deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6994
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98571; https://support.apple.com/HT207798; https://support.apple.com/HT207800
CVE: CVE-2017-6995
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98571; https://support.apple.com/HT207798; https://support.apple.com/HT207800
CVE: CVE-2017-6996
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98571; https://support.apple.com/HT207798; https://support.apple.com/HT207800
CVE: CVE-2017-6997
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98571; https://support.apple.com/HT207798; https://support.apple.com/HT207800
CVE: CVE-2017-6998
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98571; https://support.apple.com/HT207798; https://support.apple.com/HT207800
CVE: CVE-2017-6999
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98571; https://support.apple.com/HT207798; https://support.apple.com/HT207800
CVE: CVE-2017-9140
Published: 2017-05-22
Description: Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.telerik.com/support/whats-new/reporting/release-history/telerik-reporting-r1-2017-sp2-%28version-11-0-17-406%29; https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018; https://www.veracode.com/blog/research/anatomy-cross-site-scripting-flaw-telerik-reporting-module
CVE: CVE-2017-4915
Published: 2017-05-22
Description: VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/98566; http://www.securitytracker.com/id/1038525; https://www.exploit-db.com/exploits/42045/
CVE: CVE-2017-4916
Published: 2017-05-22
Description: VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Successful exploitation of this issue may allow host users with normal user privileges to trigger a denial-of-service in a Windows host machine.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/98560; http://www.securitytracker.com/id/1038526; https://www.exploit-db.com/exploits/42140/
CVE: CVE-2017-9141
Published: 2017-05-22
Description: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-617
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98606; https://github.com/ImageMagick/ImageMagick/commit/0c5b1e430a83ef793a7334bbbee408cf3c628699
CVE: CVE-2017-9142
Published: 2017-05-22
Description: In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-617
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98683; https://github.com/ImageMagick/ImageMagick/commit/f0232a2a45dfd003c1faf[PII_REDACTED]df3ab0ee1
CVE: CVE-2017-9143
Published: 2017-05-22
Description: In ImageMagick 7.0.5-5, the ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98682; https://github.com/ImageMagick/ImageMagick/commit/3b0fe05cddd8910f84e51b4d50099702ea45ba4a
CVE: CVE-2017-9144
Published: 2017-05-22
Description: In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98603; https://github.com/ImageMagick/ImageMagick/commit/f6240ee77847787f6d7618b669d3a2040a2d6d40
CVE: CVE-2017-7492
Published: 2017-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-7503. Reason: This candidate is a reservation duplicate of CVE-2017-7503. Notes: All CVE users should reference CVE-2017-7503 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2016-4854
Published: 2017-05-22
Description: Cross-site request forgery (CSRF) vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvndb.jvn.jp/jvndb/JVNDB-2016-000194; http://www.securityfocus.com/bid/93278; https://jvn.jp/en/jp/JVN46351856/index.html
CVE: CVE-2016-4863
Published: 2017-05-22
Description: The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168; http://www.securityfocus.com/bid/93479; https://jvn.jp/en/jp/JVN39619137/index.html
CVE: CVE-2016-4900
Published: 2017-05-22
Description: Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvndb.jvn.jp/jvndb/JVNDB-2016-000206; http://www.securityfocus.com/bid/93572; https://evernote.com/security/updates/#win
CVE: CVE-2016-4901
Published: 2017-05-22
Description: Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvndb.jvn.jp/jvndb/JVNDB-2016-000207; http://www.e-tax.nta.go.jp/topics/topics_281014.htm; http://www.securityfocus.com/bid/93606
CVE: CVE-2016-4903
Published: 2017-05-22
Description: Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93790; http://www.wp-olivecart.com/news/20160925.html; https://jvn.jp/en/jp/JVN14567604/index.html
CVE: CVE-2016-4904
Published: 2017-05-22
Description: Cross-site request forgery (CSRF) vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to hijack the authentication of a user to perform unintended operations via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000209.html; http://www.securityfocus.com/bid/93790; http://www.wp-olivecart.com/news/20160925.html
CVE: CVE-2016-4905
Published: 2017-05-22
Description: SQL injection vulnerability in the WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows attackers with administrator rights to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000210.html; http://www.securityfocus.com/bid/93790; http://www.wp-olivecart.com/news/20160925.html
CVE: CVE-2016-7804
Published: 2017-05-22
Description: Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvndb.jvn.jp/jvndb/JVNDB-2016-000211; http://www.7-zip.org/history.txt; https://jvn.jp/en/jp/JVN76780067/index.html
CVE: CVE-2017-2161
Published: 2017-05-22
Description: FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 and earlier allows authenticated attackers to bypass access restrictions to obtain unauthorized image data via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-425
References: http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000090.html; http://www.toshiba-personalstorage.net/news/20170516a.htm; https://jvn.jp/en/jp/JVN46372675/index.html
CVE: CVE-2017-2162
Published: 2017-05-22
Description: FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 and earlier allows default credentials to be set for wireless LAN connections to the product when enabling the PhotoShare function through a web browser.
