deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14525
Published: 2017-09-28
Description: Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in the startat parameter to xda/help/en/default.htm or (2) /%09/ (slash encoded horizontal tab slash) followed by a domain in the redirectUrl parameter to xda/component/virtuallinkconnect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://seclists.org/fulldisclosure/2017/Sep/57; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; http://seclists.org/fulldisclosure/2017/Sep/57
CVE: CVE-2017-14526
Published: 2017-09-28
Description: Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://seclists.org/fulldisclosure/2017/Sep/58; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; http://seclists.org/fulldisclosure/2017/Sep/58
CVE: CVE-2017-14527
Published: 2017-09-28
Description: Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a (1) crafted DTD, involving unspecified XML structures in a request to xda/com/documentum/ucf/server/transport/impl/GAIRConnector or crafted XML file in a MediaProfile file (2) import or (3) check in.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: http://seclists.org/fulldisclosure/2017/Sep/58; https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774; http://seclists.org/fulldisclosure/2017/Sep/58
CVE: CVE-2017-14622
Published: 2017-09-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101050; https://packetstormsecurity.com/files/144261/WordPress-2kb-Amazon-Affiliates-Store-2.1.0-Cross-Site-Scripting.html; https://wordpress.org/plugins/2kb-amazon-affiliates-store/#developers
CVE: CVE-2017-14775
Published: 2017-09-28
Description: Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/laravel/framework/pull/21320; https://github.com/laravel/framework/releases/tag/v5.5.10; https://laravel-news.com/laravel-v5-5-11
CVE: CVE-2017-14795
Published: 2017-09-28
Description: The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted BPG file, related to improper interaction with hls_pcm_sample in hevc.c in libavcodec in FFmpeg and put_pcm_var in hevcdsp_template.c in libavcodec in FFmpeg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/leonzhao7/vulnerability/blob/master/An%20Out-of-Bounds%20Read%20%28DoS%29%20Vulnerability%20in%20hevc.c%20of%20libbpg.md; https://github.com/leonzhao7/vulnerability/blob/master/An%20Out-of-Bounds%20Read%20%28DoS%29%20Vulnerability%20in%20hevc.c%20of%20libbpg.md
CVE: CVE-2017-14796
Published: 2017-09-28
Description: The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (integer underflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to improper interaction with copy_CTB_to_hv in hevc_filter.c in libavcodec in FFmpeg and sao_filter_CTB in hevc_filter.c in libavcodec in FFmpeg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://github.com/leonzhao7/vulnerability/blob/master/An%20integer%20underflow%20vulnerability%20in%20sao_filter_CTB%20of%20libbpg.md; https://github.com/leonzhao7/vulnerability/blob/master/An%20integer%20underflow%20vulnerability%20in%20sao_filter_CTB%20of%20libbpg.md
CVE: CVE-2017-1483
Published: 2017-09-28
Description: IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 128621.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306
References: http://www.ibm.com/support/docview.wss?uid=swg22007375; http://www.securityfocus.com/bid/101013; https://exchange.xforce.ibmcloud.com/vulnerabilities/128621
CVE: CVE-2017-14838
Published: 2017-09-28
Description: TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/42795/; https://www.exploit-db.com/exploits/42795/
CVE: CVE-2017-14839
Published: 2017-09-28
Description: TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/42797/; https://www.exploit-db.com/exploits/42797/
CVE: CVE-2017-14840
Published: 2017-09-28
Description: TeamWork TicketPlus allows Arbitrary File Upload in updateProfile.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/42796/; https://www.exploit-db.com/exploits/42796/
CVE: CVE-2017-14841
Published: 2017-09-28
Description: Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/42799/; https://www.exploit-db.com/exploits/42799/
CVE: CVE-2017-14842
Published: 2017-09-28
Description: Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/42798/; https://www.exploit-db.com/exploits/42798/
CVE: CVE-2017-14843
Published: 2017-09-28
Description: Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/42804/; https://www.exploit-db.com/exploits/42804/
CVE: CVE-2017-14844
Published: 2017-09-28
Description: Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/42801/; https://www.exploit-db.com/exploits/42801/
CVE: CVE-2017-14845
Published: 2017-09-28
Description: Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/42800/; https://www.exploit-db.com/exploits/42800/
CVE: CVE-2017-14846
Published: 2017-09-28
Description: Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/42802/; https://www.exploit-db.com/exploits/42802/
CVE: CVE-2017-14847
Published: 2017-09-28
Description: Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/42805/; https://www.exploit-db.com/exploits/42805/
CVE: CVE-2017-14849
Published: 2017-09-28
