deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8233
Published: 2017-06-13
Description: In a camera driver function in all Android releases from CAF using the Linux kernel, a bounds check is missing when writing into an array potentially leading to an out-of-bounds heap write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-8234
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, an out of bounds access can potentially occur in a camera function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-8235
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, a memory structure in a camera driver is not properly protected.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-8236
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an IPA driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-8237
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists while loading a firmware image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-8238
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a camera function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/2017-06-01; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-8239
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, userspace-controlled parameters for flash initialization are not sanitized potentially leading to exposure of kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-8240
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, a kernel driver has an off-by-one buffer over-read vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-8241
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a WLAN function due to an incorrect message length.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-8242
Published: 2017-06-13
Description: In all Android releases from CAF using the Linux kernel, a race condition exists in a QTEE driver potentially leading to an arbitrary memory write.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-5697
Published: 2017-06-14
Description: Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 11.6.25.1129 potentially allowing a remote attacker to hijack users web clicks via attacker's crafted web page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00081&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00081&languageid=en-fr
CVE: CVE-2017-0636
Published: 2017-06-14
Description: An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-35310230. References: M-ALPS03162263.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/98866; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0637
Published: 2017-06-14
Description: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process.Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34064500.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98868; http://www.securitytracker.com/id/1038623; https://android.googlesource.com/platform/external/libhevc/+/ebaa71da6362c497310377df[PII_REDACTED]01d258
CVE: CVE-2017-0638
Published: 2017-06-14
Description: A remote code execution vulnerability in System UI component could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High because it is a remote arbitrary code execution in an unprivileged process. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-36368305.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/98872; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0639
Published: 2017-06-14
Description: An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35310991.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98871; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0640
Published: 2017-06-14
Description: A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33129467.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/98868; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0641
Published: 2017-06-14
Description: A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34360591.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: http://www.securityfocus.com/bid/98868; http://www.securitytracker.com/id/1038623; https://android.googlesource.com/platform/external/libvpx/+/698796fc930baecf5c3fdebef17e73d5d9a58bcb
CVE: CVE-2017-0642
Published: 2017-06-14
Description: A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34819017.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/98868; http://www.securitytracker.com/id/1038623; https://android.googlesource.com/platform/external/libhevc/+/913d9e8d93d6b81bb8eac3fc2c1426651f5b259d
CVE: CVE-2017-0643
Published: 2017-06-14
Description: A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-35645051.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/98868; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0644
Published: 2017-06-14
Description: A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1. Android ID: A-35472997.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/98868; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0645
Published: 2017-06-14
Description: An elevation of privilege vulnerability in Bluetooth could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it is a local bypass of user interaction requirements. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35385327.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98871; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0646
Published: 2017-06-14
Description: An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate due to details specific to the vulnerability. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-33899337.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98871; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0647
Published: 2017-06-14
Description: An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36392138.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98877; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0648
Published: 2017-06-14
Description: An elevation of privilege vulnerability in the kernel FIQ debugger could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-36101220.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/98875; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0649
Published: 2017-06-14
Description: An elevation of privilege vulnerability in the MediaTek sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and because of vulnerability specific details which limit the impact of the issue. Product: Android. Versions: N/A. Android ID: A-34468195. References: M-ALPS03162283.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/98866; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0650
Published: 2017-06-14
Description: An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Low because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35472278.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-0651
Published: 2017-06-14
