deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-4978
Published: 2017-05-19
Description: EMC RSA Adaptive Authentication (On-Premise) versions prior to 7.3 P2 (exclusive) contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/540552/30/0/threaded; http://www.securityfocus.com/bid/98392; http://www.securitytracker.com/id/1038469
CVE: CVE-2017-4979
Published: 2017-05-19
Description: EMC Isilon OneFS 8.0.1.0, OneFS 8.0.0.0 - 8.0.0.2, OneFS 7.2.1.0 - 7.2.1.3, and OneFS 7.2.0.x is affected by an NFS export vulnerability. Under certain conditions, after upgrading a cluster from OneFS 7.1.1.x or earlier, users may have unexpected levels of access to some NFS exports.
CVSS Score: 7.1 (HIGH)
References: http://www.securityfocus.com/archive/1/540551/30/0/threaded; http://www.securityfocus.com/archive/1/540551/30/0/threaded
CVE: CVE-2017-7968
Published: 2017-05-19
Description: An Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft Web Studio v8.0 Patch 3 and prior versions. Upon installation, Wonderware InduSoft Web Studio creates a new directory and two files, which are placed in the system's path and can be manipulated by non-administrators. This could allow an authenticated user to escalate his or her privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-090-02; http://www.securityfocus.com/bid/98544; https://ics-cert.us-cert.gov/advisories/ICSA-17-138-02
CVE: CVE-2017-9080
Published: 2017-05-19
Description: PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://touhidshaikh.com/blog/poc/playsms-v1-4-rce/; https://www.exploit-db.com/exploits/42003/; https://www.exploit-db.com/exploits/44599/
CVE: CVE-2017-9083
Published: 2017-05-19
Description: poppler 0.54.0, as used in Evince and other products, has a NULL pointer dereference in the JPXStream::readUByte function in JPXStream.cc. For example, the perf_test utility will crash (segmentation fault) when parsing an invalid PDF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugs.freedesktop.org/show_bug.cgi?id=101084; https://security.gentoo.org/glsa/201801-17; https://bugs.freedesktop.org/show_bug.cgi?id=101084
CVE: CVE-2017-9090
Published: 2017-05-19
Description: reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to bypass the CAPTCHA via an empty $_POST['captcha'].
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/s3131212/allendisk/issues/25; https://github.com/s3131212/allendisk/issues/25
CVE: CVE-2017-9091
Published: 2017-05-19
Description: /admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to CAPTCHA bypass by emptying $_POST['captcha'].
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/s3131212/allendisk/issues/23; https://github.com/s3131212/allendisk/issues/23
CVE: CVE-2015-5241
Published: 2017-05-19
Description: After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal' or 'uddi-console'. User session data, credentials, and auth tokens are cleared before the redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://juddi.apache.org/security.html; http://juddi.apache.org/security.html
CVE: CVE-2017-9093
Published: 2017-05-19
Description: The my_skip_input_data_fn function in imagew-jpeg.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/jsummers/imageworsener/issues/26; https://github.com/jsummers/imageworsener/issues/26
CVE: CVE-2017-9094
Published: 2017-05-19
Description: The lzw_add_to_dict function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/98728; https://github.com/jsummers/imageworsener/issues/27; http://www.securityfocus.com/bid/98728
CVE: CVE-2017-9098
Published: 2017-05-19
Description: ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage function in coders/rle.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: http://hg.code.sf.net/p/graphicsmagick/code/diff/0a5b75e019b6/coders/rle.c; http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98593
CVE: CVE-2017-7475
Published: 2017-05-19
Description: Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/oss-sec/2017/q2/151; https://bugs.freedesktop.org/show_bug.cgi?id=100763; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475
CVE: CVE-2017-7504
Published: 2017-05-19
Description: HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/98595; https://bugzilla.redhat.com/show_bug.cgi?id=1451441; http://www.securityfocus.com/bid/98595
CVE: CVE-2017-9100
Published: 2017-05-21
Description: login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password field during an admin login attempt.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://touhidshaikh.com/blog/poc/d-link-dir600-auth-bypass/; https://www.exploit-db.com/exploits/42039/; https://www.youtube.com/watch?v=waIJKWCpyNQ
CVE: CVE-2017-7620
Published: 2017-05-21
Description: MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalink_page.php?url= URI and (2) an open redirect via a login_page.php?return= URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt; http://www.securitytracker.com/id/1038538; https://mantisbt.org/bugs/view.php?id=22702
CVE: CVE-2017-9024
Published: 2017-05-21
Description: Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor (SCA) 3.0, has a Directory Traversal issue in its TFTP Server, allowing attackers to read arbitrary files via ../ sequences in a pathname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://hyp3rlinx.altervista.org/advisories/SECURE-AUDITOR-v3.0-DIRECTORY-TRAVERSAL.txt; https://www.exploit-db.com/exploits/42041/; http://hyp3rlinx.altervista.org/advisories/SECURE-AUDITOR-v3.0-DIRECTORY-TRAVERSAL.txt
CVE: CVE-2017-9046
Published: 2017-05-21
Description: winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 allows code execution via a crafted ssgp.dll file that must be installed locally. For example, if ssgp.dll is on the desktop and executes arbitrary code in the DllMain function, then clicking on a mailto: link on a remote web page triggers the attack.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://packetstormsecurity.com/files/142606/Pegasus-4.72-Build-572-Remote-Code-Execution.html; https://packetstormsecurity.com/files/142606/Pegasus-4.72-Build-572-Remote-Code-Execution.html
