deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12796
Published: 2017-10-23
Description: The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system commands by crafting malicious XML payloads, as demonstrated by a single admin/reports/reportSchemaXml.form request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html; https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291; https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1
CVE: CVE-2017-14327
Published: 2017-10-23
Description: Extreme EXOS 16.x, 21.x, and 22.x allows administrators to read arbitrary files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://extremeportal.force.com/ExtrArticleDetail?n=000017719; https://extremeportal.force.com/ExtrArticleDetail?n=000017719
CVE: CVE-2017-14328
Published: 2017-10-23
Description: Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://extremeportal.force.com/ExtrArticleDetail?n=000017765; https://extremeportal.force.com/ExtrArticleDetail?n=000017765
CVE: CVE-2017-14329
Published: 2017-10-23
Description: Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shell.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://extremeportal.force.com/ExtrArticleDetail?n=000017719; https://extremeportal.force.com/ExtrArticleDetail?n=000017719
CVE: CVE-2017-14330
Published: 2017-10-23
Description: Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving a privileged process.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://extremeportal.force.com/ExtrArticleDetail?n=000017719; https://extremeportal.force.com/ExtrArticleDetail?n=000017719
CVE: CVE-2017-14331
Published: 2017-10-23
Description: Extreme EXOS 16.x, 21.x, and 22.x allows administrators to bypass the "exsh restricted shell" protection mechanism and obtain an interactive shell.
CVSS Score: 6.7 (MEDIUM)
References: https://extremeportal.force.com/ExtrArticleDetail?n=000017719; https://extremeportal.force.com/ExtrArticleDetail?n=000017719
CVE: CVE-2017-14332
Published: 2017-10-23
Description: Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values.
CVSS Score: 8.1 (HIGH)
References: https://extremeportal.force.com/ExtrArticleDetail?n=000017765; https://extremeportal.force.com/ExtrArticleDetail?n=000017765
CVE: CVE-2017-15377
Published: 2017-10-23
Description: In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default).
CVSS Score: 7.5 (HIGH)
References: https://github.com/OISF/suricata/commit/b9579fbe7dd408200ef03cbe20efddb624b73885; https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html; https://redmine.openinfosecfoundation.org/issues/2231
CVE: CVE-2017-15378
Published: 2017-10-23
Description: SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://whiteboyz.xyz/esic-software-publico-sql-injection.html; https://www.exploit-db.com/exploits/42981/; http://whiteboyz.xyz/esic-software-publico-sql-injection.html
CVE: CVE-2017-15379
Published: 2017-10-23
Description: An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://whiteboyz.xyz/esic-software-publico-autentication-bypass.html; https://www.exploit-db.com/exploits/42980/; http://whiteboyz.xyz/esic-software-publico-autentication-bypass.html
CVE: CVE-2017-15380
Published: 2017-10-23
Description: XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://whiteboyz.xyz/esic-software-publico-xss.html; https://www.exploit-db.com/exploits/42983/; http://whiteboyz.xyz/esic-software-publico-xss.html
CVE: CVE-2017-15381
Published: 2017-10-23
Description: SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/42982/; https://www.exploit-db.com/exploits/42982/
CVE: CVE-2017-15567
Published: 2017-10-23
Description: The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors.  NOTE: the vendor disputes this because there is no command shell in the product or in the associated SDK
CVSS Score: 7.8 (HIGH)
References: https://gist.github.com/shiham101/4c49ece8ecac7c3c02ecbc6942aeca80; https://gist.github.com/shiham101/4c49ece8ecac7c3c02ecbc6942aeca80
CVE: CVE-2017-15580
Published: 2017-10-23
Description: osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://0day.today/exploits/28864; http://nakedsecurity.com/cve/CVE-2017-15580/; https://becomepentester.blogspot.com/2017/10/osTicket-File-Upload-Restrictions-Bypassed-CVE-2017-15580.html
CVE: CVE-2017-15687
Published: 2017-10-23
Description: DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fireshellsecurity.team/assets/pdf/DOM-Based-Cross-Site-Scripting-_XSS_-Logitech-Media-Server.pdf; https://www.exploit-db.com/exploits/43024/; https://fireshellsecurity.team/assets/pdf/DOM-Based-Cross-Site-Scripting-_XSS_-Logitech-Media-Server.pdf
CVE: CVE-2017-15805
Published: 2017-10-23
Description: Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter, for reading arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.fwhibbit.es/lfi-en-cisco-small-business-sa500-series-cuando-la-seguridad-de-tu-red-esta-hecha-un-cisco; https://www.fwhibbit.es/lfi-en-cisco-small-business-sa500-series-cuando-la-seguridad-de-tu-red-esta-hecha-un-cisco
CVE: CVE-2017-9946
Published: 2017-10-23
Description: A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. An attacker with network access to the integrated web server (80/tcp and 443/tcp) could bypass the authentication and download sensitive information from the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: http://packetstormsecurity.com/files/169544/Siemens-APOGEE-PXC-TALON-TC-Authentication-Bypass.html; http://www.securityfocus.com/bid/101248; https://cert-portal.siemens.com/productcert/pdf/ssa-148078.pdf
