deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2265
Published: 2017-07-17
Description: Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.4.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://resumenext.blog.fc2.com/blog-entry-30.html; https://jvn.jp/en/jp/JVN42031953/index.html; http://resumenext.blog.fc2.com/blog-entry-30.html
CVE: CVE-2017-2266
Published: 2017-07-17
Description: Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.1.0.4.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://resumenext.blog.fc2.com/blog-entry-30.html; https://jvn.jp/en/jp/JVN42031953/index.html; http://resumenext.blog.fc2.com/blog-entry-30.html
CVE: CVE-2017-2267
Published: 2017-07-17
Description: Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.5.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://resumenext.blog.fc2.com/blog-entry-30.html; https://jvn.jp/en/jp/JVN42031953/index.html; http://resumenext.blog.fc2.com/blog-entry-30.html
CVE: CVE-2017-2268
Published: 2017-07-17
Description: Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.1.0.5.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://resumenext.blog.fc2.com/blog-entry-30.html; https://jvn.jp/en/jp/JVN42031953/index.html; http://resumenext.blog.fc2.com/blog-entry-30.html
CVE: CVE-2017-2269
Published: 2017-07-17
Description: Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.2.0.9 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://resumenext.blog.fc2.com/blog-entry-30.html; https://jvn.jp/en/jp/JVN42031953/index.html; http://resumenext.blog.fc2.com/blog-entry-30.html
CVE: CVE-2017-2270
Published: 2017-07-17
Description: Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.2.0.9 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://resumenext.blog.fc2.com/blog-entry-30.html; https://jvn.jp/en/jp/JVN42031953/index.html; http://resumenext.blog.fc2.com/blog-entry-30.html
CVE: CVE-2017-2271
Published: 2017-07-17
Description: Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.2.8.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN61502349/index.html; https://jvn.jp/en/jp/JVN61502349/index.html
CVE: CVE-2017-2272
Published: 2017-07-17
Description: Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.3.2.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN61502349/index.html; https://jvn.jp/en/jp/JVN61502349/index.html
CVE: CVE-2017-2314
Published: 2017-07-17
Description: Receipt of a malformed BGP OPEN message may cause the routing protocol daemon (rpd) process to crash and restart. By continuously sending specially crafted BGP OPEN messages, an attacker can repeatedly crash the rpd process causing prolonged denial of service. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 12.3 prior to 12.3R12-S4, 12.3R13, 12.3R3-S4; 12.3X48 prior to 12.3X48-D50; 13.3 prior to 13.3R4-S11, 13.3R10; 14.1 prior to 14.1R8-S3, 14.1R9; 14.1X53 prior to 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R4-S7, 14.2R6-S4, 14.2R7; 15.1 prior to 15.1F2-S11, 15.1F4-S1-J1, 15.1F5-S3, 15.1F6, 15.1R4; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D33, 15.1X53-D50.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1038889; https://kb.juniper.net/JSA10779; http://www.securitytracker.com/id/1038889
CVE: CVE-2017-2335
Published: 2017-07-17
Description: A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99590; http://www.securitytracker.com/id/1038881; https://kb.juniper.net/JSA10782
CVE: CVE-2017-2336
Published: 2017-07-17
Description: A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based attacker to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the attacker to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99590; http://www.securitytracker.com/id/1038881; https://kb.juniper.net/JSA10782
CVE: CVE-2017-2337
Published: 2017-07-17
Description: A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99590; http://www.securitytracker.com/id/1038881; https://kb.juniper.net/JSA10782
CVE: CVE-2017-2338
Published: 2017-07-17
Description: A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99590; http://www.securitytracker.com/id/1038881; https://kb.juniper.net/JSA10782
CVE: CVE-2017-2339
Published: 2017-07-17
Description: A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the lower-privileged user to effectively execute commands with the permissions of an administrator. This issue affects Juniper Networks ScreenOS 6.3.0 releases prior to 6.3.0r24 on SSG Series. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99590; http://www.securitytracker.com/id/1038881; https://kb.juniper.net/JSA10782
CVE: CVE-2017-2341
Published: 2017-07-17
