deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14983
Published: 2017-10-03
Description: Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/admin_conf/index.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/jsj730sos/cve/blob/master/Eonweb_module_admin_conf_index%20xss; https://github.com/jsj730sos/cve/blob/master/Eonweb_module_admin_conf_index%20xss
CVE: CVE-2017-14984
Published: 2017-10-03
Description: Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the bp_name parameter to /module/admin_bp/add_services.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jsj730sos/cve/blob/master/Eonweb_module_admin_bp_add_services_XSS; https://github.com/jsj730sos/cve/blob/master/Eonweb_module_admin_bp_add_services_XSS
CVE: CVE-2017-14985
Published: 2017-10-03
Description: Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the url parameter to module/module_frame/index.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jsj730sos/cve/blob/master/Eonweb_module_module_frame_module_frame.php%20xss; https://github.com/jsj730sos/cve/blob/master/Eonweb_module_module_frame_module_frame.php%20xss
CVE: CVE-2017-14988
Published: 2017-10-03
Description: Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00063.html; https://github.com/openexr/openexr/issues/248; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00063.html
CVE: CVE-2017-14989
Published: 2017-10-03
Description: A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, because the FT_Done_Glyph function (from FreeType 2) is called at an incorrect place in the ImageMagick code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/ImageMagick/ImageMagick/issues/781; https://usn.ubuntu.com/3681-1/; https://www.debian.org/security/2017/dsa-4032
CVE: CVE-2017-14990
Published: 2017-10-03
Description: WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: http://www.securitytracker.com/id/1039554; https://core.trac.wordpress.org/ticket/38474; https://www.debian.org/security/2017/dsa-3997
CVE: CVE-2017-1569
Published: 2017-10-03
Description: IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service. IBM X-Force ID: 131779.
CVSS Score: 7.5 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22008547; http://www.securityfocus.com/bid/101073; https://exchange.xforce.ibmcloud.com/vulnerabilities/131779
CVE: CVE-2017-6089
Published: 2017-10-03
Description: SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id parameters to topics/deletetopics.php; the (2) id parameter to bookmarks/deletebookmarks.php; or the (3) id parameter to calendar/deletecalendar.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://sysdream.com/news/lab/2017-09-29-cve-2017-6089-phpcollab-2-5-1-multiple-sql-injections-unauthenticated/; https://www.exploit-db.com/exploits/42935/; https://sysdream.com/news/lab/2017-09-29-cve-2017-6089-phpcollab-2-5-1-multiple-sql-injections-unauthenticated/
CVE: CVE-2017-6090
Published: 2017-10-03
Description: Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://sysdream.com/news/lab/2017-09-29-cve-2017-6090-phpcollab-2-5-1-arbitrary-file-upload-unauthenticated/; https://www.exploit-db.com/exploits/42934/; https://www.exploit-db.com/exploits/43519/
CVE: CVE-2017-8018
Published: 2017-10-03
Description: EMC AppSync host plug-in versions 3.5 and below (Windows platform only) includes a denial of service (DoS) vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2017/Sep/75; http://www.securityfocus.com/bid/101016; http://seclists.org/fulldisclosure/2017/Sep/75
CVE: CVE-2017-8021
Published: 2017-10-03
Description: EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by malicious users to compromise the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: http://seclists.org/fulldisclosure/2017/Sep/74; http://www.securityfocus.com/bid/101018; http://seclists.org/fulldisclosure/2017/Sep/74
CVE: CVE-2017-9537
Published: 2017-10-03
Description: Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/541262/100/0/threaded; http://www.securityfocus.com/bid/101071; http://www.securityfocus.com/archive/1/541262/100/0/threaded
CVE: CVE-2017-9538
Published: 2017-10-03
Description: The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a "Cannot exit above the top directory" error message throughout the entire web application) via a ".." in the path field. In other words, the denial of service is caused by an incorrect implementation of a directory-traversal protection mechanism.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/541263/100/0/threaded; http://www.securityfocus.com/bid/101066; http://www.securityfocus.com/archive/1/541263/100/0/threaded
CVE: CVE-2017-9797
Published: 2017-10-03
Description: When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://mail-archives.apache.org/mod_mbox/geode-user/201709.mbox/%3cCAEwge-Hrbb7JS8Nygrh7geyFvW4bMZ3AdCmPOzMfvbniipz0bA%40mail.gmail.com%3e; http://mail-archives.apache.org/mod_mbox/geode-user/201709.mbox/%3cCAEwge-Hrbb7JS8Nygrh7geyFvW4bMZ3AdCmPOzMfvbniipz0bA%40mail.gmail.com%3e
CVE: CVE-2017-0806
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the Android framework (gatekeeperresponse). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62998805.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/101086; https://android.googlesource.com/platform/frameworks/base/+/b87c968e5a41a1a09166199bf54eee12608f3900; https://source.android.com/security/bulletin/2017-10-01
CVE: CVE-2017-0807
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the Android framework (ui framework). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35056974.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/101190; http://www.securityfocus.com/bid/102131; https://source.android.com/security/bulletin/2017-12-01
CVE: CVE-2017-0808
Published: 2017-10-04
Description: An information disclosure vulnerability in the Android framework (file system). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62301183.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101190; https://android.googlesource.com/platform/libcore/+/809681f310663288e83587089abb7715c68f6924; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0809
Published: 2017-10-04
Description: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673128.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101088; https://android.googlesource.com/platform/frameworks/av/+/552a3b5df2a6876d10da20f72e4cc0d44ac2c790; https://source.android.com/security/bulletin/2017-10-01
CVE: CVE-2017-0810
Published: 2017-10-04
Description: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38207066.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101088; https://android.googlesource.com/platform/external/libmpeg2/+/[PII_REDACTED]fe523ad7b0e49456eb75d27a30818a; https://source.android.com/security/bulletin/2017-10-01
CVE: CVE-2017-0811
Published: 2017-10-04
Description: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37930177.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/101088; https://android.googlesource.com/platform/external/libhevc/+/25c0ffbe6a181b4a373c3c9b421ea449d457e6ed; https://source.android.com/security/bulletin/2017-10-01
CVE: CVE-2017-0812
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the Android media framework (audio hal). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62873231.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/101088; https://android.googlesource.com/device/google/dragon/+/7df7ec13b1d222ac3a66797fbe432605ea8f973f; https://source.android.com/security/bulletin/2017-10-01
CVE: CVE-2017-0813
Published: 2017-10-04
Description: A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36531046.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/101151; https://android.googlesource.com/platform/frameworks/av/+/7fa3f552a6f34ed05c15e64ea30b8eed53f77a41; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0814
Published: 2017-10-04
Description: An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62800140.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101151; https://android.googlesource.com/platform/external/tremolo/+/eeb4e45d5683f88488c083ecf142dc89bc3f0b47; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0815
Published: 2017-10-04
Description: An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63526567.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101088; https://android.googlesource.com/platform/frameworks/av/+/f490fc335772a9b14e78997486f4a572b0594c04; https://source.android.com/security/bulletin/2017-10-01
CVE: CVE-2017-0816
Published: 2017-10-04
Description: An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63662938.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101088; https://android.googlesource.com/platform/frameworks/av/+/f490fc335772a9b14e78997486f4a572b0594c04; https://source.android.com/security/bulletin/2017-10-01
CVE: CVE-2017-0817
Published: 2017-10-04
Description: An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63522430.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101151; https://android.googlesource.com/platform/frameworks/av/+/d834160d9759f1098df692b34e6eeb548f9e317b; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0818
Published: 2017-10-04
Description: A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63581671.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/101151; https://android.googlesource.com/platform/frameworks/av/+/d07f5c14e811951ff9b411ceb84e7288e0d04aaf; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0819
Published: 2017-10-04
Description: A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63045918.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: http://www.securityfocus.com/bid/101151; https://android.googlesource.com/platform/external/libhevc/+/87fb7909c49e6a4510ba86ace1ffc83459c7e1b9; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0820
Published: 2017-10-04
Description: A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62187433.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/101151; https://android.googlesource.com/platform/frameworks/av/+/8a3a2f6ea7defe1a81bb32b3c9f3537f84749b9d; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0822
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the Android system (camera). Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63787722.
CVSS Score: 9.8 (CRITICAL)
References: https://android.googlesource.com/platform/frameworks/base/+/c574568aaede7f652432deb7707f20ae54bbdf9a; https://source.android.com/security/bulletin/pixel/2017-10-01; https://android.googlesource.com/platform/frameworks/base/+/c574568aaede7f652432deb7707f20ae54bbdf9a
CVE: CVE-2017-0823
Published: 2017-10-04
Description: An information disclosure vulnerability in the Android system (rild). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37896655.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://android.googlesource.com/platform/hardware/ril/+/cd5f15f588a5d27e99ba12f057245bfe507f8c42; https://source.android.com/security/bulletin/pixel/2017-10-01; https://android.googlesource.com/platform/hardware/ril/+/cd5f15f588a5d27e99ba12f057245bfe507f8c42
CVE: CVE-2017-0824
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37622847. References: B-V[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2017-10-01; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0825
Published: 2017-10-04
Description: An information disclosure vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37305633. References: B-V[PII_REDACTED].
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-10-01; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0826
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the HTC bootloader. Product: Android. Versions: Android kernel. Android ID: A-34949781.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-10-01; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0827
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-62539960. References: M-ALPS03353876, M-ALPS03353861, M-ALPS03353869, M-ALPS03353867, M-ALPS03353872.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/101120; https://source.android.com/security/bulletin/2017-10-01; http://www.securityfocus.com/bid/101120
CVE: CVE-2017-0828
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the Huawei bootloader. Product: Android. Versions: Android kernel. Android ID: A-34622855.
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2017-10-01; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-0829
Published: 2017-10-04
Description: An elevation of privilege vulnerability in the Motorola bootloader. Product: Android. Versions: Android kernel. Android ID: A-62345044.
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/pixel/2017-10-01; https://source.android.com/security/bulletin/pixel/2017-10-01
CVE: CVE-2017-11122
Published: 2017-10-04
Description: On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 router advertisement offloading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/144461/Broadcom-ICMPv6-Information-Leak.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1300; https://support.apple.com/HT208112
CVE: CVE-2017-1126
Published: 2017-10-04
Description: IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that could lead to further attacks. IBM X-Force ID: 121341.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22008470; http://www.securityfocus.com/bid/101104; https://exchange.xforce.ibmcloud.com/vulnerabilities/121341
CVE: CVE-2017-12166
Published: 2017-10-04
Description: OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/101153; http://www.securitytracker.com/id/1039470; https://community.openvpn.net/openvpn/wiki/CVE-2017-12166
CVE: CVE-2017-12617
Published: 2017-10-04
Description: When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434, CWE-434
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2017-12818
Published: 2017-10-04
Description: Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102906; https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-004-sentinel-ldk-rte-stack-overflow-in-custom-xml-parser-leads-to-remote-denial-of-service/
CVE: CVE-2017-12819
Published: 2017-10-04
Description: Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-005-sentinel-ldk-rte-remote-manipulations-with-language-pack-updater-lead-to-ntlm-relay-attack-for-system-user/; https://ics-cert.us-cert.gov/advisories/ICSA-18-093-01
CVE: CVE-2017-12820
Published: 2017-10-04
Description: Arbitrary memory read from controlled memory pointer in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102906; https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-006-sentinel-ldk-rte-arbitrary-memory-read-from-controlled-memory-pointer-leads-to-remote-denial-of-service/
CVE: CVE-2017-12821
Published: 2017-10-04
Description: Memory corruption in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 might cause remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102906; https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-007-sentinel-ldk-rte-memory-corruption-might-cause-remote-code-execution/
CVE: CVE-2017-12822
Published: 2017-10-04
Description: Remote enabling and disabling admin interface in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to new attack vectors.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/102906; https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-008-sentinel-ldk-rte-remote-enabling-and-disabling-admin-interface/
CVE: CVE-2017-14491
Published: 2017-10-04
Description: Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html
CVE: CVE-2017-14991
Published: 2017-10-04
Description: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3e[PII_REDACTED]e0fe3af380410eababe5a47c4cf9; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.4; http://www.securityfocus.com/bid/101187