CVE: CVE-2017-9947
Published: 2017-10-23
Description: A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/tcp) to obtain information on the structure of the file system of the affected devices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-538, CWE-22
References: http://packetstormsecurity.com/files/169544/Siemens-APOGEE-PXC-TALON-TC-Authentication-Bypass.html; http://www.securityfocus.com/bid/101248; https://cert-portal.siemens.com/productcert/pdf/ssa-148078.pdf
CVE: CVE-2010-2232
Published: 2017-10-23
Description: In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://db.apache.org/derby/releases/release-10.6.2.1.html#Note+for+DERBY-2925; http://www.securityfocus.com/bid/101562; https://issues.apache.org/jira/browse/DERBY-2925
CVE: CVE-2016-10516
Published: 2017-10-23
Description: Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://blog.neargle.com/2016/09/21/flask-src-review-get-a-xss-from-debuger/; https://github.com/pallets/werkzeug/pull/1001; https://lists.debian.org/debian-lts-announce/2017/11/msg00037.html
CVE: CVE-2017-15808
Published: 2017-10-23
Description: In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2017-15808.md; https://github.com/thorsten/phpMyFAQ/commit/a249b4645fb86f6a9fbe5d2344ab1cbdb906b75c; https://github.com/thorsten/phpMyFAQ/commit/a249b4645fb86f6a9fbe5d2344ab1cbdb906b75c
CVE: CVE-2017-15809
Published: 2017-10-23
Description: In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpMyFAQ/commit/cb648f0d5690b81647dd5c9efe942ebf6cce7da9; https://github.com/thorsten/phpMyFAQ/commit/cb648f0d5690b81647dd5c9efe942ebf6cce7da9
CVE: CVE-2017-15810
Published: 2017-10-23
Description: The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/144583/WordPress-PopCash.Net-Publisher-Code-Integration-1.0-Cross-Site-Scripting.html; https://wordpress.org/plugins/popcashnet-code-integration-tool/#developers; https://wpvulndb.com/vulnerabilities/8936
CVE: CVE-2017-15811
Published: 2017-10-23
Description: The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/144582/WordPress-Pootle-Button-1.1.1-Cross-Site-Scripting.html; https://plugins.trac.wordpress.org/changeset/1745805/pootle-button/tags/; https://wpvulndb.com/vulnerabilities/8930
CVE: CVE-2017-15812
Published: 2017-10-23
Description: The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/easy-appointments/#developers; https://wpvulndb.com/vulnerabilities/8937; https://wordpress.org/plugins/easy-appointments/#developers
CVE: CVE-2011-2683
Published: 2017-10-23
Description: reseed seeds random numbers from an insecure HTTP request to random.org during installation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a man-in-the-middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2011/07/06/8; http://www.openwall.com/lists/oss-security/2014/02/08/5; https://bugs.launchpad.net/ubuntu/+source/reseed/+bug/804594
CVE: CVE-2011-2684
Published: 2017-10-23
Description: foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908dfsg-5.1+squeeze0 as packaged in Debian squeeze create temporary files insecurely, which allows local users to write over arbitrary files via a symlink attack on /tmp/foo2zjs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2011/07/06/10; http://www.openwall.com/lists/oss-security/2014/02/08/5; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633870
CVE: CVE-2011-4333
Published: 2017-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) from parameter to index.php or the (2) page_no parameter to recentchanges.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2011/11/21/16; http://www.openwall.com/lists/oss-security/2014/02/08/5; http://www.openwall.com/lists/oss-security/2011/11/21/16
CVE: CVE-2011-4334
Published: 2017-10-23
Description: edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://www.openwall.com/lists/oss-security/2011/11/21/16; http://www.openwall.com/lists/oss-security/2014/02/08/5; http://www.openwall.com/lists/oss-security/2011/11/21/16
CVE: CVE-2012-4567
Published: 2017-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) inc/inc.ClassUI.php or (2) out/out.DocumentNotify.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOG; http://www.openwall.com/lists/oss-security/2012/10/06/1; http://www.openwall.com/lists/oss-security/2012/10/31/7
CVE: CVE-2012-4568
Published: 2017-10-23
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOG; http://www.openwall.com/lists/oss-security/2012/10/06/1; http://www.openwall.com/lists/oss-security/2012/10/31/7
CVE: CVE-2012-4569
Published: 2017-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOG; http://www.openwall.com/lists/oss-security/2012/10/06/1; http://www.openwall.com/lists/oss-security/2012/10/31/7
CVE: CVE-2012-4570
Published: 2017-10-23
Description: SQL injection vulnerability in LetoDMS_Core/Core/inc.ClassDMS.php in LetoDMS (formerly MyDMS) before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://sourceforge.net/p/mydms/code/HEAD/tree/trunk/CHANGELOG; http://www.openwall.com/lists/oss-security/2012/10/06/1; http://www.openwall.com/lists/oss-security/2012/10/31/7
CVE: CVE-2013-7377
Published: 2017-10-23
