deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-12
Description: All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://www.debian.org/security/2017/dsa-3972; http://www.securityfocus.com/bid/100814
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-12
Description: The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://www.debian.org/security/2017/dsa-3981; http://www.securityfocus.com/bid/100809
CVE: CVE-2017-14341
Published: 2017-09-12
Description: ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/ImageMagick/ImageMagick/commit/7d63315a64267c565d1f34b9cb523a14616fed24; https://github.com/ImageMagick/ImageMagick/issues/654; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-14342
Published: 2017-09-12
Description: ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/ImageMagick/ImageMagick/issues/650; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/650
CVE: CVE-2017-14343
Published: 2017-09-12
Description: ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/649; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/649
CVE: CVE-2017-14344
Published: 2017-09-12
Description: This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x95382673 by the windrvr1240 kernel driver. The issue lies in the failure to properly validate user-supplied data which can result in a kernel pool overflow. An attacker can leverage this vulnerability to execute arbitrary code under the context of kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://srcincite.io/advisories/src-2017-0027/; https://www.exploit-db.com/exploits/42665/; http://srcincite.io/advisories/src-2017-0027/
CVE: CVE-2017-14345
Published: 2017-09-12
Description: SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/imsebao/404team/blob/master/tianchoy-blog-sql.md; https://github.com/imsebao/404team/blob/master/tianchoy-blog-sql.md
CVE: CVE-2017-14346
Published: 2017-09-12
Description: upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/imsebao/404team/blob/master/tianchoy-blog-getshell.md; https://github.com/imsebao/404team/blob/master/tianchoy-blog-getshell.md
CVE: CVE-2017-8918
Published: 2017-09-12
Description: XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://thenopsled.com/Exploit-DB%20Writeup.txt; https://thenopsled.com/Exploit-DB%20Writeup.txt
CVE: CVE-2017-14347
Published: 2017-09-12
Description: NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yangchonghui2017/cve/blob/master/1.txt; https://github.com/yangchonghui2017/cve/blob/master/1.txt
CVE: CVE-2017-14348
Published: 2017-09-12
Description: LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100866; https://github.com/LibRaw/LibRaw/issues/100; http://www.securityfocus.com/bid/100866
CVE: CVE-2017-8015
Published: 2017-09-12
Description: EMC AppSync (all versions prior to 3.5) contains a SQL injection vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2017/Sep/14; http://www.securityfocus.com/bid/100683; http://seclists.org/fulldisclosure/2017/Sep/14
CVE: CVE-2017-1162
Published: 2017-09-12
Description: IBM QRadar 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 122957.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22008194; http://www.securityfocus.com/bid/100686; https://exchange.xforce.ibmcloud.com/vulnerabilities/122957
CVE: CVE-2017-1352
Published: 2017-09-12
Description: IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-77
References: http://www.ibm.com/support/docview.wss?uid=swg22006650; http://www.securityfocus.com/bid/100697; https://exchange.xforce.ibmcloud.com/vulnerabilities/126538
CVE: CVE-2017-1434
Published: 2017-09-12
Description: IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) under unusual circumstances, could expose highly sensitive information in the error log to a local user.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22005740; http://www.securityfocus.com/bid/100693; http://www.securitytracker.com/id/1039297
CVE: CVE-2017-1438
Published: 2017-09-12
Description: IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner privileges to obtain root access. IBM X-Force ID: 128057.
CVSS Score: 6.7 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22006885; http://www.securityfocus.com/bid/100685; http://www.securitytracker.com/id/1039300
CVE: CVE-2017-1439
Published: 2017-09-12
Description: IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner privileges to obtain root access. IBM X-Force ID: 128058.
CVSS Score: 6.7 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22006061; http://www.securityfocus.com/bid/100690; http://www.securitytracker.com/id/1039301
CVE: CVE-2017-14396
Published: 2017-09-12
Description: In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.osticket.com/blog/125; http://www.osticket.com/blog/125
CVE: CVE-2017-14397
Published: 2017-09-12
Description: AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://download.anydesk.com/changelog.txt; https://download.anydesk.com/changelog.txt
CVE: CVE-2017-14399
Published: 2017-09-12
Description: In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajax_rename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/SPuerBRead/blackcat-cms-file-upload/blob/master/README.md; https://github.com/SPuerBRead/blackcat-cms-file-upload/blob/master/README.md
CVE: CVE-2017-14400
Published: 2017-09-12
Description: In ImageMagick 7.0.7-1 Q16, the PersistPixelCache function in magick/cache.c mishandles the pixel cache nexus, which allows remote attackers to cause a denial of service (NULL pointer dereference in the function GetVirtualPixels in MagickCore/cache.c) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100865; https://github.com/ImageMagick/ImageMagick/issues/746; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-1451
Published: 2017-09-12
Description: IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner privileges to obtain root access. IBM X-Force ID: 128178.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22006061; http://www.securityfocus.com/bid/100690; http://www.securitytracker.com/id/1039301
CVE: CVE-2017-1452
Published: 2017-09-12
Description: IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user to obtain elevated privilege and overwrite DB2 files. IBM X-Force ID: 128180.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22006109; http://www.securityfocus.com/bid/100698; http://www.securitytracker.com/id/1039299
CVE: CVE-2017-1519
Published: 2017-09-12
Description: IBM DB2 10.5 and 11.1 contains a denial of service vulnerability. A remote user can cause disruption of service for DB2 Connect Server setup with a particular configuration. IBM X-Force ID: 129829.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22007183; http://www.securityfocus.com/bid/100688; http://www.securitytracker.com/id/1039298
CVE: CVE-2017-1520
Published: 2017-09-12
Description: IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830.