Description: An information disclosure vulnerability in the kernel ION subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Low because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-35644815.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98875; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-0663
Published: 2017-06-14
Description: A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3952; http://www.securityfocus.com/bid/98877; http://www.securitytracker.com/id/1038623
CVE: CVE-2017-2810
Published: 2017-06-14
Description: An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/99076; https://security.gentoo.org/glsa/201811-18; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0307
CVE: CVE-2017-9502
Published: 2017-06-14
Description: In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://openwall.com/lists/oss-security/2017/06/14/1; http://www.securityfocus.com/bid/99120; http://www.securitytracker.com/id/1038697
CVE: CVE-2016-8746
Published: 2017-06-14
Description: Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-426
References: http://www.securityfocus.com/bid/95998; https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; http://www.securityfocus.com/bid/95998
CVE: CVE-2016-8751
Published: 2017-06-14
Description: Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99067; https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; http://www.securityfocus.com/bid/99067
CVE: CVE-2017-7676
Published: 2017-06-14
Description: Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98958; https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; http://www.securityfocus.com/bid/98958
CVE: CVE-2017-7677
Published: 2017-06-14
Description: In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862
References: http://www.securityfocus.com/bid/98961; https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; http://www.securityfocus.com/bid/98961
CVE: CVE-2017-9463
Published: 2017-06-14
Description: The application Piwigo is affected by a SQL injection vulnerability in version 2.9.0 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The user_list_backend.php component is affected: values of the iDisplayStart & iDisplayLength parameters are not sanitized; these are used to construct a SQL query and retrieve a list of registered users into the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/commit/42920897ce927c236728d387f61bf03d117109a2; https://github.com/Piwigo/Piwigo/issues/705; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-003
CVE: CVE-2017-9464
Published: 2017-06-14
Description: An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the "redirect" parameter is not validated.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/Piwigo/Piwigo/issues/706; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-007; https://github.com/Piwigo/Piwigo/issues/706
CVE: CVE-2017-8907
Published: 2017-06-14
Description: Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so.  An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent.  By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: http://www.securityfocus.com/bid/99090; https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-06-14-907283498.html; http://www.securityfocus.com/bid/99090
CVE: CVE-2017-9616
Published: 2017-06-14
Description: In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrolled recursion) in the dissect_mp4_box function in epan/dissectors/file-mp4.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: http://www.securityfocus.com/bid/99085; http://www.securitytracker.com/id/1038706; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13777
CVE: CVE-2017-9617
Published: 2017-06-14
Description: In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion (uncontrolled recursion) in the dissect_daap_one_tag function in epan/dissectors/packet-daap.c in the DAAP dissector.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: http://www.securityfocus.com/bid/99087; http://www.securitytracker.com/id/1038706; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13799
CVE: CVE-2017-4981
Published: 2017-06-14
Description: EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.securityfocus.com/archive/1/540720/30/0/threaded; http://www.securityfocus.com/bid/99044; http://www.securitytracker.com/id/1038695
CVE: CVE-2017-4986
Published: 2017-06-14
Description: EMC ESRS VE 3.18 or earlier contains Authentication Bypass that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/540721/30/0/threaded; http://www.securityfocus.com/bid/99036; http://www.securitytracker.com/id/1038696
CVE: CVE-2017-7910
Published: 2017-06-14
Description: A Stack-Based Buffer Overflow issue was discovered in Digital Canal Structural Wind Analysis versions 9.1 and prior. An attacker may be able to run arbitrary code by remotely exploiting an executable to perform a denial-of-service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/98976; https://ics-cert.us-cert.gov/advisories/ICSA-17-157-02; http://www.securityfocus.com/bid/98976
CVE: CVE-2017-7914
Published: 2017-06-14
Description: A Missing Authorization issue was discovered in Rockwell Automation PanelView Plus 6 700-1500 6.00.04, 6.00.05, 6.00.42, 6.00-20140306, 6.10.20121012, 6.10-20140122, 7.00-20121012, 7.00-20130108, 7.00-20130325, 7.00-20130619, 7.00-20140128, 7.00-20140310, 7.00-20140429, 7.00-20140621, 7.00-20140729, 7.00-20141022, 8.00-20140730, and 8.00-20141023. There is no authorization check when connecting to the device, allowing an attacker remote access.
CVSS Score: 8.6 (HIGH)
CWE: CWE-882, CWE-862
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-157-01; https://ics-cert.us-cert.gov/advisories/ICSA-17-157-01
CVE: CVE-2017-9621
Published: 2017-06-14
Description: Cross-site scripting (XSS) vulnerability in modules/Base/Lang/Administrator/update_translation.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) original or (2) new parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Telaxus/EPESI/commit/3cd666558c89d9c4b27eb74bf6b8e81b4f6e7118; https://github.com/Telaxus/EPESI/issues/185; https://github.com/Telaxus/EPESI/commit/3cd666558c89d9c4b27eb74bf6b8e81b4f6e7118
CVE: CVE-2017-9622
Published: 2017-06-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted common data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Telaxus/EPESI/commit/48fb5e81cd7a47d98bade092a5a72d8177621dbd; https://github.com/Telaxus/EPESI/issues/186; https://github.com/Telaxus/EPESI/commit/48fb5e81cd7a47d98bade092a5a72d8177621dbd
CVE: CVE-2017-9623
Published: 2017-06-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted country data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Telaxus/EPESI/commit/48fb5e81cd7a47d98bade092a5a72d8177621dbd; https://github.com/Telaxus/EPESI/issues/186; https://github.com/Telaxus/EPESI/commit/48fb5e81cd7a47d98bade092a5a72d8177621dbd