Description: The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: http://www.openwall.com/lists/oss-security/2014/05/13/1; http://www.openwall.com/lists/oss-security/2014/05/15/2; https://nodesecurity.io/advisories/codem-transcode_command_injection
CVE: CVE-2014-3741
Published: 2017-10-23
Description: The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.openwall.com/lists/oss-security/2014/05/13/1; http://www.openwall.com/lists/oss-security/2014/05/15/2; https://github.com/tojocky/node-printer/commit/e001e38738c17219a1d9dd8c31f7d82b9c0013c7
CVE: CVE-2014-3744
Published: 2017-10-23
Description: Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2014/05/13/1; http://www.openwall.com/lists/oss-security/2014/05/15/2; http://www.securityfocus.com/bid/67389
CVE: CVE-2015-2878
Published: 2017-10-23
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2) Url matching, (3) DNS Inject, or (4) IP Redirect Sensor in a request to interface/rest/dpi/setEnabled/1; or (5) perform whitelisting of malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/archive/1/536074/100/0/threaded; http://www.securityfocus.com/archive/1/536076/100/0/threaded; https://www.exploit-db.com/exploits/37686/
CVE: CVE-2015-5379
Published: 2017-10-23
Description: Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132764/Axigen-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/536046/100/0/threaded; https://blogs.securiteam.com/index.php/archives/2534
CVE: CVE-2015-5532
Published: 2017-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132812/WordPress-Paid-Memberships-Pro-1.8.4.2-Cross-Site-Scripting.html; http://www.paidmembershipspro.com/2015/07/pmpro-updates-1-8-4-3-and-1-8-4-4/; http://www.securityfocus.com/archive/1/536057/100/0/threaded
CVE: CVE-2015-5533
Published: 2017-10-23
Description: SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpd_keep_month parameter to wp-admin/options-general.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132811/WordPress-Count-Per-Day-3.4-SQL-Injection.html; http://www.securityfocus.com/archive/1/536056/100/0/threaded; https://plugins.trac.wordpress.org/changeset/1190683/count-per-day
CVE: CVE-2015-6839
Published: 2017-10-23
Description: The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://docs.google.com/document/d/13t1jqu-Upj4SyjYBMj3OMshdy6rGBrnb1R3P-goz-cs/edit?pli=1; https://docs.google.com/document/d/1aH6kvoLR8O1qWOpEz89FAB2xFcBNB-QqHgZpXxg0vGE/preview?sle=true&pli=1; https://www.eleccionesciudad.gob.ar/uploads/resoluciones/Informe_05-BALOTAJE-2015-07-17.pdf
CVE: CVE-2017-13772
Published: 2017-10-23
Description: Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the (1) ping_addr parameter to PingIframeRpm.htm or (2) dnsserver2 parameter to WanStaticIpV6CfgRpm.htm.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/158999/TP-Link-WDR4300-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/43022/; https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772/
CVE: CVE-2017-13682
Published: 2017-10-23
Description: In Symantec Encryption Desktop before SED 10.4.1 MP2HF1, a kernel memory leak is a type of resource leak that can occur when a computer program incorrectly manages memory allocations in such a way that memory which is no longer needed is not released. In object-oriented programming, a memory leak may happen when an object is stored in memory but cannot be accessed by the running code.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/101497; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171009_00; http://www.securityfocus.com/bid/101497
CVE: CVE-2017-13683
Published: 2017-10-23
Description: In Symantec Endpoint Encryption before SEE 11.1.3HF3, a kernel memory leak is a type of resource leak that can occur when a computer program incorrectly manages memory allocations in such a way that memory which is no longer needed is not released. In object-oriented programming, a memory leak may happen when an object is stored in memory but cannot be accessed by the running code.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/101498; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171009_00; http://www.securityfocus.com/bid/101498
CVE: CVE-2017-12613
Published: 2017-10-24
Description: When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://www.apache.org/dist/apr/Announcement1.x.html; http://www.openwall.com/lists/oss-security/2021/08/23/1; http://www.securityfocus.com/bid/101560
CVE: CVE-2017-12618
Published: 2017-10-24
Description: Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-125
References: http://mail-archives.apache.org/mod_mbox/apr-dev/201710.mbox/%3CCACsi252POs4toeJJciwg09_eu2cO3XFg%3DUqsPjXsfjDoeC3-UQ%40mail.gmail.com%3E; http://www.securityfocus.com/bid/101558; http://www.securitytracker.com/id/1042004
CVE: CVE-2017-15081
Published: 2017-10-24
Description: In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://w00troot.blogspot.in/2017/10/php-melody-2.html; https://pastebin.com/7Xjm8Wqt; https://www.exploit-db.com/exploits/43062/
CVE: CVE-2014-0691
Published: 2017-10-24
Description: Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password, aka Bug ID CSCuc79643.
CVSS Score: 7.3 (HIGH)
CWE: CWE-331
References: https://www.cisco.com/c/en/us/td/docs/collaboration/CWMS/1_1/b_Release_Notes.html; https://www.cisco.com/c/en/us/td/docs/collaboration/CWMS/1_1/b_Release_Notes.html