CVE: CVE-2014-9970
Published: 2017-05-21
Description: jasypt before 1.9.2 allows a timing attack against the password hash comparison.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securitytracker.com/id/1039744; http://www.securitytracker.com/id/1040360; https://access.redhat.com/errata/RHSA-2017:2546
CVE: CVE-2017-9101
Published: 2017-05-21
Description: import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/42044/; https://www.exploit-db.com/exploits/44598/; https://www.exploit-db.com/exploits/42044/
CVE: CVE-2017-9110
Published: 2017-05-21
Description: In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2017/05/12/5; https://github.com/openexr/openexr/issues/232; https://github.com/openexr/openexr/pull/233
CVE: CVE-2017-9111
Published: 2017-05-21
Description: In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00000.html; http://www.openwall.com/lists/oss-security/2017/05/12/5
CVE: CVE-2017-9112
Published: 2017-05-21
Description: In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2017/05/12/5; https://github.com/openexr/openexr/issues/232; https://github.com/openexr/openexr/pull/233
CVE: CVE-2017-9113
Published: 2017-05-21
Description: In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00000.html; http://www.openwall.com/lists/oss-security/2017/05/12/5
CVE: CVE-2017-9114
Published: 2017-05-21
Description: In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2017/05/12/5; https://github.com/openexr/openexr/issues/232; https://github.com/openexr/openexr/pull/233
CVE: CVE-2017-9115
Published: 2017-05-21
Description: In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00000.html; http://www.openwall.com/lists/oss-security/2017/05/12/5
CVE: CVE-2017-9116
Published: 2017-05-21
Description: In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2017/05/12/5; https://github.com/openexr/openexr/issues/232; https://github.com/openexr/openexr/pull/233
CVE: CVE-2017-9117
Published: 2017-05-21
Description: In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://bugzilla.maptools.org/show_bug.cgi?id=2690; http://www.securityfocus.com/bid/98581; https://gitlab.com/libtiff/libtiff/-/issues/89
CVE: CVE-2017-9119
Published: 2017-05-21
Description: The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: http://www.securityfocus.com/bid/98596; https://bugs.php.net/bug.php?id=74593; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-9131
Published: 2017-05-21
Description: An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. By connecting to the Mosquitto broker on an access point and one of its clients, an attacker can gather enough information to craft a command that reboots the client remotely when sent to the client's Mosquitto broker, aka "unauthenticated remote command execution." This command can be re-sent endlessly to act as a DoS attack on the client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2017-9132
Published: 2017-05-21
Description: A hard-coded credentials issue was discovered on Mimosa Client Radios before 2.2.3, Mimosa Backhaul Radios before 2.2.3, and Mimosa Access Points before 2.2.3. These devices run Mosquitto, a lightweight message broker, to send information between devices. By using the vendor's hard-coded credentials to connect to the broker on any device (whether it be an AP, Client, or Backhaul model), an attacker can view all the messages being sent between the devices. If an attacker connects to an AP, the AP will leak information about any clients connected to it, including the serial numbers, which can be used to remotely factory reset the clients via a page in their web interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2017-9133
Published: 2017-05-21
Description: An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. In the device's web interface, after logging in, there is a page that allows you to ping other hosts from the device and view the results. The user is allowed to specify which host to ping, but this variable is not sanitized server-side, which allows an attacker to pass a specially crafted string to execute shell commands as the root user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2017-9134
Published: 2017-05-21
Description: An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. There is a page in the web interface that will show you the device's serial number, regardless of whether or not you have logged in. This information-leakage issue is relevant because there is another page (accessible without any authentication) that allows you to remotely factory reset the device simply by entering the serial number.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2017-9135
Published: 2017-05-21
Description: An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program like cURL. There is one test accessible via cURL that does not properly sanitize user input, allowing an attacker to execute shell commands as the root user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2017-9136
Published: 2017-05-21
Description: An issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface, there is a page that allows an attacker to use an unsanitized GET parameter to download files from the device as the root user. The attacker can download any file from the device's filesystem. This can be used to view unsalted, MD5-hashed administrator passwords, which can then be cracked, giving the attacker full admin access to the device's web interface. This vulnerability can also be used to view the plaintext pre-shared key (PSK) for encrypted wireless connections, or to view the device's serial number (which allows an attacker to factory reset the device).
