deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-11458
Published: 2017-07-25
Description: Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97566; https://erpscan.io/advisories/erpscan-17-017-sap-netweaver-java-7-3-java-xss-ctcprotocolprotocol-servlet/; http://www.securityfocus.com/bid/97566
CVE: CVE-2017-11459
Published: 2017-07-25
Description: SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://erpscan.io/advisories/erpscan-17-019-sap-trex-rce/; https://erpscan.io/advisories/erpscan-17-019-sap-trex-rce/
CVE: CVE-2017-11460
Published: 2017-07-25
Description: Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject arbitrary web script or HTML via the responsecode parameter to shp/shp_result.jsp, aka SAP Security Note 2308535.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101826; http://www.securityfocus.com/bid/97565; https://erpscan.io/advisories/erpscan-17-016-sap-netweaver-java-7-4-dataarchivingservice-servlet-xss/
CVE: CVE-2017-8919
Published: 2017-07-25
Description: NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated users to obtain sensitive password information via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/99957; https://kb.netapp.com/support/s/article/ka51A0000008Spy/NTAP-20[PII_REDACTED]; http://www.securityfocus.com/bid/99957
CVE: CVE-2017-9413
Published: 2017-07-25
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or (2) update Internet Radio Settings via the urlRedirectCustomUrl parameter to networkSettings.view.  NOTE: These vulnerabilities can be exploited to conduct server-side request forgery (SSRF) attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/142794/Subsonic-6.1.1-Server-Side-Request-Forgery.html; https://www.exploit-db.com/exploits/42118/; http://packetstormsecurity.com/files/142794/Subsonic-6.1.1-Server-Side-Request-Forgery.html
CVE: CVE-2017-6612
Published: 2017-07-25
Description: A vulnerability in the gateway GPRS support node (GGSN) of Cisco ASR 5000 Series Aggregation Services Routers 17.3.9.62033 through 21.1.2 could allow an unauthenticated, remote attacker to redirect HTTP traffic sent to an affected device. More Information: CSCvc67927.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99920; http://www.securitytracker.com/id/1038961; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-asr
CVE: CVE-2017-6672
Published: 2017-07-25
Description: A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device. More Information: CSCvb99022 CSCvc16964 CSCvc37351 CSCvc54843 CSCvc63444 CSCvc77815 CSCvc88658 CSCve08955 CSCve14141 CSCve33870.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/99921; http://www.securitytracker.com/id/1038962; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-asr1
CVE: CVE-2017-6746
Published: 2017-07-25
Description: A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid administrator credentials. Affected Products: Cisco AsyncOS Software 10.0 and later for WSA on both virtual and hardware appliances. More Information: CSCvd88862. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270 10.1.1-235.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99877; http://www.securitytracker.com/id/1038948; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa1
CVE: CVE-2017-6748
Published: 2017-07-25
Description: A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88855. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270 10.1.1-234.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-74
References: http://www.securityfocus.com/bid/99918; http://www.securitytracker.com/id/1038956; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa2
CVE: CVE-2017-6749
Published: 2017-07-25
Description: A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88865. Known Affected Releases: 10.1.0-204.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99875; http://www.securitytracker.com/id/1038957; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa3
CVE: CVE-2017-6750
Published: 2017-07-25
Description: A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to log in to the device with the privileges of a limited user or an unauthenticated, remote attacker to authenticate to certain areas of the web GUI, aka a Static Credentials Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCve06124. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: http://www.securityfocus.com/bid/99924; http://www.securitytracker.com/id/1038958; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa4
CVE: CVE-2017-6751
Published: 2017-07-25
Description: A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypass Vulnerability. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88863. Known Affected Releases: 10.1.0-204 9.0.0-485.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99967; http://www.securitytracker.com/id/1038959; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa5
CVE: CVE-2017-6753
Published: 2017-07-25
Description: A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows. The vulnerability is due to a design defect in the extension. An attacker who can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser. The following versions of the Cisco WebEx browser extensions are affected: Versions prior to 1.0.12 of the Cisco WebEx extension on Google Chrome, Versions prior to 1.0.12 of the Cisco WebEx extension on Mozilla Firefox. Cisco Bug IDs: CSCvf15012 CSCvf15020 CSCvf15030 CSCvf15033 CSCvf15036 CSCvf15037.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/99614; http://www.securitytracker.com/id/1038909; http://www.securitytracker.com/id/1038910
CVE: CVE-2017-6755
Published: 2017-07-25
Description: A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning (PCP) Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc90312. Known Affected Releases: 12.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99878; http://www.securitytracker.com/id/1038960; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-pcpt
CVE: CVE-2016-6133
Published: 2017-07-25
Description: Cross-site scripting (XSS) vulnerability in Ektron Content Management System before 9.1.0.184SP3(9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/540742/100/0/threaded; http://www.securityfocus.com/archive/1/540742/100/0/threaded
CVE: CVE-2017-9233
Published: 2017-07-25
Description: XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-835
References: http://www.debian.org/security/2017/dsa-3898; http://www.openwall.com/lists/oss-security/2017/06/17/7; http://www.securityfocus.com/bid/99276
CVE: CVE-2017-11624
Published: 2017-07-25
Description: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf.html; https://github.com/qpdf/qpdf/issues/117; https://usn.ubuntu.com/3638-1/
CVE: CVE-2017-11625
Published: 2017-07-25
Description: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_26.html; https://github.com/qpdf/qpdf/issues/120; https://usn.ubuntu.com/3638-1/
CVE: CVE-2017-11626
Published: 2017-07-25
Description: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_65.html; https://github.com/qpdf/qpdf/issues/119; https://usn.ubuntu.com/3638-1/
CVE: CVE-2017-11627
Published: 2017-07-25
Description: A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function in PointerHolder.hh, aka an "infinite loop."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://somevulnsofadlab.blogspot.jp/2017/07/qpdfan-infinite-loop-in-libqpdf_21.html; https://github.com/qpdf/qpdf/issues/118; https://usn.ubuntu.com/3638-1/
CVE: CVE-2017-11628
Published: 2017-07-25
Description: In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=[PII_REDACTED]9b3686c8a6a58ee01131ac0047465e; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=5f8380d33e648964d2d5140f329cf2d4c443033c; http://www.securityfocus.com/bid/99489
CVE: CVE-2017-11613
Published: 2017-07-26
Description: In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99977; https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f; https://lists.debian.org/debian-lts-announce/2018/05/msg00022.html
CVE: CVE-2017-11629
Published: 2017-07-26
Description: dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#api-php-Reflected-XSS; http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#api-php-Reflected-XSS
CVE: CVE-2017-11630
Published: 2017-07-26
Description: dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/FiyoCMS/FiyoCMS/issues/6; https://github.com/FiyoCMS/FiyoCMS/issues/6
CVE: CVE-2017-11631
Published: 2017-07-26
Description: dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/FiyoCMS/FiyoCMS/issues/7; https://github.com/FiyoCMS/FiyoCMS/issues/7
CVE: CVE-2017-11636
Published: 2017-07-26
Description: GraphicsMagick 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames that have non-identical widths.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/39961adf974c; http://www.securityfocus.com/bid/99978; https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html
CVE: CVE-2017-11637
Published: 2017-07-26
Description: GraphicsMagick 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/f3ffc5541257; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html; https://usn.ubuntu.com/4206-1/
CVE: CVE-2017-11638
Published: 2017-07-26
Description: GraphicsMagick 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11642.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/29550606d8b9; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/
CVE: CVE-2017-11639
Published: 2017-07-26
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100013; https://github.com/ImageMagick/ImageMagick/issues/588; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-11640
Published: 2017-07-26
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to an address access exception in the WritePTIFImage() function in coders/tiff.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99989; https://github.com/ImageMagick/ImageMagick/issues/584; https://security.gentoo.org/glsa/201711-07
CVE: CVE-2017-11641
Published: 2017-07-26
Description: GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-772
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/db732abd9318; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html; https://usn.ubuntu.com/4222-1/
CVE: CVE-2017-11642
Published: 2017-07-26
Description: GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11638.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/29550606d8b9; http://www.securityfocus.com/bid/100395; https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html
CVE: CVE-2017-11643
Published: 2017-07-26
Description: GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/d00b74315a71; http://www.securityfocus.com/bid/100357; https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html
CVE: CVE-2017-11644
Published: 2017-07-26
Description: When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadMATImage() function in coders/mat.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100014; https://github.com/ImageMagick/ImageMagick/issues/587; http://www.securityfocus.com/bid/100014
CVE: CVE-2017-11651
Published: 2017-07-26
Description: NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://118.89.230.52/about/details.docx; http://118.89.230.52/about/details.docx
CVE: CVE-2017-6005
Published: 2017-07-26
Description: Waves MaxxAudio, as installed on Dell laptops, adds a "WavesSysSvc" Windows service with File Version 1.1.6.0. This service has a vulnerability known as Unquoted Service Path. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.
CVSS Score: 7.0 (HIGH)
References: http://justpentest.blogspot.in/2017/07/dell-unquoted-service-path-local.html; http://justpentest.blogspot.in/2017/07/dell-unquoted-service-path-local.html
CVE: CVE-2017-11654
Published: 2017-07-26
Description: An out-of-bounds read and write flaw was found in the way SIPcrack 0.2 processed SIP traffic, because 0x00 termination of a payload array was mishandled. A remote attacker could potentially use this flaw to crash the sipdump process by generating specially crafted SIP traffic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://openwall.com/lists/oss-security/2017/07/26/1; http://www.securityfocus.com/bid/100023; http://openwall.com/lists/oss-security/2017/07/26/1
CVE: CVE-2017-11655
Published: 2017-07-26
Description: A memory leak was found in the way SIPcrack 0.2 handled processing of SIP traffic, because a lines array was mismanaged. A remote attacker could potentially use this flaw to crash long-running sipdump network sniffing sessions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://openwall.com/lists/oss-security/2017/07/26/1; http://www.securityfocus.com/bid/100024; http://openwall.com/lists/oss-security/2017/07/26/1
CVE: CVE-2017-11612
Published: 2017-07-26
Description: In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1039014; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-xss-vulnerability.html; http://www.securitytracker.com/id/1039014
CVE: CVE-2017-11615
Published: 2017-07-26
Description: A sandbox escape in the Lua interface in Wube Factorio before 0.15.31 allows remote game servers or user-assisted attackers to execute arbitrary C code by including and loading a C library.
CVSS Score: 8.6 (HIGH)
References: https://security.gerhardt.link/RCE-in-Factorio/; https://security.gerhardt.link/RCE-in-Factorio/
CVE: CVE-2017-11658
Published: 2017-07-26
Description: In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/Shinkurt/157dbb3767c9489f3d754f79b183a890; https://wp-rocket.me/changelog; https://wpvulndb.com/vulnerabilities/8872
CVE: CVE-2017-5691
Published: 2017-07-26
Description: Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state.
CVSS Score: 9.0 (CRITICAL)
References: https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesb3p03767en_us; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00076&languageid=en-fr; https://support.lenovo.com/us/en/product_security/LEN-15184
CVE: CVE-2017-11666
Published: 2017-07-26
Description: Cross-site scripting (XSS) vulnerability in js/ViewerPanel.js in the file previewer plugin in Kopano WebApp versions 3.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a specially crafted previewable file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://stash.kopano.io/projects/KWA/repos/filepreviewer/commits/85d2b5c2d27f461bba12e9491fcc4b0d8fde771a; https://stash.kopano.io/projects/KWA/repos/filepreviewer/commits/85d2b5c2d27f461bba12e9491fcc4b0d8fde771a
CVE: CVE-2017-9610
Published: 2017-07-26
Description: The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d2ab84732936b6e7e5a461dc[PII_REDACTED]5e9a06; http://www.securityfocus.com/bid/99976; https://bugs.ghostscript.com/show_bug.cgi?id=698025