deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-5201
Published: 2017-01-19
Description: A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-2718.html; http://www.securityfocus.com/bid/94196; http://www.securitytracker.com/id/1037273
CVE: CVE-2016-5203
Published: 2017-01-19
Description: A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5204
Published: 2017-01-19
Description: Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5205
Published: 2017-01-19
Description: Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5206
Published: 2017-01-19
Description: The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5207
Published: 2017-01-19
Description: In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5208
Published: 2017-01-19
Description: Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5209
Published: 2017-01-19
Description: Bad casting in bitmap manipulation in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5210
Published: 2017-01-19
Description: Heap buffer overflow during TIFF image parsing in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5211
Published: 2017-01-19
Description: A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5212
Published: 2017-01-19
Description: Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5213
Published: 2017-01-19
Description: A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5214
Published: 2017-01-19
Description: Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the Mark of the Web via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-19
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5215
Published: 2017-01-19
Description: A use after free in webaudio in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5216
Published: 2017-01-19
Description: A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5217
Published: 2017-01-19
Description: The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged plugins, which allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5218
Published: 2017-01-19
Description: The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the contents of the Omnibox (URL bar) via a crafted HTML page containing PDF data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5219
Published: 2017-01-19
Description: A heap use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5220
Published: 2017-01-19
Description: PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5221
Published: 2017-01-19
Description: Type confusion in libGLESv2 in ANGLE in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android possibly allowed a remote attacker to bypass buffer validation via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5222
Published: 2017-01-19
Description: Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5223
Published: 2017-01-19
Description: Integer overflow in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption or DoS via a crafted PDF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5224
Published: 2017-01-19
Description: A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5225
Published: 2017-01-19
Description: Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-19
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-5226
Published: 2017-01-19
Description: Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, which allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2016-9650
Published: 2017-01-19
Description: Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attacker to bypass a no-referrer policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-19
References: http://rhn.redhat.com/errata/RHSA-2016-2919.html; http://www.securityfocus.com/bid/94633; https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
CVE: CVE-2015-8212
Published: 2017-01-19
Description: CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-005.txt.asc; http://www.securitytracker.com/id/1035673; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-005.txt.asc
CVE: CVE-2016-10075
Published: 2017-01-19
Description: The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-17
References: http://www.openwall.com/lists/oss-security/2016/12/28/8; http://www.securityfocus.com/bid/95143; https://github.com/tqdm/tqdm/issues/328
CVE: CVE-2016-7543
Published: 2017-01-19
Description: Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2017-0725.html; http://www.openwall.com/lists/oss-security/2016/09/26/9; http://www.securityfocus.com/bid/93183
CVE: CVE-2016-7545
Published: 2017-01-19
Description: SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2016-2702.html; http://rhn.redhat.com/errata/RHSA-2017-0535.html; http://rhn.redhat.com/errata/RHSA-2017-0536.html
CVE: CVE-2016-7793
Published: 2017-01-19
Description: sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/09/30/2; http://www.securityfocus.com/bid/93249; https://github.com/sociomantic-tsunami/git-hub/issues/197
CVE: CVE-2016-7794
Published: 2017-01-19
Description: sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/09/30/2; http://www.securityfocus.com/bid/93249; https://github.com/sociomantic-tsunami/git-hub/issues/197
CVE: CVE-2016-9016
Published: 2017-01-19
Description: Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/10/25/3; http://www.openwall.com/lists/oss-security/2016/10/25/9; http://www.securityfocus.com/bid/93899
CVE: CVE-2016-5725
Published: 2017-01-19
Description: Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html; http://seclists.org/fulldisclosure/2016/Sep/53; http://www.jcraft.com/jsch/ChangeLog
CVE: CVE-2016-10143
Published: 2017-01-20
Description: A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96787; https://dev.tiki.org/item6174; https://sourceforge.net/p/tikiwiki/code/60308/
CVE: CVE-2016-5012
Published: 2017-01-20
Description: In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92041; https://moodle.org/mod/forum/discuss.php?d=336697; http://www.securityfocus.com/bid/92041
CVE: CVE-2016-5013
Published: 2017-01-20
Description: In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: http://www.securityfocus.com/bid/92040; https://moodle.org/mod/forum/discuss.php?d=336698; http://www.securityfocus.com/bid/92040
CVE: CVE-2016-5014
Published: 2017-01-20
Description: In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92042; https://moodle.org/mod/forum/discuss.php?d=336699; http://www.securityfocus.com/bid/92042
CVE: CVE-2016-7038
Published: 2017-01-20
Description: In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
CVSS Score: 7.3 (HIGH)
CWE: CWE-640
References: http://www.securityfocus.com/bid/93174; https://moodle.org/mod/forum/discuss.php?d=339631; http://www.securityfocus.com/bid/93174
CVE: CVE-2016-8642
Published: 2017-01-20
Description: In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94441; https://moodle.org/mod/forum/discuss.php?d=343275; http://www.securityfocus.com/bid/94441
CVE: CVE-2016-8643
Published: 2017-01-20
Description: In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94457; https://moodle.org/mod/forum/discuss.php?d=343276; http://www.securityfocus.com/bid/94457
CVE: CVE-2016-8644
Published: 2017-01-20
Description: In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94458; https://moodle.org/mod/forum/discuss.php?d=343277; http://www.securityfocus.com/bid/94458
CVE: CVE-2017-2576
Published: 2017-01-20
Description: In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/95649; https://moodle.org/mod/forum/discuss.php?d=345912; http://www.securityfocus.com/bid/95649
CVE: CVE-2017-2578
Published: 2017-01-20
Description: In Moodle 3.x, there is XSS in the assignment submission page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95647; https://moodle.org/mod/forum/discuss.php?d=345915; http://www.securityfocus.com/bid/95647
CVE: CVE-2017-5541
Published: 2017-01-20
Description: Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder and new-folder parameters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/95689; https://github.com/symphonycms/symphony-2/issues/2639; https://github.com/symphonycms/symphony-2/releases/tag/2.6.10
CVE: CVE-2017-5542
Published: 2017-01-20
Description: Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95686; https://github.com/symphonycms/symphony-2/issues/2639; https://github.com/symphonycms/symphony-2/releases/tag/2.6.10
CVE: CVE-2017-5543
Published: 2017-01-20
Description: includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/95688; https://github.com/intelliants/subrion/issues/297; http://www.securityfocus.com/bid/95688
CVE: CVE-2014-2045
Published: 2017-01-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attackers to inject arbitrary web script or HTML via the username when (1) logging in or (2) creating an account in the old interface, (3) username when creating an account in the new interface, (4) hostname in the old interface, (5) inspect parameter in the config module, (6) commands parameter in the atcommands tool, or (7) host parameter in the ping tool.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/135613/Viprinet-Multichannel-VPN-Router-300-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2016/Feb/8; http://www.securityfocus.com/archive/1/537441/100/0/threaded
CVE: CVE-2014-9754
Published: 2017-01-20
Description: The hardware VPN client in Viprinet MultichannelVPN Router 300 version[PII_REDACTED]/[PII_REDACTED] does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300-Identity-Verification-Fail.html; http://seclists.org/fulldisclosure/2016/Feb/8; http://www.securityfocus.com/archive/1/537441/100/0/threaded
CVE: CVE-2014-9755
Published: 2017-01-20
Description: The hardware VPN client in Viprinet MultichannelVPN Router 300 version[PII_REDACTED]/[PII_REDACTED] does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows remote attackers to perform a replay attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300-Identity-Verification-Fail.html; http://seclists.org/fulldisclosure/2016/Feb/8; http://www.securityfocus.com/archive/1/537441/100/0/threaded
CVE: CVE-2016-5316
Published: 2017-01-20
Description: Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2016-07/msg00087.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00060.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00090.html
CVE: CVE-2016-5317
Published: 2017-01-20
Description: Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-07/msg00087.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00060.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00090.html