deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-5923
Published: 2017-04-03
Description: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/98080; https://github.com/VirusTotal/yara/commit/ab906da53ff2a68c6fd6d1fa73f2b7c7bf0bc636; https://github.com/VirusTotal/yara/issues/597
CVE: CVE-2017-5924
Published: 2017-04-03
Description: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98075; https://github.com/VirusTotal/yara/commit/7f02eca670f29c00a1d2c305e96febae6ce5d37b; https://github.com/VirusTotal/yara/issues/593
CVE: CVE-2017-5949
Published: 2017-04-03
Description: JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out-of-bounds write and application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers access to red-zone memory locations, related to jit/ThunkGenerators.cpp, llint/LowLevelInterpreter32_64.asm, and llint/LowLevelInterpreter64.asm.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/97298; https://bugs.webkit.org/show_bug.cgi?id=167239; https://trac.webkit.org/changeset/211479
CVE: CVE-2017-5950
Published: 2017-04-03
Description: The SingleDocParser::HandleNode function in yaml-cpp (aka LibYaml-C++) 0.5.3 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97307; https://github.com/jbeder/yaml-cpp/issues/459; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2017-5951
Published: 2017-04-03
Description: The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2017/dsa-3838; http://www.securityfocus.com/bid/98665; https://bugs.ghostscript.com/show_bug.cgi?id=697548
CVE: CVE-2017-6181
Published: 2017-04-03
Description: The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted regular expression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97304; https://bugs.ruby-lang.org/issues/13234; https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/57660
CVE: CVE-2017-6194
Published: 2017-04-03
Description: The relocs function in libr/bin/p/bin_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97299; https://github.com/radare/radare2/commit/72794dc3523bbd5bb370de3c5857cb736c387e18; https://github.com/radare/radare2/issues/6829
CVE: CVE-2017-6441
Published: 2017-04-03
Description: The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating "Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugs.php.net/bug.php?id=74146; https://github.com/php/php-src/pull/2396; https://bugs.php.net/bug.php?id=74146
CVE: CVE-2017-6448
Published: 2017-04-03
Description: The dalvik_disassemble function in libr/asm/p/asm_dalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97313; https://github.com/radare/radare2/commit/f41e941341e44aa86edd4483c4487ec09a074257; https://github.com/radare/radare2/issues/6885
CVE: CVE-2017-7378
Published: 2017-04-03
Description: The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97296; https://blogs.gentoo.org/ago/2017/03/31/podofo-heap-based-buffer-overflow-in-podofopdfpainterexpandtabs-pdfpainter-cpp; http://www.securityfocus.com/bid/97296
CVE: CVE-2017-7379
Published: 2017-04-03
Description: The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97296; https://blogs.gentoo.org/ago/2017/03/31/podofo-heap-based-buffer-overflow-in-podofopdfsimpleencodingconverttoencoding-pdfencoding-cpp; http://www.securityfocus.com/bid/97296
CVE: CVE-2017-7380
Published: 2017-04-03
Description: The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97296; https://blogs.gentoo.org/ago/2017/03/31/podofo-four-null-pointer-dereference; http://www.securityfocus.com/bid/97296
CVE: CVE-2017-7381
Published: 2017-04-03
Description: The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97296; https://blogs.gentoo.org/ago/2017/03/31/podofo-four-null-pointer-dereference; http://www.securityfocus.com/bid/97296
CVE: CVE-2017-7382
Published: 2017-04-03
Description: The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97296; https://blogs.gentoo.org/ago/2017/03/31/podofo-four-null-pointer-dereference; http://www.securityfocus.com/bid/97296
CVE: CVE-2017-7383
Published: 2017-04-03
Description: The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97296; https://blogs.gentoo.org/ago/2017/03/31/podofo-four-null-pointer-dereference; http://www.securityfocus.com/bid/97296
CVE: CVE-2017-7400
Published: 2017-04-03
Description: OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97324; https://access.redhat.com/errata/RHSA-2017:1598; https://access.redhat.com/errata/RHSA-2017:1739
CVE: CVE-2017-7401
Published: 2017-04-03
Description: Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/97321; https://access.redhat.com/errata/RHSA-2017:1285; https://access.redhat.com/errata/RHSA-2017:1787