CVSS Score: 4.3 (MEDIUM)
References: http://jvndb.jvn.jp/jvndb/JVNDB-2017-000091; http://www.toshiba-personalstorage.net/news/20170516a.htm; https://jvn.jp/en/jp/JVN81820501/index.html
CVE: CVE-2017-2168
Published: 2017-05-22
Description: Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvndb.jvn.jp/jvndb/JVNDB-2017-000092; https://jvn.jp/en/jp/JVN96165722/index.html; https://wordpress.org/plugins/wp-booking-system/#developers
CVE: CVE-2017-2169
Published: 2017-05-22
Description: Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093; https://jvn.jp/en/jp/JVN70411623/index.html; https://wordpress.org/plugins/maxbuttons/#developers
CVE: CVE-2017-2171
Published: 2017-05-22
Description: Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-91
References: http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094; https://jvn.jp/en/jp/JVN24834813/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094
CVE: CVE-2017-2173
Published: 2017-05-22
Description: Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvndb.jvn.jp/jvndb/JVNDB-2017-000096; https://jvn.jp/en/jp/JVN85512750/index.html; https://www.ipa.go.jp/sec/info/20170519.html
CVE: CVE-2017-2174
Published: 2017-05-22
Description: Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvndb.jvn.jp/jvndb/JVNDB-2017-000097; https://jvn.jp/en/jp/JVN11326581/index.html; https://www.ipa.go.jp/sec/info/20170519.html
CVE: CVE-2017-2175
Published: 2017-05-22
Description: Untrusted search path vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvndb.jvn.jp/jvndb/JVNDB-2017-000098; https://jvn.jp/en/jp/JVN12493656/index.html; https://www.ipa.go.jp/sec/info/20170519.html
CVE: CVE-2017-5657
Published: 2017-05-22
Description: Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://archiva.apache.org/security.html#CVE-2017-5657; http://www.securityfocus.com/bid/98570; http://www.securitytracker.com/id/1038528
CVE: CVE-2017-9146
Published: 2017-05-22
Description: The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted tnef file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862707; https://github.com/Yeraze/ytnef/issues/47; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFJWMUEUC4ILH2HEOCYVVLQT654ZMCGQ/
CVE: CVE-2017-9147
Published: 2017-05-22
Description: LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, which might allow remote attackers to cause a denial of service (crash) via a crafted TIFF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://bugzilla.maptools.org/show_bug.cgi?id=2693; http://www.debian.org/security/2017/dsa-3903; http://www.securityfocus.com/bid/98594
CVE: CVE-2016-2172
Published: 2017-05-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-6891
Published: 2017-05-22
Description: Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=5520704d075802df25ce4ffccc010ba1641bd484; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html; http://www.debian.org/security/2017/dsa-3861
CVE: CVE-2017-9149
Published: 2017-05-22
Description: Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus contextual menu, which allows context-dependent attackers to obtain sensitive information by reading a file for which cleaning had been attempted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://0xacab.org/mat/mat/commit/8f6303a1f26fe8dad83ba96ab8328dbdfa3af59a; https://0xacab.org/mat/mat/commit/94ca62a429bb6a3a5f293de26053e54bbfeea9f9; https://0xacab.org/mat/mat/issues/11527
CVE: CVE-2016-6112
Published: 2017-05-22
Description: IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application. IBM X-Force ID: 118282.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg21992739; http://www.ibm.com/support/docview.wss?uid=swg21992739
CVE: CVE-2017-1092
Published: 2017-05-22
Description: IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID: 120390.
CVSS Score: 9.8 (CRITICAL)
References: http://www.ibm.com/support/docview.wss?uid=swg22002897; https://www.exploit-db.com/exploits/42091/; https://www.exploit-db.com/exploits/42541/
CVE: CVE-2017-1159
Published: 2017-05-22
Description: IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 122891.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22000253; http://www.securityfocus.com/bid/98561; http://www.ibm.com/support/docview.wss?uid=swg22000253
CVE: CVE-2017-1282
Published: 2017-05-22
Description: IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124760.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22002356; http://www.securityfocus.com/bid/98563; http://www.ibm.com/support/docview.wss?uid=swg22002356
CVE: CVE-2017-1289
Published: 2017-05-22
Description: IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/98401; https://access.redhat.com/errata/RHSA-2017:1220; https://access.redhat.com/errata/RHSA-2017:1221
CVE: CVE-2017-1320
Published: 2017-05-22
Description: IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22002877; http://www.securitytracker.com/id/1038505; http://www.ibm.com/support/docview.wss?uid=swg22002877
CVE: CVE-2017-9150
Published: 2017-05-22
Description: The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows local users to obtain sensitive address information via crafted bpf system calls.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0d0e57697f162da4aa218b5feafe614fb666db07; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.1; http://www.securityfocus.com/bid/98635
CVE: CVE-2015-1529
Published: 2017-05-23
Description: Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/76663; https://android.googlesource.com/platform/frameworks/av/+/b9096dc; https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf