deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9269
Published: 2017-02-21
Description: Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality. This was resolved in Version 6.5 CP 1737.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/96252; http://www.securitytracker.com/id/1037849; https://success.trendmicro.com/solution/1116672
CVE: CVE-2016-9314
Published: 2017-02-21
Description: Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to backup the system configuration and download it onto their local machine. This backup file contains sensitive information like passwd/shadow files, RSA certificates, Private Keys and Default Passphrase, etc. This was resolved in Version 6.5 CP 1737.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96252; http://www.securitytracker.com/id/1037849; https://success.trendmicro.com/solution/1116672
CVE: CVE-2016-9315
Published: 2017-02-21
Description: Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or add new admin accounts. This was resolved in Version 6.5 CP 1737.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/96252; http://www.securitytracker.com/id/1037849; https://success.trendmicro.com/solution/1116672
CVE: CVE-2016-9316
Published: 2017-02-21
Description: Multiple stored Cross-Site-Scripting (XSS) vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allow authenticated, remote users with least privileges to inject arbitrary HTML/JavaScript code into web pages. This was resolved in Version 6.5 CP 1737.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96252; http://www.securitytracker.com/id/1037849; https://success.trendmicro.com/solution/1116672
CVE: CVE-2017-5881
Published: 2017-02-21
Description: GOM Player 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted fpx file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/41367/; https://www.exploit-db.com/exploits/41367/
CVE: CVE-2017-5959
Published: 2017-02-21
Description: CSRF token bypass in GeniXCMS before 1.0.2 could result in escalation of privileges. The forgotpassword.php page can be used to acquire a token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-352
References: https://github.com/semplon/GeniXCMS/issues/70; https://github.com/semplon/GeniXCMS/releases/tag/v1.0.2; https://github.com/semplon/GeniXCMS/issues/70
CVE: CVE-2017-6070
Published: 2017-02-21
Description: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://dev.cmsmadesimple.org/project/files/69; https://daylight-it.com/security-advisory-dlcs0001.html; http://dev.cmsmadesimple.org/project/files/69
CVE: CVE-2017-6071
Published: 2017-02-21
Description: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://dev.cmsmadesimple.org/project/files/69; https://daylight-it.com/security-advisory-dlcs0001.html; http://dev.cmsmadesimple.org/project/files/69
CVE: CVE-2017-6072
Published: 2017-02-21
Description: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://dev.cmsmadesimple.org/project/files/69; https://daylight-it.com/security-advisory-dlcs0001.html; http://dev.cmsmadesimple.org/project/files/69
CVE: CVE-2017-6078
Published: 2017-02-21
Description: FastStone MaxView 3.0 and 3.1 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with a crafted biSize field in the BITMAPINFOHEADER section.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/ilsani/rd/tree/master/security-advisories/faststone/maxview-cve-2017-6078; https://github.com/ilsani/rd/tree/master/security-advisories/faststone/maxview-cve-2017-6078
CVE: CVE-2017-6095
Published: 2017-02-21
Description: A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; https://wpvulndb.com/vulnerabilities/8740; https://www.exploit-db.com/exploits/41438/
CVE: CVE-2017-6096
Published: 2017-02-21
Description: A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authentication to Wordpress admin) with the GET Parameter: filter_list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; https://wpvulndb.com/vulnerabilities/8740; https://www.exploit-db.com/exploits/41438/
CVE: CVE-2017-6097
Published: 2017-02-21
Description: A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; https://wpvulndb.com/vulnerabilities/8740; https://www.exploit-db.com/exploits/41438/
CVE: CVE-2017-6098
Published: 2017-02-21
Description: A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin; https://wpvulndb.com/vulnerabilities/8740; https://www.exploit-db.com/exploits/41438/
CVE: CVE-2015-4056
Published: 2017-02-21
Description: The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discover credentials by leveraging administrative access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-310
References: http://seclists.org/bugtraq/2015/Jun/91; http://seclists.org/bugtraq/2015/Jun/91
CVE: CVE-2015-4057
Published: 2017-02-21
Description: The "Plug-in for VMware vCenter" in VCE Vision Intelligent Operations before 2.6.5 sends a cleartext HTTP response upon a request for the Settings screen, which allows remote attackers to discover the admin user password by sniffing the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://seclists.org/bugtraq/2015/Jun/91; http://seclists.org/bugtraq/2015/Jun/91
CVE: CVE-2017-6127
Published: 2017-02-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that (1) change the SSID, (2) change the Wi-Fi password, or (3) possibly have unspecified other impact via crafted requests to form2WlanBasicSetup.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2017/Feb/66; http://www.securityfocus.com/bid/96369; https://drive.google.com/file/d/0B6715xUqH18MeV9GOVE0ZmFrQUU/view
CVE: CVE-2016-9049
Published: 2017-02-21
Description: An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server process to dereference a null pointer. An attacker can simply connect to a TCP port in order to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/96376; http://www.talosintelligence.com/reports/TALOS-2016-0263/; http://www.securityfocus.com/bid/96376
CVE: CVE-2016-9051
Published: 2017-02-21
Description: An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can simply connect to the port to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/96374; http://www.talosintelligence.com/reports/TALOS-2016-0265/; http://www.securityfocus.com/bid/96374
CVE: CVE-2016-9053
Published: 2017-02-21
Description: An exploitable out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server to fetch a function table outside the bounds of an array resulting in remote code execution. An attacker can simply connect to the port to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: http://www.securityfocus.com/bid/96372; http://www.talosintelligence.com/reports/TALOS-2016-0267/; http://www.securityfocus.com/bid/96372
CVE: CVE-2017-2684
Published: 2017-02-22
Description: Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access to the affected system, to bypass the application-level authentication.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-592
References: http://www.securityfocus.com/bid/96208; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-931064.pdf; http://www.securityfocus.com/bid/96208
CVE: CVE-2017-3821
Published: 2017-02-22
Description: A vulnerability in the serviceability page of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct reflected cross-site scripting (XSS) attacks. More Information: CSCvc49348. Known Affected Releases: 10.5(2.14076.1). Known Fixed Releases: 12.0(0.98000.209) 12.0(0.98000.478) 12.0(0.98000.609).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96241; http://www.securitytracker.com/id/1037839; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cucm
CVE: CVE-2017-3827
Published: 2017-02-22
Description: A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco ESA and Cisco WSA, both virtual and hardware appliances, that are configured with message or content filters to scan incoming email attachments on the ESA or services scanning content of web access on the WSA. More Information: SCvb91473, CSCvc76500. Known Affected Releases: 10.0.0-203 9.9.9-894 WSA10.0.0-233.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96239; http://www.securitytracker.com/id/1037831; http://www.securitytracker.com/id/1037832
CVE: CVE-2017-3828
Published: 2017-02-22
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvb98777. Known Affected Releases: 11.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 11.0(1.23063.1) 11.5(1.12029.1) 11.5(1.12900.11) 11.5(1.12900.21) 11.6(1.10000.4) 12.0(0.98000.156) 12.0(0.98000.178) 12.0(0.98000.369) 12.0(0.98000.470) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.6).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96240; http://www.securitytracker.com/id/1037839; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cucm1
CVE: CVE-2017-3829
Published: 2017-02-22
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc30999. Known Affected Releases: 12.0(0.98000.280). Known Fixed Releases: 11.0(1.23900.3) 12.0(0.98000.180) 12.0(0.98000.422) 12.0(0.98000.541) 12.0(0.98000.6).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96250; http://www.securitytracker.com/id/1037839; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cucm2
CVE: CVE-2017-3830
Published: 2017-02-22
Description: A vulnerability in an internal API of the Cisco Meeting Server (CMS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected appliance. More Information: CSCvc89678. Known Affected Releases: 2.1. Known Fixed Releases: 2.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96242; http://www.securitytracker.com/id/1037833; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms
CVE: CVE-2017-3833
Published: 2017-02-22
Description: A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software. More Information: CSCvb95951. Known Affected Releases: 12.0(0.99999.2). Known Fixed Releases: 11.0(1.23064.1) 11.5(1.12031.1) 11.5(1.12900.21) 11.5(1.12900.7) 11.5(1.12900.8) 11.6(1.10000.4) 12.0(0.98000.155) 12.0(0.98000.178) 12.0(0.98000.366) 12.0(0.98000.367) 12.0(0.98000.468) 12.0(0.98000.469) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.6).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96246; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-ucm; http://www.securityfocus.com/bid/96246
CVE: CVE-2017-3835
Published: 2017-02-22
Description: A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned by other users, because of SQL Injection. More Information: CSCvb15627. Known Affected Releases: 1.4(0.908).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/96249; http://www.securitytracker.com/id/1037841; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-ise
CVE: CVE-2017-3836
Published: 2017-02-22
Description: A vulnerability in the web framework Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. More Information: CSCvb61689. Known Affected Releases: 11.5(1.11007.2). Known Fixed Releases: 12.0(0.98000.162) 12.0(0.98000.178) 12.0(0.98000.383) 12.0(0.98000.488) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.6).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96251; http://www.securitytracker.com/id/1037840; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cucm3
CVE: CVE-2017-3837
Published: 2017-02-22
Description: An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96243; http://www.securitytracker.com/id/1037834; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1
CVE: CVE-2017-3838
Published: 2017-02-22
Description: A vulnerability in Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvc04838. Known Affected Releases: 5.8(2.5).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96234; http://www.securitytracker.com/id/1037835; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-acs
CVE: CVE-2017-3839
Published: 2017-02-22
Description: An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc04845. Known Affected Releases: 5.8(2.5).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/96236; http://www.securitytracker.com/id/1037836; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-acs1
CVE: CVE-2017-3840
Published: 2017-02-22
Description: A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect Vulnerability. More Information: CSCvc04849. Known Affected Releases: 5.8(2.5).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/96238; http://www.securitytracker.com/id/1037837; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-acs2
CVE: CVE-2017-3841
Published: 2017-02-22
Description: A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to disclose sensitive information. More Information: CSCvc04854. Known Affected Releases: 5.8(2.5).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96237; http://www.securitytracker.com/id/1037838; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-acs3
CVE: CVE-2017-3842
Published: 2017-02-22
Description: A vulnerability in the web-based management interface of the Cisco Intrusion Prevention System Device Manager (IDM) could allow an unauthenticated, remote attacker to view sensitive information stored in certain HTML comments. More Information: CSCuh91455. Known Affected Releases: 7.2(1)V7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96256; http://www.securitytracker.com/id/1037842; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-idm
CVE: CVE-2017-3843
Published: 2017-02-22
Description: A vulnerability in the file download functions for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to download system files that should be restricted. More Information: CSCvc99446. Known Affected Releases: 11.5(0).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96248; http://www.securitytracker.com/id/1037843; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-pcp1
CVE: CVE-2017-3844
Published: 2017-02-22
Description: A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are vulnerable. Cisco Prime Collaboration Assurance software versions prior to 11.0 are not vulnerable. More Information: CSCvc86238. Known Affected Releases: 11.5(0).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/96247; http://www.securitytracker.com/id/1037843; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-pcp2
CVE: CVE-2017-3845
Published: 2017-02-22
Description: A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are vulnerable. Cisco Prime Collaboration Assurance software versions prior to 11.0 are not vulnerable. More Information: CSCvc77783. Known Affected Releases: 11.5(0).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96245; http://www.securitytracker.com/id/1037844; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-pcp3
CVE: CVE-2017-3847
Published: 2017-02-22
Description: A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. More Information: CSCvc72741. Known Affected Releases: 6.2.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96253; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-fpmc; http://www.securityfocus.com/bid/96253
CVE: CVE-2016-9682
Published: 2017-02-22
Description: The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI (/cgi-bin/diagnostics) component responsible for emailing out information about the state of the system. The application doesn't properly escape the information passed in the 'tsrDeleteRestartedFile' or 'currentTSREmailTo' variables before making a call to system(), allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://documents.software.dell.com/sonicwall-sma-100-series/8.1.0.7/release-notes/resolved-issues?ParentProduct=868; http://www.securityfocus.com/bid/96375; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2016-0003