CVE: CVE-2013-7450
Published: 2017-04-03
Description: Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2016/04/18/11; http://www.openwall.com/lists/oss-security/2016/04/18/5; http://www.openwall.com/lists/oss-security/2016/05/20/1
CVE: CVE-2014-1677
Published: 2017-04-03
Description: Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2016/Jul/67; http://www.exploit-db.com/exploits/31894; http://www.securityfocus.com/archive/1/538955/100/0/threaded
CVE: CVE-2014-3927
Published: 2017-04-03
Description: mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.s3.eurecom.fr/cve/CVE-2014-3927.txt; https://github.com/infrastation/mrlg4php/issues/1; https://hackerone.com/reports/16330
CVE: CVE-2014-3928
Published: 2017-04-03
Description: Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.s3.eurecom.fr/cve/CVE-2014-3928.txt; https://github.com/Cougar/lg/issues/4; https://hackerone.com/reports/16330
CVE: CVE-2014-3929
Published: 2017-04-03
Description: The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to obtain private ssh keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.s3.eurecom.fr/cve/CVE-2014-3929.txt; https://github.com/Cougar/lg/issues/5; https://hackerone.com/reports/16330
CVE: CVE-2014-3930
Published: 2017-04-03
Description: lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to obtain IP addresses and other unspecified router credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.s3.eurecom.fr/cve/CVE-2014-3930.txt; https://hackerone.com/reports/16330; http://www.s3.eurecom.fr/cve/CVE-2014-3930.txt
CVE: CVE-2017-5642
Published: 2017-04-03
Description: During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.5.0; https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.5.0
CVE: CVE-2017-7402
Published: 2017-04-03
Description: Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://rungga.blogspot.co.id/2017/04/remote-file-upload-vulnerability-in.html; https://www.exploit-db.com/exploits/41784/; http://rungga.blogspot.co.id/2017/04/remote-file-upload-vulnerability-in.html
CVE: CVE-2016-10317
Published: 2017-04-03
Description: The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97410; https://bugs.ghostscript.com/show_bug.cgi?id=697459; https://usn.ubuntu.com/3636-1/
CVE: CVE-2017-7397
Published: 2017-04-03
Description: BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as defined in RFC 1812 section 5.3.7). This product enables net.ipv4.conf.all.log_martians by default.  NOTE: the vendor reports "It has been proved that this vulnerability has no foundation and it is totally fake and based on false assumptions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.exploitalert.com/view-details.html?id=26361; https://backbox.org/portal/blog/false-cve-backbox-46-unmasked; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2017-7407
Published: 2017-04-03
Description: The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.
CVSS Score: 2.4 (LOW)
CWE: CWE-119, CWE-119
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; https://access.redhat.com/errata/RHSA-2018:3558; https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13
CVE: CVE-2017-5684
Published: 2017-04-03
Description: The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system to gain access to personal information.
CVSS Score: 3.9 (LOW)
CWE: CWE-276
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00073&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00073&languageid=en-fr
CVE: CVE-2017-5685
Published: 2017-04-03
Description: The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system to gain access to personal information.
CVSS Score: 3.9 (LOW)
CWE: CWE-276
References: http://www.securityfocus.com/bid/97408; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00073&languageid=en-fr; http://www.securityfocus.com/bid/97408
CVE: CVE-2017-5686
Published: 2017-04-03
Description: The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system to gain access to personal information.
CVSS Score: 3.9 (LOW)
CWE: CWE-276
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00073&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00073&languageid=en-fr
CVE: CVE-2017-7410
Published: 2017-04-03
Description: Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://forum.websitebaker.org/index.php/topic%2C30187.0.html; http://project.websitebaker.org/issues/39; http://www.securityfocus.com/bid/97495
CVE: CVE-2017-7412
Published: 2017-04-04
Description: NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands.