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-522, CWE-732
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2017-9137
Published: 2017-05-21
Description: Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a default password of mateidu for the mateidu account (a hidden user account established by the vendor). This account can be accessed via both the web interface and SSH. In the web interface, this simply grants an attacker read-only access to the device's settings. However, when using SSH, this gives an attacker access to a Linux shell. NOTE: the vendor has commented "The mateidu user is a known user, which is mentioned in the FibeAir IP-10 User Guide. Customers are instructed to change the mateidu user password. Changing the user password fully solves the vulnerability."
CVSS Score: 7.3 (HIGH)
CWE: CWE-1188
References: http://blog.iancaling.com/post/[PII_REDACTED]8; http://blog.iancaling.com/post/[PII_REDACTED]8
CVE: CVE-2017-9138
Published: 2017-05-21
Description: There is a debug-interface vulnerability on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20). After connecting locally to a router in a wired or wireless manner, one can bypass intended access restrictions by sending shell commands directly and reading their results, or by entering shell commands that change this router's username and password.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: http://www.tendacn.com/en/2017.html; http://www.tendacn.com/en/2017.html
CVE: CVE-2017-9139
Published: 2017-05-21
Description: There is a stack-based buffer overflow on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20). Crafted POST requests to an unspecified URL result in DoS, interrupting the HTTP service (used to login to the web UI of a router) for 1 to 2 seconds.
CVSS Score: 3.5 (LOW)
CWE: CWE-119
References: http://www.tendacn.com/en/2017.html; http://www.tendacn.com/en/2017.html
CVE: CVE-2017-6630
Published: 2017-05-22
Description: A vulnerability in the Session Initiation Protocol (SIP) implementation of Cisco IP Phone 8851 11.0(0.1) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to an abnormal SIP message. An attacker could exploit this vulnerability by manipulating the CANCEL packet. An exploit could allow the attacker to cause a disruption of service to the phone. Cisco Bug IDs: CSCvc34795.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/98533; http://www.securitytracker.com/id/1038511; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-sip
CVE: CVE-2017-6632
Published: 2017-05-22
Description: A vulnerability in the logging configuration of Secure Sockets Layer (SSL) policies for Cisco FirePOWER System Software 5.3.0 through 6.2.2 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high consumption of system resources. The vulnerability is due to the logging of certain TCP packets by the affected software. An attacker could exploit this vulnerability by sending a flood of crafted TCP packets to an affected device. A successful exploit could allow the attacker to cause a DoS condition. The success of an exploit is dependent on how an administrator has configured logging for SSL policies for a device. This vulnerability affects Cisco FirePOWER System Software that is configured to log connections by using SSL policy default actions. Cisco Bug IDs: CSCvd07072.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-400
References: http://www.securityfocus.com/bid/98523; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-fpwr; http://www.securityfocus.com/bid/98523
CVE: CVE-2017-6633
Published: 2017-05-22
Description: A vulnerability in the TCP throttling process of Cisco UCS C-Series Rack Servers 3.0(0.234) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient rate-limiting protection. An attacker could exploit this vulnerability by sending a high rate of TCP SYN packets to a specific TCP listening port on an affected device. An exploit could allow the attacker to cause a specific TCP listening port to stop accepting new connections, resulting in a DoS condition. Cisco Bug IDs: CSCva65544.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/98525; http://www.securitytracker.com/id/1038513; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-ucsc
CVE: CVE-2017-6634
Published: 2017-05-22
Description: A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to insufficient CSRF protection by the Device Manager web interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow the attacker to submit arbitrary requests to an affected device via the Device Manager web interface and with the privileges of the user. Cisco Bug IDs: CSCvc88811.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/98524; http://www.securitytracker.com/id/1038517; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-ie1000csrf
CVE: CVE-2017-6635
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal techniques to submit a path to a desired file location on an affected system. A successful exploit could allow the attacker to delete any file from the system. Cisco Bug IDs: CSCvc99597.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264, CWE-862
References: http://www.securityfocus.com/bid/98535; http://www.securitytracker.com/id/1038514; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp3