deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4312
Published: 2017-02-17
Description: XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp.  NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt; http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html; http://www.securityfocus.com/archive/1/539199/100/0/threaded
CVE: CVE-2016-4314
Published: 2017-02-17
Description: Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-LOCAL-FILE-INCLUSION.txt; http://packetstormsecurity.com/files/138330/WSO2-Carbon-4.4.5-Local-File-Inclusion.html; http://www.securityfocus.com/archive/1/539200/100/0/threaded
CVE: CVE-2016-4315
Published: 2017-02-17
Description: Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxy_ajaxprocessor.jsp.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-CSRF-DOS.txt; http://packetstormsecurity.com/files/138332/WSO2-Carbon-4.4.5-Cross-Site-Request-Forgery-Denial-Of-Service.html; http://www.securityfocus.com/archive/1/539202/100/0/threaded
CVE: CVE-2016-4316
Published: 2017-02-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt; http://packetstormsecurity.com/files/138331/WSO2-Carbon-4.4.5-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/539201/100/0/threaded
CVE: CVE-2016-4327
Published: 2017-02-17
Description: Cross-site scripting (XSS) vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20[PII_REDACTED] and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/137073/WSO2-SOA-Enablement-Server-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/538413/100/0/threaded; http://www.securityfocus.com/bid/85893
CVE: CVE-2016-4861
Published: 2017-02-17
Description: The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN18926672/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000158; https://framework.zend.com/security/advisory/ZF2016-03
CVE: CVE-2016-5417
Published: 2017-02-17
Description: Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.24 allows remote attackers to cause a denial of service (memory consumption) by leveraging partial initialization of internal resolver data structures.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/08/02/5; http://www.securityfocus.com/bid/92257; https://sourceware.org/bugzilla/show_bug.cgi?id=19257
CVE: CVE-2016-6233
Published: 2017-02-17
Description: The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/91802; https://framework.zend.com/security/advisory/ZF2016-02; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2/
CVE: CVE-2016-8652
Published: 2017-02-17
Description: The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://dovecot.org/pipermail/dovecot-news/2016-December/000333.html; http://www.openwall.com/lists/oss-security/2016/12/02/4; http://www.openwall.com/lists/oss-security/2016/12/05/12
CVE: CVE-2016-9139
Published: 2017-02-17
Description: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94141; https://www.otrs.com/security-advisory-2016-02-security-update-otrs/; http://www.securityfocus.com/bid/94141
CVE: CVE-2016-9637
Published: 2017-02-17
Description: The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2016-2963.html; http://www.securityfocus.com/bid/94699; http://www.securitytracker.com/id/1037397
CVE: CVE-2016-9773
Published: 2017-02-17
Description: Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9556.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-125
References: http://www.openwall.com/lists/oss-security/2016/12/01/4; http://www.openwall.com/lists/oss-security/2016/12/02/11; http://www.openwall.com/lists/oss-security/2016/12/02/12
CVE: CVE-2016-9814
Published: 2017-02-17
Description: The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-399
References: http://www.securityfocus.com/bid/94730; https://lists.debian.org/debian-lts-announce/2018/03/msg00001.html; https://simplesamlphp.org/security/201612-01
CVE: CVE-2016-9827
Published: 2017-02-17
Description: The _iprintf function in outputtxt.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of service (buffer over-read) via a crafted SWF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/01/7; http://www.openwall.com/lists/oss-security/2016/12/05/2; http://www.securityfocus.com/bid/95086
CVE: CVE-2016-9828
Published: 2017-02-17
Description: The dumpBuffer function in read.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SWF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/12/01/8; http://www.openwall.com/lists/oss-security/2016/12/05/3; http://www.securityfocus.com/bid/94627
CVE: CVE-2016-9829
Published: 2017-02-17
Description: Heap-based buffer overflow in the parseSWF_DEFINEFONT function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to have unspecified impact via a crafted SWF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/01/5; http://www.openwall.com/lists/oss-security/2016/12/05/4; http://www.securityfocus.com/bid/95133
CVE: CVE-2016-9831
Published: 2017-02-17
Description: Heap-based buffer overflow in the parseSWF_RGBA function in parser.c in the listswf tool in libming 0.4.7 allows remote attackers to have unspecified impact via a crafted SWF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/12/01/6; http://www.openwall.com/lists/oss-security/2016/12/05/6; http://www.securityfocus.com/bid/94767
CVE: CVE-2016-9955
Published: 2017-02-17