CVSS Score: 7.8 (HIGH)
References: http://lists.science.uu.nl/pipermail/nix-dev/2017-April/023329.html; https://github.com/NixOS/nixpkgs/commit/6c59d851e2967410cc8fb6ba3f374b1d3efa988e; https://github.com/NixOS/nixpkgs/commit/fa4fe7110566d8370983fa81f2b04a833339236d
CVE: CVE-2014-9922
Published: 2017-04-04
Description: The eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gain privileges via a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=69c433ed2ecd2d3264efd7afec4439524b319121; http://source.android.com/security/bulletin/2017-04-01.html; http://www.securityfocus.com/bid/97354
CVE: CVE-2016-10229
Published: 2017-04-04
Description: udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-358
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191; http://source.android.com/security/bulletin/2017-04-01.html; http://www.securityfocus.com/bid/97397
CVE: CVE-2017-3204
Published: 2017-04-04
Description: The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
CVSS Score: 8.1 (HIGH)
CWE: CWE-310
References: http://www.securityfocus.com/bid/97481; https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/; https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d[PII_REDACTED]1
CVE: CVE-2017-5683
Published: 2017-04-04
Description: Privilege escalation in IntelHAXM.sys driver in the Intel Hardware Accelerated Execution Manager before version 6.0.6 allows a local user to gain system level access.
CVSS Score: 7.8 (HIGH)
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00072&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00072&languageid=en-fr
CVE: CVE-2017-7228
Published: 2017-04-04
Description: An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.
CVSS Score: 8.2 (HIGH)
CWE: CWE-129
References: http://openwall.com/lists/oss-security/2017/04/04/3; http://www.debian.org/security/2017/dsa-3847; http://www.securityfocus.com/bid/97375
CVE: CVE-2017-7398
Published: 2017-04-04
Description: D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated, as demonstrated by changing the Security option from WPA2 to None, or changing the hiddenSSID parameter, SSID parameter, or a security-option password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2017/Apr/4; https://www.exploit-db.com/exploits/41821/; http://seclists.org/fulldisclosure/2017/Apr/4
CVE: CVE-2017-7413
Published: 2017-04-04
Description: In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html; https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html; https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html
CVE: CVE-2017-7414
Published: 2017-04-04
Description: In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled in the user's preferences, and has enabled the "Should PGP signed messages be automatically verified when viewed?" preference. To exploit this vulnerability, an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user, who then must either view or preview it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html; https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html; https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html
CVE: CVE-2016-10318
Published: 2017-04-04
Description: A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=163ae1c6ad6299b19e22b4a35d5ab24a89791a98; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.4; http://www.securityfocus.com/bid/97404
CVE: CVE-2017-5670
Published: 2017-04-04
Description: Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate attackers to obtain sensitive information by reading raw disk blocks.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2017/Feb/25; http://www.securityfocus.com/bid/96175; https://supportkb.riverbed.com/support/index?page=content&id=S30065
CVE: CVE-2017-7305
Published: 2017-04-04
Description: Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism via a crafted boot. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contains correct computational logic for a bootloader password; however, this password is optional to meet different customers' needs
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-521, CWE-521
References: http://seclists.org/fulldisclosure/2017/Feb/25; https://supportkb.riverbed.com/support/index?page=content&id=S30065; http://seclists.org/fulldisclosure/2017/Feb/25
CVE: CVE-2017-7306
Published: 2017-04-04
Description: Riverbed RiOS through 9.6.0 has a weak default password for the secure vault, which makes it easier for physically proximate attackers to defeat the secure-vault protection mechanism by leveraging knowledge of the password algorithm and the appliance serial number. NOTE: the vendor believes that this does not meet the definition of a vulnerability. The product contains correct computational logic for supporting arbitrary password changes by customers; however, a password change is optional to meet different customers' needs
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-521, CWE-521
References: http://seclists.org/fulldisclosure/2017/Feb/25; https://supportkb.riverbed.com/support/index?page=content&id=S30065; http://seclists.org/fulldisclosure/2017/Feb/25
CVE: CVE-2017-7307
Published: 2017-04-04
Description: Riverbed RiOS before 9.0.1 does not properly restrict shell access in single-user mode, which makes it easier for physically proximate attackers to obtain root privileges and access decrypted data by replacing the /opt/tms/bin/cli file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732
References: http://seclists.org/fulldisclosure/2017/Feb/25; https://supportkb.riverbed.com/support/index?page=content&id=S30065; http://seclists.org/fulldisclosure/2017/Feb/25
CVE: CVE-2015-1611
Published: 2017-04-04
Description: OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.internetsociety.org/sites/default/files/10_4_2.pdf; http://www.securityfocus.com/bid/73254; https://cloudrouter.org/security/
CVE: CVE-2015-1612
Published: 2017-04-04
Description: OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka "LLDP Relay."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.internetsociety.org/sites/default/files/10_4_2.pdf; http://www.securityfocus.com/bid/73254; https://cloudrouter.org/security/