Description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/101056; https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/; https://twitter.com/nodejs/status/[PII_REDACTED]68876288
CVE: CVE-2017-1577
Published: 2017-09-28
Description: IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 132117.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.ibm.com/support/docview.wss?uid=swg22008586; http://www.securityfocus.com/bid/101017; http://www.securitytracker.com/id/1039405
CVE: CVE-2017-1591
Published: 2017-09-28
Description: IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132368.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008815; http://www.securityfocus.com/bid/101021; https://exchange.xforce.ibmcloud.com/vulnerabilities/132368
CVE: CVE-2017-2551
Published: 2017-09-28
Description: Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: http://www.vapidlabs.com/advisory.php?v=201; https://wordpress.org/plugins/backwpup/#developers; http://www.vapidlabs.com/advisory.php?v=201
CVE: CVE-2014-2029
Published: 2017-09-29
Description: The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/02/19/14; https://bugs.launchpad.net/percona-toolkit/+bug/1279502; https://bugzilla.novell.com/show_bug.cgi?id=864194
CVE: CVE-2015-1027
Published: 2017-09-29
Description: The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://bugs.launchpad.net/percona-toolkit/+bug/1408375; https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/; https://bugs.launchpad.net/percona-toolkit/+bug/1408375
CVE: CVE-2017-10701
Published: 2017-09-29
Description: Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka SAP Security Notes 2469860, 2471209, and 2488516.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100786; http://www.securityfocus.com/bid/100788; http://www.securityfocus.com/bid/100805
CVE: CVE-2017-11479
Published: 2017-09-29
Description: Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/10/24/1; http://www.openwall.com/lists/oss-security/2019/10/29/3; https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884
CVE: CVE-2017-12222
Published: 2017-09-29
Description: A vulnerability in the wireless controller manager of Cisco IOS XE could allow an unauthenticated, adjacent attacker to cause a restart of the switch and result in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted association request. An exploit could allow the attacker to cause the switch to restart. This vulnerability affects Cisco Catalyst 3650 and 3850 switches running IOS XE Software versions 16.1 through 16.3.3, and acting as wireless LAN controllers (WLC). Cisco Bug IDs: CSCvd45069.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399, CWE-20
References: http://www.securityfocus.com/bid/101035; http://www.securitytracker.com/id/1039458; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ios-xe
CVE: CVE-2017-12226
Published: 2017-09-29
Description: A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, and Cisco New Generation Wireless Controllers (NGWC) 3850 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incomplete input validation of HTTP requests by the affected GUI, if the GUI connection state or protocol changes. An attacker could exploit this vulnerability by authenticating to the Wireless Controller GUI as a Lobby Administrator user of an affected device and subsequently changing the state or protocol for their connection to the GUI. A successful exploit could allow the attacker to elevate their privilege level to administrator and gain full control of the affected device. This vulnerability affects the following Cisco products if they are running Cisco IOS XE Software Release 3.7.0E, 3.7.1E, 3.7.2E, 3.7.3E, 3.7.4E, or 3.7.5E: Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, Cisco New Generation Wireless Controllers (NGWC) 3850. Cisco Bug IDs: CSCvd73746.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-20
References: http://www.securityfocus.com/bid/101063; http://www.securitytracker.com/id/1039456; http://www.securitytracker.com/id/1039457
CVE: CVE-2017-12228
Published: 2017-09-29
Description: A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software. Cisco Bug IDs: CSCvc33171.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20, CWE-295
References: http://www.securityfocus.com/bid/101065; http://www.securitytracker.com/id/1039450; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-pnp
CVE: CVE-2017-12229
Published: 2017-09-29
Description: A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious API request to an affected device. A successful exploit could allow the attacker to bypass authentication and gain access to the web UI of the affected software. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the HTTP Server feature is enabled for the device. The newly redesigned, web-based administration UI was introduced in the Denali 16.2 Release of Cisco IOS XE Software. This vulnerability does not affect the web-based administration UI in earlier releases of Cisco IOS XE Software. Cisco Bug IDs: CSCuz46036.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/101032; http://www.securitytracker.com/id/1039447; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-restapi
