?id=1181599; https://exchange.xforce.ibmcloud.com/vulnerabilities/99688
CVE: CVE-2014-9513
Published: 2017-08-28
Description: Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2015/01/05/8; http://www.securityfocus.com/bid/71868; https://exchange.xforce.ibmcloud.com/vulnerabilities/99649
CVE: CVE-2014-9514
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in BMC Footprints Service Core 11.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/534648; http://www.securityfocus.com/archive/1/534648
CVE: CVE-2014-9557
Published: 2017-08-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in SmartCMS v.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130076/SmartCMS-2-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2015/Jan/97; http://packetstormsecurity.com/files/130076/SmartCMS-2-Cross-Site-Scripting.html
CVE: CVE-2014-9558
Published: 2017-08-28
Description: Multiple SQL injection vulnerabilities in SmartCMS v.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130075/SmartCMS-2-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Jan/96; http://www.securityfocus.com/bid/72289
CVE: CVE-2015-0101
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Process Manager Express 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; and IBM Business Process Manager Advanced 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21693134; http://www.securityfocus.com/bid/72920; http://www-01.ibm.com/support/docview.wss?uid=swg21693134
CVE: CVE-2015-0114
Published: 2017-08-28
Description: Stack-based buffer overflow in IBM V5R4, and IBM i Access for Windows 6.1 and 7.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020540; http://www.securityfocus.com/bid/72914; http://www-01.ibm.com/support/docview.wss?uid=nas8N1020540
CVE: CVE-2015-0210
Published: 2017-08-28
Description: wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://bugzilla.redhat.com/show_bug.cgi?id=1178263; https://bugzilla.redhat.com/show_bug.cgi?id=1178921; https://bugzilla.redhat.com/show_bug.cgi?id=1178263
CVE: CVE-2015-0928
Published: 2017-08-28
Description: libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/73117; https://redmine.openinfosecfoundation.org/issues/1272; http://www.securityfocus.com/bid/73117
CVE: CVE-2015-0974
Published: 2017-08-28
Description: Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://packetstormsecurity.com/files/129808/ZTE-Datacard-MF19-Privilege-Escalation-DLL-Hijacking.html; http://packetstormsecurity.com/files/129808/ZTE-Datacard-MF19-Privilege-Escalation-DLL-Hijacking.html
CVE: CVE-2015-1177
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/130058/Exponent-CMS-2.3.2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/534528/100/0/threaded; http://www.securityfocus.com/bid/72274
CVE: CVE-2015-1198
Published: 2017-08-28
Description: Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2015/01/18/8; http://www.securityfocus.com/bid/72103; http://www.openwall.com/lists/oss-security/2015/01/18/8
CVE: CVE-2015-1199
Published: 2017-08-28
Description: Directory traversal vulnerability in ppmd 10.1-5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2015/01/18/9; http://www.openwall.com/lists/oss-security/2015/01/18/9
CVE: CVE-2015-1386
Published: 2017-08-28
Description: Directory traversal vulnerability in unshield 1.0-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2015/01/27/27; https://bugzilla.redhat.com/show_bug.cgi?id=1185717; http://www.openwall.com/lists/oss-security/2015/01/27/27
CVE: CVE-2015-1401
Published: 2017-08-28
Description: Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2015/01/11/7; http://www.openwall.com/lists/oss-security/2015/01/27/31; http://www.securityfocus.com/bid/71981
CVE: CVE-2015-1430
Published: 2017-08-28
Description: Buffer overflow in xymon 4.3.17-1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/01/31/4; http://www.openwall.com/lists/oss-security/2015/01/31/4
CVE: CVE-2015-1443
Published: 2017-08-28
Description: The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://seclists.org/oss-sec/2015/q1/376; http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt; http://www.openwall.com/lists/oss-security/2015/02/01/5
CVE: CVE-2015-1445
Published: 2017-08-28
Description: HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.