Description: The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94946; https://lists.debian.org/debian-lts-announce/2018/03/msg00001.html; https://simplesamlphp.org/security/201612-02
CVE: CVE-2017-5357
Published: 2017-02-17
Description: regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command, which triggers an invalid free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2017/01/12/5; http://www.openwall.com/lists/oss-security/2017/01/12/6; http://www.openwall.com/lists/oss-security/2017/01/12/7
CVE: CVE-2017-5006
Published: 2017-02-17
Description: Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5007
Published: 2017-02-17
Description: Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing a page, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5008
Published: 2017-02-17
Description: Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5009
Published: 2017-02-17
Description: WebRTC in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5010
Published: 2017-02-17
Description: Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5011
Published: 2017-02-17
Description: Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5012
Published: 2017-02-17
Description: A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5013
Published: 2017-02-17
Description: Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5014
Published: 2017-02-17
Description: Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5015
Published: 2017-02-17
Description: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5016
Published: 2017-02-17
Description: Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a remote attacker to show certain UI elements on a page they don't control via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5017
Published: 2017-02-17
Description: Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extract image fragments on systems with GeForce 8600M graphics chips via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5018
Published: 2017-02-17
Description: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrome app launcher page, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5019
Published: 2017-02-17
Description: A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5020
Published: 2017-02-17
Description: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5021
Published: 2017-02-17
Description: A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5022
Published: 2017-02-17
Description: Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5023
Published: 2017-02-17
Description: Type confusion in Histogram in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit a near null dereference via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5024
Published: 2017-02-17
Description: FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5025
Published: 2017-02-17
Description: FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5026
Published: 2017-02-17
Description: Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts on a page they don't control via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://rhn.redhat.com/errata/RHSA-2017-0206.html; http://www.debian.org/security/2017/dsa-3776; http://www.securityfocus.com/bid/95792
CVE: CVE-2017-5027
Published: 2017-02-17
Description: Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html; https://crbug.com/661126; https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html
CVE: CVE-2017-5344
Published: 2017-02-17
Description: An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil (main/java/com/dotmarketing/common/util/SQLUtil.java), as part of the remediation of CVE-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesServlet path. Overcoming these controls permits a number of blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://dotcms.com/security/SI-39; http://seclists.org/fulldisclosure/2017/Feb/34; http://www.securityfocus.com/bid/96259
CVE: CVE-2017-5998
Published: 2017-02-17
Description: Cross-site scripting (XSS) vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the str_log_name parameter in a "Web Admin Portal > Log Configuration > Add" action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://arthrocyber.com/research; http://arthrocyber.com/research
CVE: CVE-2017-6014
Published: 2017-02-17
Description: In Wireshark 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, causing continuous attempts to read the same zero length packet. This will quickly exhaust all system memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.debian.org/security/2017/dsa-3811; http://www.securityfocus.com/bid/96284; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13416
CVE: CVE-2017-6056
Published: 2017-02-17
Description: It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://rhn.redhat.com/errata/RHSA-2017-0517.html; http://rhn.redhat.com/errata/RHSA-2017-0826.html; http://rhn.redhat.com/errata/RHSA-2017-0827.html
CVE: CVE-2016-6251
Published: 2017-02-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2014-9905
Published: 2017-02-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/07/09/3; https://github.com/inverse-inc/sogo/commit/1a7fc2a0e90a19dfb1fce292ae5ff53aa513ade9; https://github.com/inverse-inc/sogo/commit/3a5e44e7eb8b390b67a8f8a83030b[PII_REDACTED]1