CVSS Score: 3.7 (LOW)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=swg22007186; http://www.securityfocus.com/bid/100684; http://www.securitytracker.com/id/1039308
CVE: CVE-2015-9229
Published: 2017-09-12
Description: In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cybersecurityworks.com/zerodays/cve-2015-9229-nextgen-gallery.html; https://github.com/cybersecurityworks/Disclosed/issues/5; https://cybersecurityworks.com/zerodays/cve-2015-9229-nextgen-gallery.html
CVE: CVE-2015-9230
Published: 2017-09-12
Description: In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/10/27/3; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cybersecurityworks.com/zerodays/cve-2015-9230-bulletproof.html
CVE: CVE-2017-0161
Published: 2017-09-13
Description: The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to maintain certain sequencing requirements, aka "NetBIOS Remote Code Execution Vulnerability".
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/100728; http://www.securitytracker.com/id/1039318; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0161
CVE: CVE-2017-11761
Published: 2017-09-13
Description: Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in unintended Information Disclosure, aka "Microsoft Exchange Information Disclosure Vulnerability"
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100731; http://www.securitytracker.com/id/1039320; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11761
CVE: CVE-2017-11764
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, and CVE-2017-8756.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100726; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11764
CVE: CVE-2017-11766
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8731, CVE-2017-8734, and CVE-2017-8751.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100729; http://www.securitytracker.com/id/1039326; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11766
CVE: CVE-2017-8567
Published: 2017-09-13
Description: A remote code execution vulnerability exists in Microsoft Excel for Mac 2011 when it fails to properly handle objects in memory, aka "Microsoft Office Remote Code Execution".
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100719; http://www.securitytracker.com/id/1039315; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8567
CVE: CVE-2017-8597
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 Version 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8643 and CVE-2017-8648.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100745; http://www.securitytracker.com/id/1039326; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8597
CVE: CVE-2017-8628
Published: 2017-09-13
Description: Microsoft Bluetooth Driver in Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703 allows a spoofing vulnerability due to Microsoft's implementation of the Bluetooth stack, aka "Microsoft Bluetooth Driver Spoofing Vulnerability".
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/100744; http://www.securitytracker.com/id/1039339; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8628
CVE: CVE-2017-8629
Published: 2017-09-13
Description: Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100725; http://www.securitytracker.com/id/1039329; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8629
CVE: CVE-2017-8630
Published: 2017-09-13
Description: Microsoft Office 2016 allows a remote code execution vulnerability when it fails to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8631, CVE-2017-8632, and CVE-2017-8744.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100732; http://www.securitytracker.com/id/1039315; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8630
CVE: CVE-2017-8631
Published: 2017-09-13
Description: A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Web Apps 2013, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Excel Web App 2013 Service Pack 1, Microsoft Excel Viewer 2007 Service Pack 3, and Office Online Server when they fail to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8630, CVE-2017-8632, and CVE-2017-8744.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100751; http://www.securitytracker.com/id/1039315; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8631
CVE: CVE-2017-8632
Published: 2017-09-13
Description: A remote code execution vulnerability exists in Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Web Apps 2013, Microsoft Excel for Mac 2011, Microsoft Excel 2016 for Mac, and Microsoft Office Compatibility Pack Service Pack 3, when they fail to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8630, CVE-2017-8631, and CVE-2017-8744.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100734; http://www.securitytracker.com/id/1039315; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8632
CVE: CVE-2017-8643
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to leave a malicious website open during user clipboard activities, due to the way that Microsoft Edge handles clipboard events, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8597 and CVE-2017-8648.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100747; http://www.securitytracker.com/id/1039326; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8643
CVE: CVE-2017-8648
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows Version 1703 allows an attacker to obtain information to further compromise the user's system, due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8597 and CVE-2017-8643.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100750; http://www.securitytracker.com/id/1039326; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8648
CVE: CVE-2017-8649
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8660, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100754; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8649
CVE: CVE-2017-8660
Published: 2017-09-13
Description: Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8729, CVE-2017-8738, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100757; http://www.securitytracker.com/id/1039342; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8660
CVE: CVE-2017-8675
Published: 2017-09-13
Description: The Windows Kernel-Mode Drivers component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability".. This CVE ID is unique from CVE-2017-8720.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100752; http://www.securitytracker.com/id/1039325; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8675
CVE: CVE-2017-8676
Published: 2017-09-13
Description: The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an authenticated attacker to retrieve information from a targeted system via a specially crafted application, aka "Windows GDI+ Information Disclosure Vulnerability."
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100755; http://www.securitytracker.com/id/1039333; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8676
CVE: CVE-2017-8677
Published: 2017-09-13
Description: The Windows GDI+ component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly discloses kernel memory addresses, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8678, CVE-2017-8680, CVE-2017-8681, and CVE-2017-8687.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100767; http://www.securitytracker.com/id/1039338; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8677
CVE: CVE-2017-8678
Published: 2017-09-13
Description: The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8677, CVE-2017-8680, CVE-2017-8681, and CVE-2017-8687.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100769; http://www.securitytracker.com/id/1039325; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8678