deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6037
Published: 2017-04-27
Description: A Heap-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. This vulnerability causes a buffer overflow when a maliciously crafted project file is run by the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-119
References: http://www.securityfocus.com/bid/97639; https://ics-cert.us-cert.gov/advisories/ICSA-17-103-01; http://www.securityfocus.com/bid/97639
CVE: CVE-2017-8287
Published: 2017-04-27
Description: FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc08b502c3e685afca098b6e8a195aded6a0; http://www.debian.org/security/2017/dsa-3839; http://www.securityfocus.com/bid/99091
CVE: CVE-2017-8288
Published: 2017-04-27
Description: gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98070; https://bugs.kali.org/view.php?id=2513; https://bugzilla.gnome.org/show_bug.cgi?id=781728
CVE: CVE-2017-8289
Published: 2017-04-27
Description: Stack-based buffer overflow in the ipv6_addr_from_str function in sys/net/network_layer/ipv6/addr/ipv6_addr_from_str.c in RIOT prior to 2017-04-25 allows local attackers, and potentially remote attackers, to cause a denial of service or possibly have unspecified other impact via a malformed IPv6 address.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/RIOT-OS/RIOT/issues/6840; https://github.com/RIOT-OS/RIOT/pull/6961; https://github.com/RIOT-OS/RIOT/pull/6962
CVE: CVE-2017-8291
Published: 2017-04-27
Description: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://openwall.com/lists/oss-security/2017/04/28/2; http://www.debian.org/security/2017/dsa-3838; http://www.securityfocus.com/bid/98476
CVE: CVE-2017-7415
Published: 2017-04-27
Description: Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97961; https://jira.atlassian.com/browse/CONFSERVER-52222; https://packetstormsecurity.com/files/142330/Confluence-6.0.x-Information-Disclosure.html
CVE: CVE-2017-3008
Published: 2017-04-27
Description: Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98002; http://www.securitytracker.com/id/1038364; https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
CVE: CVE-2017-3066
Published: 2017-04-27
Description: Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/98003; http://www.securitytracker.com/id/1038364; https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
CVE: CVE-2017-5186
Published: 2017-04-27
Description: Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x before 9.0.2 Hotfix 2 (9.0.2.2) use the deprecated MD5 hashing algorithm in a communications certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://bugzilla.novell.com/show_bug.cgi?id=1019041; https://bugzilla.novell.com/show_bug.cgi?id=1019789; https://bugzilla.novell.com/show_bug.cgi?id=988749
CVE: CVE-2017-8294
Published: 2017-04-27
Description: libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/98072; https://github.com/VirusTotal/yara/commit/83d799804648c2a0895d40a19835d9b757c6fa4e; https://github.com/VirusTotal/yara/issues/646
CVE: CVE-2017-5135
Published: 2017-04-27
Description: Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. The Technicolor (formerly Cisco) DPC3928SL with firmware D3928SL-P15-13-A386-c3420r55105-160127a could be reached by any SNMP community string from the Internet; also, you can write in the MIB because it provides write properties, aka Stringbleed. NOTE: the string-bleed/StringBleed-CVE-2017-5135 GitHub repository is not a valid reference as of 2017-04-27; it contains Trojan horse code purported to exploit this vulnerability.
CVSS Score: 9.1 (CRITICAL)
References: http://www.securityfocus.com/bid/98092; https://stringbleed.github.io/; https://www.reddit.com/r/netsec/comments/67qt6u/cve_20175135_snmp_authentication_bypass/
CVE: CVE-2017-8296
Published: 2017-04-27
Description: kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password entries created and consulted are also accessible in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://openwall.com/lists/oss-security/2017/04/26/9; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860817; https://security.gentoo.org/glsa/201708-04
CVE: CVE-2017-8297
Published: 2017-04-27
Description: A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple PHP File Manager" component).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/jcampbell1/simple-file-manager/commit/de52e7ee61a842d8fdf791f2a5b7c91b6c5cdb56; https://github.com/jcampbell1/simple-file-manager/commit/de52e7ee61a842d8fdf791f2a5b7c91b6c5cdb56
CVE: CVE-2017-8298
Published: 2017-04-27
Description: cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/cnvs/canvas/issues/331; https://github.com/cnvs/canvas/issues/331
CVE: CVE-2017-8301
Published: 2017-04-27
Description: LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://seclists.org/oss-sec/2017/q2/145; http://www.securityfocus.com/bid/98076; https://github.com/libressl-portable/portable/issues/307
CVE: CVE-2017-8302
Published: 2017-04-27
Description: Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dsp_nextn.cfm, admin/core/views/cusers/inc/dsp_search_form.cfm, admin/core/views/cusers/inc/dsp_users_list.cfm, admin/core/views/cusers/list.cfm, and admin/core/views/cusers/listusers.cfm.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/blueriver/MuraCMS/commit/0e387c9454b3c085fe5e7cd876ed746ca16d5308; https://github.com/blueriver/MuraCMS/issues/2577; https://github.com/blueriver/MuraCMS/commit/0e387c9454b3c085fe5e7cd876ed746ca16d5308
CVE: CVE-2017-8307
Published: 2017-04-27
Description: In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also exploitable in conjunction with CVE-2017-8308 when Avast Self-Defense is enabled. The vulnerability allows for Denial of Service attacks and hiding traces of a possible attack.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/98086; https://www.trustwave.com/Resources/Security-Advisories/Advisories/Multiple-Vulnerabilities-in-Avast-Antivirus/?fid=9201; http://www.securityfocus.com/bid/98086
CVE: CVE-2017-8308
Published: 2017-04-27
Description: In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/98084; https://www.trustwave.com/Resources/Security-Advisories/Advisories/Multiple-Vulnerabilities-in-Avast-Antivirus/?fid=9201; http://www.securityfocus.com/bid/98084
CVE: CVE-2017-8305
Published: 2017-04-27
Description: The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's strlcpy is used only on systems with a C library (e.g., glibc) that lacks its own strlcpy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861347; http://www.13thmonkey.org/udfclient/; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861347
CVE: CVE-2017-7895
Published: 2017-04-28
Description: The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3886; http://www.securityfocus.com/bid/98085; https://access.redhat.com/errata/RHSA-2017:1615
CVE: CVE-2016-7815
Published: 2017-04-28
Description: Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN19241292/index.html; http://www.securityfocus.com/bid/95379; https://support.cybozu.com/ja-jp/article/9689
CVE: CVE-2016-7839
Published: 2017-04-28
Description: Cross-site scripting vulnerability in Olive Blog allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN60879379/index.html; http://www.securityfocus.com/bid/95309; http://jvn.jp/en/jp/JVN60879379/index.html
CVE: CVE-2016-7840
Published: 2017-04-28
Description: Cross-site scripting vulnerability in WEB SCHEDULE allows remote attackers to inject arbitrary web script or HTML via the month parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN12124922/index.html; http://www.securityfocus.com/bid/95312; http://jvn.jp/en/jp/JVN12124922/index.html
CVE: CVE-2016-7841
Published: 2017-04-28
Description: Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN71538099/index.html; http://www.securityfocus.com/bid/95314; http://jvn.jp/en/jp/JVN71538099/index.html
CVE: CVE-2016-7842
Published: 2017-04-28
Description: Directory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier allows remote attackers to read arbitrary files via specially crafted ATC file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN83917769/index.html; http://www.securityfocus.com/bid/95450; https://hibara.org/software/attachecase/
CVE: CVE-2016-7843
Published: 2017-04-28
Description: Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 and earlier allows remote attackers to read arbitrary files via specially crafted ATC file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN28331227/index.html; http://maruuofactory.life.coocan.jp/attachecase/#pathTraversal; http://www.securityfocus.com/bid/95445
CVE: CVE-2017-2090
Published: 2017-04-28
Description: Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN73182875/index.html; http://www.securityfocus.com/bid/96429; https://support.cybozu.com/ja-jp/article/9499
CVE: CVE-2017-2091
Published: 2017-04-28
Description: Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN73182875/index.html; http://www.securityfocus.com/bid/96429; https://support.cybozu.com/ja-jp/article/9570
CVE: CVE-2017-2092
Published: 2017-04-28
Description: Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN73182875/index.html; http://www.securityfocus.com/bid/96429; https://support.cybozu.com/ja-jp/article/9555
CVE: CVE-2017-2093
Published: 2017-04-28
Description: Cybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN73182875/index.html; http://www.securityfocus.com/bid/96429; https://support.cybozu.com/ja-jp/article/9647
CVE: CVE-2017-2094
Published: 2017-04-28
Description: Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: http://jvn.jp/en/jp/JVN73182875/index.html; http://www.securityfocus.com/bid/96429; https://support.cybozu.com/ja-jp/article/9655
CVE: CVE-2017-2095
Published: 2017-04-28
Description: Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in the mail function leading to an alteration of the order of mail folders via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN73182875/index.html; http://www.securityfocus.com/bid/96429; https://support.cybozu.com/ja-jp/article/9660
CVE: CVE-2017-2096
Published: 2017-04-28
Description: smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN50197114/index.html; http://smalruby.jp/blog/2017/01/14/smalruby-editor-0-4-1-has-been-released-english.html; http://www.securityfocus.com/bid/95775
CVE: CVE-2017-2097
Published: 2017-04-28
Description: Cross-site request forgery (CSRF) vulnerability in Knowledge versions prior to v1.7.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN09460804/index.html; http://www.securityfocus.com/bid/95779; http://jvn.jp/en/jp/JVN09460804/index.html
CVE: CVE-2017-2098
Published: 2017-04-28
Description: Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN81618356/index.html; http://www.securityfocus.com/bid/95866; https://forums.cubecart.com/topic/52088-cubecart-614-released/
CVE: CVE-2017-2099
Published: 2017-04-28
Description: Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote code execution via unspecified vectors.
CVSS Score: 6.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN71666779/index.html; http://www.securityfocus.com/bid/96226; http://jvn.jp/en/jp/JVN71666779/index.html
CVE: CVE-2017-2100
Published: 2017-04-28
Description: Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows remote attackers to conduct DNS rebinding attacks via unspecified vectors.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN87662835/index.html; http://www.securityfocus.com/bid/96229; http://jvn.jp/en/jp/JVN87662835/index.html
CVE: CVE-2017-2101
Published: 2017-04-28
Description: Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN88176589/index.html; http://www.securityfocus.com/bid/96261; http://jvn.jp/en/jp/JVN88176589/index.html
CVE: CVE-2017-2102
Published: 2017-04-28
Description: Cross-site request forgery (CSRF) vulnerability in Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN39008927/index.html; http://www.securityfocus.com/bid/96260; http://jvn.jp/en/jp/JVN39008927/index.html
CVE: CVE-2017-2103
Published: 2017-04-28
Description: The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN01014759/index.html; http://www.securityfocus.com/bid/96004; http://jvn.jp/en/jp/JVN01014759/index.html
CVE: CVE-2017-2104
Published: 2017-04-28
Description: The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN21114208/index.html; http://www.securityfocus.com/bid/96005; http://jvn.jp/en/jp/JVN21114208/index.html
CVE: CVE-2017-2105
Published: 2017-04-28
Description: The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN53880182/index.html; http://www.securityfocus.com/bid/96232; http://jvn.jp/en/jp/JVN53880182/index.html
CVE: CVE-2017-2106
Published: 2017-04-28
Description: Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN34207650/index.html; http://www.securityfocus.com/bid/96227; https://github.com/webmin/webmin/commit/475cc4fbdf51c865b291d252d81a58bad05de0c7
CVE: CVE-2017-2107
Published: 2017-04-28
Description: Untrusted search path vulnerability in Self-extracting archive files created by 7-ZIP32.DLL 9.22.00.01 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://akky.xrea.jp/security/7-zip4.txt; http://jvn.jp/en/jp/JVN86200862/index.html; http://www.securityfocus.com/bid/96431
CVE: CVE-2017-2108
Published: 2017-04-28
Description: Untrusted search path vulnerability in PrimeDrive Desktop Application 1.4.3 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN88713190/index.html; http://www.securityfocus.com/bid/96619; http://www.softbank.jp/biz/news/cloud/170215/
CVE: CVE-2017-2109
Published: 2017-04-28
Description: Cybozu KUNAI for Android 3.0.4 to 3.0.5.1 allow remote attackers to obtain log information through a malicious Android application.
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN88745657/index.html; http://www.securityfocus.com/bid/96844; https://support.cybozu.com/ja-jp/article/9836
CVE: CVE-2017-2110
Published: 2017-04-28
Description: The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN82619692/index.html; http://www.securityfocus.com/bid/96615; http://jvn.jp/en/jp/JVN82619692/index.html
CVE: CVE-2017-2111
Published: 2017-04-28
Description: HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware version 1.18 and earlier may allow a remote attackers to display false information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: http://jvn.jp/en/jp/JVN46830433/index.html; http://www.iodata.jp/support/information/2017/camera201702/; http://www.securityfocus.com/bid/96620
CVE: CVE-2017-2112
Published: 2017-04-28
Description: TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware version 1.18 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN46830433/index.html; http://www.iodata.jp/support/information/2017/camera201702/; http://www.securityfocus.com/bid/96620
CVE: CVE-2017-2113
Published: 2017-04-28
Description: Buffer overflow in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware version 1.18 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN46830433/index.html; http://www.iodata.jp/support/information/2017/camera201702/; http://www.securityfocus.com/bid/96620
CVE: CVE-2017-2114
Published: 2017-04-28
Description: Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN17535578/index.html; http://www.securityfocus.com/bid/97717; https://support.cybozu.com/ja-jp/article/9738