deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-3880
Published: 2017-03-17
Description: An Authentication Bypass vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access limited meeting information on the Cisco WebEx Meetings Server. More Information: CSCvd50728. Known Affected Releases: 2.6 2.7 2.8 CWMS-2.5MR1 Orion1.1.2.patch T29_orion_merge.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/96918; http://www.securitytracker.com/id/1038040; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-webex
CVE: CVE-2017-3881
Published: 2017-03-17
Description: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/96960; http://www.securityfocus.com/bid/97391; http://www.securitytracker.com/id/1038059
CVE: CVE-2017-7174
Published: 2017-03-17
Description: The user-account creation feature in Chef Manage 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This is fixed in 2.4.5.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/97069; https://discourse.chef.io/t/chef-manage-2-4-5-security-release/10599; http://www.securityfocus.com/bid/97069
CVE: CVE-2017-2656
Published: 2017-03-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-6320.  Reason: This candidate is a reservation duplicate of CVE-2016-6320.  Notes: All CVE users should reference CVE-2016-6320 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-10253
Published: 2017-03-18
Description: An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/erlang/otp/pull/1108; https://usn.ubuntu.com/3571-1/; https://github.com/erlang/otp/pull/1108
CVE: CVE-2017-7177
Published: 2017-03-18
Description: Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: http://www.securityfocus.com/bid/97047; https://github.com/inliniac/suricata/commit/4a04f814b15762eb446a5ead4d69d021512df6f8; https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html
CVE: CVE-2017-7178
Published: 2017-03-18
Description: CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its __init__.py file and (2) causing the victim to download, install, and enable this plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://dev.deluge-torrent.org/wiki/ReleaseNotes/1.3.14; http://git.deluge-torrent.org/deluge/commit/?h=1.3-stable&id=318ab179865e0707d7945edc3a13a464a108d583; http://git.deluge-torrent.org/deluge/commit/?h=develop&id=11e8957deaf0c76fdfbac62d99c8b6c61cfdddf9
CVE: CVE-2016-8855
Published: 2017-03-19
Description: Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1 Update-3) allows remote attacks via the Name or Description parameter. This is fixed in 8.2 Update-2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/141655/Sitecore-Experience-Platform-8.1-Update-3-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/41618/; https://packetstormsecurity.com/files/141655/Sitecore-Experience-Platform-8.1-Update-3-Cross-Site-Scripting.html
CVE: CVE-2017-7184
Published: 2017-03-19
Description: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.
CVSS Score: 7.8 (HIGH)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=677e806da4d[PII_REDACTED]01785d847c3b3e6186a; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f843ee6dd019bcece3e74e76ad9df0155655d0df; http://openwall.com/lists/oss-security/2017/03/29/2
CVE: CVE-2017-5623
Published: 2017-03-19
Description: An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ftm/normal} command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any security-sensitive operation to be run unless the bootloader is unlocked.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/97048; https://alephsecurity.com/vulns/aleph-2017005; http://www.securityfocus.com/bid/97048
CVE: CVE-2014-9938
Published: 2017-03-20
Description: contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-116
References: https://access.redhat.com/errata/RHSA-2017:2004; https://github.com/git/git/commit/8976500cbbb13270398d3b3e07a17b8cc7bff43f; https://github.com/njhartwell/pw3nage
CVE: CVE-2017-7186
Published: 2017-03-20
Description: libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97030; https://access.redhat.com/errata/RHSA-2018:2486; https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/
CVE: CVE-2017-7187
Published: 2017-03-20
Description: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96989; http://www.securitytracker.com/id/1038086; https://access.redhat.com/errata/RHSA-2017:1842
CVE: CVE-2012-5361
Published: 2017-03-20
Description: Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/56112; https://docs.microsoft.com/en-us/security-updates/VulnerabilityResearchAdvisories/2012/msvr12-017; https://exchange.xforce.ibmcloud.com/vulnerabilities/79405
CVE: CVE-2014-9841
Published: 2017-03-20
Description: The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing of exceptions."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-388
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00018.html
CVE: CVE-2014-9842
Published: 2017-03-20
Description: Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html
CVE: CVE-2014-9843
Published: 2017-03-20
Description: The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00018.html
CVE: CVE-2014-9844
Published: 2017-03-20
Description: The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html
CVE: CVE-2014-9845
Published: 2017-03-20
Description: The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html
CVE: CVE-2014-9846
Published: 2017-03-20
Description: Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html
CVE: CVE-2014-9847
Published: 2017-03-20
Description: The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html
CVE: CVE-2014-9848
Published: 2017-03-20
Description: Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00018.html
CVE: CVE-2014-9849
Published: 2017-03-20
Description: The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html
CVE: CVE-2014-9850
Published: 2017-03-20
Description: Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00018.html
CVE: CVE-2014-9851
Published: 2017-03-20
Description: ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00011.html
CVE: CVE-2015-1610
Published: 2017-03-20
Description: hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: http://www.internetsociety.org/sites/default/files/10_4_2.pdf; http://www.securityfocus.com/bid/73251; https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1610_l2switch:_topology_spoofing_via_hosttracker
CVE: CVE-2015-8954
Published: 2017-03-20
Description: The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functionality via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777523; https://redmine.openinfosecfoundation.org/issues/1364; https://suricata-ids.org/2015/01/15/suricata-2-0-6-available/
CVE: CVE-2015-8983
Published: 2017-03-20
Description: Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2017/02/14/9; http://www.securityfocus.com/bid/72740; https://sourceware.org/bugzilla/show_bug.cgi?id=17269
CVE: CVE-2015-8984
Published: 2017-03-20
Description: The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2015/02/26/5; http://www.openwall.com/lists/oss-security/2017/02/14/9; http://www.securityfocus.com/bid/72789
CVE: CVE-2015-8985
Published: 2017-03-20
Description: The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-19
References: http://www.openwall.com/lists/oss-security/2017/02/14/9; http://www.securityfocus.com/bid/76916; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779392
CVE: CVE-2016-10214
Published: 2017-03-20
Description: Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2017/02/09/5; http://www.securityfocus.com/bid/96181; https://cgit.freedesktop.org/virglrenderer/commit/?id=40b0e7813325b08077b6f541b3989edb2d86d837
CVE: CVE-2016-2406
Published: 2017-03-20
Description: The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-275
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160218-01-dsm-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160218-01-dsm-en
CVE: CVE-2016-2981
Published: 2017-03-20
Description: An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference #: 1999965.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21999965; https://exchange.xforce.ibmcloud.com/vulnerabilities/113994?cm_mc_uid=[PII_REDACTED][PII_REDACTED]221&cm_mc_sid_50200000=[PII_REDACTED]; http://www.ibm.com/support/docview.wss?uid=swg21999965
CVE: CVE-2016-5857
Published: 2017-03-20
Description: The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the context of the kernel via a crafted application, aka Android internal bug 34386529 and Qualcomm internal bug CR#1094140.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1037968; https://source.android.com/security/bulletin/2017-03-01; http://www.securitytracker.com/id/1037968
CVE: CVE-2016-8973
Published: 2017-03-20
Description: IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. IBM Reference #: 1999960.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: http://www.ibm.com/support/docview.wss?uid=swg21999960; http://www.securityfocus.com/bid/96826; http://www.ibm.com/support/docview.wss?uid=swg21999960
CVE: CVE-2016-9165
Published: 2017-03-20
Description: The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94257; http://www.zerodayinitiative.com/advisories/ZDI-16-606; https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html
CVE: CVE-2016-9694
Published: 2017-03-20
Description: IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999960.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21999960; http://www.securityfocus.com/bid/96825; http://www.ibm.com/support/docview.wss?uid=swg21999960
CVE: CVE-2016-9696
Published: 2017-03-20
Description: IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM Reference #: 1999960.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21999960; http://www.securityfocus.com/bid/96830; http://www.ibm.com/support/docview.wss?uid=swg21999960
CVE: CVE-2016-9697
Published: 2017-03-20
Description: An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expose to an attacker information passed between the server and the browser. IBM Reference #: 1999960.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21999960; http://www.securityfocus.com/bid/96828; http://www.ibm.com/support/docview.wss?uid=swg21999960
CVE: CVE-2017-1134
Published: 2017-03-20
Description: IBM Reliable Scalable Cluster Technology could allow a local user to escalate their privileges to gain root access. IBM Reference #: 1998459.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg21998459; http://www.securityfocus.com/bid/96764; http://www.securitytracker.com/id/1038389
CVE: CVE-2017-1145
Published: 2017-03-20
Description: IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource exhaustion. IBM Reference #: 1999672.
CVSS Score: 8.6 (HIGH)
CWE: CWE-404
References: http://www.ibm.com/support/docview.wss?uid=swg21999672; http://www.securityfocus.com/bid/96759; http://www.securitytracker.com/id/1038068
CVE: CVE-2017-1146
Published: 2017-03-20
Description: IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999736.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21999736; http://www.securityfocus.com/bid/96761; http://www.ibm.com/support/docview.wss?uid=swg21999736
CVE: CVE-2017-1151
Published: 2017-03-20
Description: IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated privileges on the system. IBM Reference #: 1999293.
CVSS Score: 8.1 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg21999293; http://www.securityfocus.com/bid/96841; http://www.securitytracker.com/id/1037984
CVE: CVE-2017-1155
Published: 2017-03-20
Description: IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to another user's reports using a specially crafted HTTP request. IBM Reference #: 1999754.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21999754; http://www.securityfocus.com/bid/96968; http://www.ibm.com/support/docview.wss?uid=swg21999754
CVE: CVE-2017-5618
Published: 2017-03-20
Description: GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: http://git.savannah.gnu.org/cgit/screen.git/patch/?id=1c6d2817926d30c9a7a97d99af7ac5de4a5845b8; http://git.savannah.gnu.org/cgit/screen.git/tree/src/ChangeLog?h=v.4.5.1; http://savannah.gnu.org/bugs/?50142
CVE: CVE-2017-5930
Published: 2017-03-20
Description: The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
CVSS Score: 2.7 (LOW)
CWE: CWE-862
References: http://lists.opensuse.org/opensuse-updates/2017-02/msg00076.html; http://www.openwall.com/lists/oss-security/2017/02/08/1; http://www.openwall.com/lists/oss-security/2017/02/09/1