deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7957
Published: 2017-04-29
Description: XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3841; http://www.securityfocus.com/bid/100687; http://www.securitytracker.com/id/1039499
CVE: CVE-2017-8114
Published: 2017-04-29
Description: Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/98445; https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114; https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11
CVE: CVE-2017-8325
Published: 2017-04-29
Description: The iw_process_cols_to_intermediate function in imagew-main.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/04/27/imageworsener-heap-based-buffer-overflow-in-iw_process_cols_to_intermediate-imagew-main-c/; https://github.com/jsummers/imageworsener/commit/86564051db45b466e5f667111ce00b5eeedc8fb6; https://security.gentoo.org/glsa/201706-06
CVE: CVE-2017-8326
Published: 2017-04-29
Description: libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image, related to imagew-bmp.c and imagew-util.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682
References: https://blogs.gentoo.org/ago/2017/04/27/imageworsener-two-left-shift/; https://github.com/jsummers/imageworsener/commit/a00183107d4b84bc8a714290e824ca9c68dac738; https://security.gentoo.org/glsa/201706-06
CVE: CVE-2017-8327
Published: 2017-04-29
Description: The bmpr_read_uncompressed function in imagew-bmp.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://blogs.gentoo.org/ago/2017/04/27/imageworsener-memory-allocation-failure-in-my_mallocfn-imagew-cmd-c/; https://github.com/jsummers/imageworsener/commit/86564051db45b466e5f667111ce00b5eeedc8fb6; https://security.gentoo.org/glsa/201706-06
CVE: CVE-2017-8342
Published: 2017-04-30
Description: Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://bugs.debian.org/861514; https://github.com/Kozea/Radicale/blob/1.1.2/NEWS.rst; https://github.com/Kozea/Radicale/commit/059ba8dec1f22ccbeab837e288b3833a099cee2d
CVE: CVE-2017-7721
Published: 2017-04-30
Description: IrfanView version 4.44 (32bit) with FPX Plugin before 4.45 has an Access Violation and crash in processing a FlashPix (.FPX) file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.irfanview.com/plugins.htm; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-7721; http://www.irfanview.com/plugins.htm
CVE: CVE-2017-8339
Published: 2017-04-30
Description: PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\.\PSMEMDriver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://saptech-erp.com.au/resources/panda_bsod.zip; http://www.securityfocus.com/bid/98367; https://www.exploit-db.com/exploits/41945/
CVE: CVE-2017-8343
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98132; https://github.com/ImageMagick/ImageMagick/issues/444
CVE: CVE-2017-8344
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98136; https://github.com/ImageMagick/ImageMagick/issues/446
CVE: CVE-2017-8345
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98138; https://github.com/ImageMagick/ImageMagick/issues/442
CVE: CVE-2017-8346
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadDCMImage function in dcm.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98346; https://github.com/ImageMagick/ImageMagick/issues/440
CVE: CVE-2017-8347
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadEXRImage function in exr.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98363; https://github.com/ImageMagick/ImageMagick/issues/441
CVE: CVE-2017-8348
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98364; https://github.com/ImageMagick/ImageMagick/issues/445
CVE: CVE-2017-8349
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98370; https://github.com/ImageMagick/ImageMagick/issues/443
CVE: CVE-2017-8350
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98373; https://github.com/ImageMagick/ImageMagick/issues/447
CVE: CVE-2017-8351
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98371; https://github.com/ImageMagick/ImageMagick/issues/448
CVE: CVE-2017-8352
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98372; https://github.com/ImageMagick/ImageMagick/issues/452
CVE: CVE-2017-8353
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98377; https://github.com/ImageMagick/ImageMagick/issues/454
CVE: CVE-2017-8354
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98374; https://github.com/ImageMagick/ImageMagick/issues/451
CVE: CVE-2017-8355
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98380; https://github.com/ImageMagick/ImageMagick/issues/450
CVE: CVE-2017-8356
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98378; https://github.com/ImageMagick/ImageMagick/issues/449
CVE: CVE-2017-8357
Published: 2017-04-30
Description: In ImageMagick 7.0.5-5, the ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98388; https://github.com/ImageMagick/ImageMagick/issues/453
CVE: CVE-2017-8358
Published: 2017-04-30
Description: LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: http://www.securityfocus.com/bid/98395; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=889; https://github.com/LibreOffice/core/commit/6e6e54f944a5ebb49e9110bdeff844d00a96c56c
CVE: CVE-2017-8359
Published: 2017-04-30
Description: Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/98280; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=726; https://github.com/grpc/grpc/pull/10353
CVE: CVE-2017-8081
Published: 2017-04-30
Description: Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.