CVSS Score: 7.2 (HIGH)
CWE: CWE-113
References: http://seclists.org/oss-sec/2015/q1/376; http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt; http://www.openwall.com/lists/oss-security/2015/02/01/5
CVE: CVE-2015-1876
Published: 2017-08-28
Description: Directory traversal vulnerability in ES File Explorer 3.2.4.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/130431/ES-File-Explorer-3.2.4.1-Path-Traversal.html; http://packetstormsecurity.com/files/130431/ES-File-Explorer-3.2.4.1-Path-Traversal.html
CVE: CVE-2015-2046
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/02/21/1; http://www.openwall.com/lists/oss-security/2015/02/21/2; https://bugzilla.redhat.com/show_bug.cgi?id=1191130
CVE: CVE-2015-3976
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earlier.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf; https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-013-04a.json; https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a
CVE: CVE-2016-0634
Published: 2017-08-28
Description: The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://rhn.redhat.com/errata/RHSA-2017-0725.html; http://www.openwall.com/lists/oss-security/2016/09/16/12; http://www.openwall.com/lists/oss-security/2016/09/16/8
CVE: CVE-2016-7030
Published: 2017-08-28
Description: FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://rhn.redhat.com/errata/RHSA-2017-0001.html; http://www.openwall.com/lists/oss-security/2017/01/02/5; http://www.securityfocus.com/bid/94934
CVE: CVE-2017-8380
Published: 2017-08-28
Description: Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98303; https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg04147.html; https://security.gentoo.org/glsa/201706-03
CVE: CVE-2013-7430
Published: 2017-08-28
Description: Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the xmlns parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.html; http://www.openwall.com/lists/oss-security/2015/02/26/11; http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.html
CVE: CVE-2014-8163
Published: 2017-08-28
Description: Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://access.redhat.com/security/cve/cve-2014-8163; https://bugzilla.redhat.com/show_bug.cgi?id=1187340; https://access.redhat.com/security/cve/cve-2014-8163
CVE: CVE-2015-0233
Published: 2017-08-28
Description: Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-254
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151954.html; https://bugzilla.redhat.com/show_bug.cgi?id=1183151; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151954.html
CVE: CVE-2015-1554
Published: 2017-08-28
Description: kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2015/02/08/1; https://bugzilla.redhat.com/show_bug.cgi?id=1186590; http://www.openwall.com/lists/oss-security/2015/02/08/1
CVE: CVE-2015-1600
Published: 2017-08-28
Description: Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/130401/Netatmo-Weather-Station-Cleartext-Password-Leak.html; http://www.securityfocus.com/archive/1/534707/100/1600/threaded; http://www.securityfocus.com/bid/72622
CVE: CVE-2017-12076
Published: 2017-08-28
Description: Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.synology.com/en-global/support/security/Synology_SA_17_48_DSM; https://www.synology.com/en-global/support/security/Synology_SA_17_48_DSM
CVE: CVE-2017-12077
Published: 2017-08-28
Description: Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.synology.com/en-global/support/security/Synology_SA_17_49_SRM; https://www.synology.com/en-global/support/security/Synology_SA_17_49_SRM
CVE: CVE-2017-12840
Published: 2017-08-28
Description: A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to allocate sufficient memory on the kernel heap to contain a user supplied string as such the string is copied into a buffer of constant size (0x1000-bytes) and thus an overflow condition results. Access to the kernel driver is permitted through an obfuscated interface whereby bytes of user supplied message are "authenticated" via an obfuscation routine employing a linear equation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-016/?fid=9946; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-016/?fid=9946
CVE: CVE-2017-12876
Published: 2017-08-28
Description: Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2017/08/16/3; https://blogs.gentoo.org/ago/2017/08/10/imagemagick-heap-based-buffer-overflow-in-omp_outlined-32-enhance-c/; https://github.com/ImageMagick/ImageMagick/commit/1cc6f0ccc92c20c7cab6c4a7335daf29c91f0d8e
CVE: CVE-2017-12877
Published: 2017-08-28
Description: Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2017/08/16/2; https://blogs.gentoo.org/ago/2017/08/10/imagemagick-use-after-free-in-destroyimage-image-c/; https://github.com/ImageMagick/ImageMagick/commit/04178de2247e353fc095846784b9a10fefdbf890