CVE: CVE-2017-12230
Published: 2017-09-29
Description: A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of the affected software. An attacker could exploit this vulnerability by using the web UI of the affected software to create a new user and then logging into the web UI as the newly created user. A successful exploit could allow the attacker to elevate their privileges on the affected device. This vulnerability affects Cisco devices that are running a vulnerable release Cisco IOS XE Software, if the HTTP Server feature is enabled for the device. The newly redesigned, web-based administration UI was introduced in the Denali 16.2 Release of Cisco IOS XE Software. This vulnerability does not affect the web-based administration UI in earlier releases of Cisco IOS XE Software. Cisco Bug IDs: CSCuy83062.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-276
References: http://www.securityfocus.com/bid/101036; http://www.securitytracker.com/id/1039446; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-privesc
CVE: CVE-2017-12231
Published: 2017-09-29
Description: A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper translation of H.323 messages that use the Registration, Admission, and Status (RAS) protocol and are sent to an affected device via IPv4 packets. An attacker could exploit this vulnerability by sending a crafted H.323 RAS packet through an affected device. A successful exploit could allow the attacker to cause the affected device to crash and reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to use an application layer gateway with NAT (NAT ALG) for H.323 RAS messages. By default, a NAT ALG is enabled for H.323 RAS messages. Cisco Bug IDs: CSCvc57217.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/101039; http://www.securitytracker.com/id/1039449; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-nat
CVE: CVE-2017-12232
Published: 2017-09-29
Description: A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a misclassification of Ethernet frames. An attacker could exploit this vulnerability by sending a crafted Ethernet frame to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc03809.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/101044; http://www.securitytracker.com/id/1039452; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-rbip-dos
CVE: CVE-2017-12233
Published: 2017-09-29
Description: Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuz95334.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101038; http://www.securitytracker.com/id/1039459; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip
CVE: CVE-2017-12234
Published: 2017-09-29
Description: Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of crafted CIP packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted CIP packets to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc43709.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101038; http://www.securitytracker.com/id/1039459; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip
CVE: CVE-2017-12235
Published: 2017-09-29
Description: A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper parsing of ingress PN-DCP Identify Request packets destined to an affected device. An attacker could exploit this vulnerability by sending a crafted PN-DCP Identify Request packet to an affected device and then continuing to send normal PN-DCP Identify Request packets to the device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to process PROFINET messages. Beginning with Cisco IOS Software Release 12.2(52)SE, PROFINET is enabled by default on all the base switch module and expansion-unit Ethernet ports. Cisco Bug IDs: CSCuz47179.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101043; http://www.securitytracker.com/id/1039451; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-profinet
CVE: CVE-2017-12236
Published: 2017-09-29
Description: A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 could allow an unauthenticated, remote attacker using an x tunnel router to bypass authentication checks performed when registering an Endpoint Identifier (EID) to a Routing Locator (RLOC) in the map server/map resolver (MS/MR). The vulnerability is due to a logic error introduced via a code regression for the affected software. An attacker could exploit this vulnerability by sending specific valid map-registration requests, which will be accepted by the MS/MR even if the authentication keys do not match, to the affected software. A successful exploit could allow the attacker to inject invalid mappings of EIDs to RLOCs in the MS/MR of the affected software. This vulnerability affects Cisco devices that are configured with LISP acting as an IPv4 or IPv6 map server. This vulnerability affects Cisco IOS XE Software release trains 3.9E and Everest 16.4. Cisco Bug IDs: CSCvc18008.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/101033; http://www.securitytracker.com/id/1039448; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-lisp