CVSS Score: 8.8 (HIGH)
CWE: CWE-338
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1224; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1224
CVE: CVE-2017-8361
Published: 2017-04-30
Description: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://security.gentoo.org/glsa/201811-23
CVE: CVE-2017-8362
Published: 2017-04-30
Description: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://security.gentoo.org/glsa/201811-23
CVE: CVE-2017-8363
Published: 2017-04-30
Description: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://security.gentoo.org/glsa/201811-23
CVE: CVE-2017-8364
Published: 2017-04-30
Description: The read_buf function in stream.c in rzip 2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/04/29/rzip-heap-based-buffer-overflow-in-read_buf-stream-c/; https://lists.debian.org/debian-lts-announce/2020/04/msg00022.html; https://blogs.gentoo.org/ago/2017/04/29/rzip-heap-based-buffer-overflow-in-read_buf-stream-c/
CVE: CVE-2017-8365
Published: 2017-04-30
Description: The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://security.gentoo.org/glsa/201811-23
CVE: CVE-2017-8366
Published: 2017-04-30
Description: The strescape function in ec_strings.c in Ettercap 0.8.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted filter that is mishandled by etterfilter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3874; https://blogs.gentoo.org/ago/2017/04/29/ettercap-etterfilter-heap-based-buffer-overflow-write/; http://www.debian.org/security/2017/dsa-3874
CVE: CVE-2017-8367
Published: 2017-04-30
Description: Buffer overflow in Ether Software Easy MOV Converter 1.4.24, Easy DVD Creator, Easy MPEG/AVI/DIVX/WMV/RM to DVD, Easy Avi/Divx/Xvid to DVD Burner, Easy MPEG to DVD Burner, Easy WMV/ASF/ASX to DVD Burner, Easy RM RMVB to DVD Burner, Easy CD DVD Copy, MP3/AVI/MPEG/WMV/RM to Audio CD Burner, MP3/WAV/OGG/WMA/AC3 to CD Burner, MP3 WAV to CD Burner, My Video Converter, Easy AVI DivX Converter, Easy Video to iPod Converter, Easy Video to PSP Converter, Easy Video to 3GP Converter, Easy Video to MP4 Converter, and Easy Video to iPod/MP4/PSP/3GP Converter allows local attackers to cause a denial of service (SEH overwrite) or possibly have unspecified other impact via a long username.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/offensive-security/exploit-database/blob/master/platforms/windows/dos/41911.py; https://www.exploit-db.com/exploits/41911/; https://github.com/offensive-security/exploit-database/blob/master/platforms/windows/dos/41911.py
CVE: CVE-2017-8371
Published: 2017-04-30
Description: Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords, which might allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-522
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-343-01; http://www.datacenterdynamics.com/content-tracks/security-risk/schneider-patches-critical-vulnerability-in-struxureware-dcim/97738.fullarticle; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2016-343-01
CVE: CVE-2016-10349
Published: 2017-05-01
Description: The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100347; https://github.com/libarchive/libarchive/issues/834; https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
CVE: CVE-2016-10350
Published: 2017-05-01
Description: The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/libarchive/libarchive/issues/835; https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html; https://security.gentoo.org/glsa/201710-19
CVE: CVE-2016-10351
Published: 2017-05-01
Description: Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication information via standard filesystem operations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/telegramdesktop/tdesktop/issues/2666; https://github.com/telegramdesktop/tdesktop/pull/3842/commits/388703b9ca1912a5438e37f9dd54c35805f2c594; https://github.com/telegramdesktop/tdesktop/issues/2666
CVE: CVE-2017-6519
Published: 2017-05-01
Description: avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive  information from the responding device via port-5353 UDP packets.  NOTE: this may overlap CVE-2015-2809.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-346, CWE-346
References: https://bugzilla.redhat.com/show_bug.cgi?id=1426712; https://github.com/lathiat/avahi/issues/203; https://github.com/lathiat/avahi/issues/203#issuecomment-449536790
CVE: CVE-2017-6520
Published: 2017-05-01
Description: The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-417
References: https://www.secfu.net/advisories; https://www.secfu.net/advisories
CVE: CVE-2017-8372
Published: 2017-05-01
Description: The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-617
References: https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c/; https://lists.debian.org/debian-lts-announce/2018/05/msg00011.html; https://www.debian.org/security/2018/dsa-4192
CVE: CVE-2017-8373
Published: 2017-05-01
Description: The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_layer_iii-layer3-c/; https://lists.debian.org/debian-lts-announce/2018/05/msg00011.html; https://www.debian.org/security/2018/dsa-4192
CVE: CVE-2017-8374
Published: 2017-05-01
Description: The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c/; https://lists.debian.org/debian-lts-announce/2018/05/msg00011.html; https://www.debian.org/security/2018/dsa-4192
CVE: CVE-2017-8378
Published: 2017-05-01
Description: Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors related to m_offsets.size.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/xiangxiaobo/poc_and_report/tree/master/podofo_heapoverflow_PdfParser.ReadObjects; https://github.com/xiangxiaobo/poc_and_report/tree/master/podofo_heapoverflow_PdfParser.ReadObjects
CVE: CVE-2016-8649
Published: 2017-05-01
Description: lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94498; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845465; https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1639345
CVE: CVE-2017-8383
Published: 2017-05-01
Description: Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
CVSS Score: 5.3 (MEDIUM)
References: https://craftcms.com/changelog#2-6-2976; https://twitter.com/CraftCMS/status/[PII_REDACTED]24473088; https://craftcms.com/changelog#2-6-2976
CVE: CVE-2017-8384
Published: 2017-05-01
Description: Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://craftcms.com/changelog#2-6-2976; https://twitter.com/CraftCMS/status/[PII_REDACTED]24473088; https://craftcms.com/changelog#2-6-2976
CVE: CVE-2017-8385
Published: 2017-05-01
Description: Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640
References: https://craftcms.com/changelog#2-6-2976; https://twitter.com/CraftCMS/status/[PII_REDACTED]24473088; https://craftcms.com/changelog#2-6-2976
CVE: CVE-2017-5631
Published: 2017-05-01
Description: An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/42042/; https://www.openbugbounty.org/incidents/228262/; https://www.exploit-db.com/exploits/42042/
CVE: CVE-2017-6128
Published: 2017-05-01
Description: An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1038362; http://www.securitytracker.com/id/1038363; https://support.f5.com/csp/article/K92140924
CVE: CVE-2017-8376
Published: 2017-05-01
Description: GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/semplon/GeniXCMS/issues/72; https://github.com/semplon/GeniXCMS/issues/72
CVE: CVE-2017-8377
Published: 2017-05-01
Description: GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/semplon/GeniXCMS/issues/72; https://github.com/semplon/GeniXCMS/issues/72
CVE: CVE-2017-8388
Published: 2017-05-01
Description: GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism via a register.php?act=edit&id=1 request.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/semplon/GeniXCMS/issues/72; https://github.com/semplon/GeniXCMS/issues/72