Description: An insufficient authentication vulnerability on platforms where Junos OS instances are run in a virtualized environment, may allow unprivileged users on the Junos OS instance to gain access to the host operating environment, and thus escalate privileges. Affected releases are Juniper Networks Junos OS 14.1X53 prior to 14.1X53-D40 on QFX5110, QFX5200, QFX10002, QFX10008, QFX10016, EX4600 and NFX250; 15.1 prior to 15.1R5 on EX4600; 15.1X49 prior to 15.1X49-D70 on vSRX, SRX1500, SRX4100, SRX4200; 16.1 prior to 16.1R2 on EX4600, ACX5000 series. This issue does not affect vMX. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.securitytracker.com/id/1038893; https://kb.juniper.net/JSA10787; http://www.securitytracker.com/id/1038893
CVE: CVE-2017-2342
Published: 2017-07-17
Description: MACsec feature on Juniper Networks Junos OS 15.1X49 prior to 15.1X49-D100 on SRX300 series does not report errors when a secure link can not be established. It falls back to an unencrypted link. This can happen when MACsec is configured on ports that are not capable of MACsec or when a secure link can not be established. This can mislead customers into believing that a link is secure. On SRX 300 series devices, prior to 15.1X49-D100, MACsec was only supported on control and fabric ports of SRX340 and SRX345 devices. SRX300 and and SRX320 did not have any MACsec capable ports. Configuring MACsec on ports that were not MACsec capable would have resulted in this issue. Affected releases are Juniper Networks Junos OS 15.1X49 prior to 15.1X49-D100 on SRX300 series.
CVSS Score: 8.1 (HIGH)
CWE: CWE-392
References: http://www.securitytracker.com/id/1038890; https://kb.juniper.net/JSA10790; http://www.securitytracker.com/id/1038890
CVE: CVE-2017-2343
Published: 2017-07-17
Description: The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of user profiles on top of the existing firewall polices. As part of an internal security review of the UserFW services authentication API, hardcoded credentials were identified and removed which can impact both the SRX Series device, and potentially LDAP and Active Directory integrated points. An attacker may be able to completely compromise SRX Series devices, as well as Active Directory servers and services. When Active Directory is compromised, it may allow access to user credentials, workstations, servers performing other functions such as email, database, etc. Inter-Forest Active Directory deployments may also be at risk as the attacker may gain full administrative control over one or more Active Directories depending on the credentials supplied by the administrator of the AD domains and SRX devices performing integrated authentication of users, groups and devices. To identify if your device is potentially vulnerable to exploitation, check to see if the service is operating; from CLI review the following output: root@SRX-Firewall# run show services user-identification active-directory-access domain-controller status extensive A result of "Status: Connected" will indicate that the service is active on the device. To evaluate if user authentication is occurring through the device: root@SRX-Firewall# run show services user-identification active-directory-access active-directory-authentication-table all Next review the results to see if valid users and groups are returned. e.g. Domain: juniperlab.com Total entries: 3 Source IP Username groups state 172.16.26.1 administrator Valid 192.168.26.2 engg01 engineers Valid 192.168.26.3 guest01 guests Valid Domain: NULL Total entries: 8 Source IP Username groups state 192.168.26.4 Invalid 192.168.26.5 Invalid This will also indicate that Valid users and groups are authenticating through the device. Affected releases are Juniper Networks Junos OS 12.3X48 from 12.3X48-D30 and prior to 12.3X48-D35 on SRX series; 15.1X49 from 15.1X49-D40 and prior to 15.1X49-D50 on SRX series. Devices on any version of Junos OS 12.1X46, or 12.1X47 are unaffected by this issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-798
References: http://www.securitytracker.com/id/1038904; https://kb.juniper.net/JSA10791; http://www.securitytracker.com/id/1038904
CVE: CVE-2017-2344
Published: 2017-07-17
Description: A routine within an internal Junos OS sockets library is vulnerable to a buffer overflow. Malicious exploitation of this issue may lead to a denial of service (kernel panic) or be leveraged as a privilege escalation through local code execution. The routines are only accessible via programs running on the device itself, and veriexec restricts arbitrary programs from running on Junos OS. There are no known exploit vectors utilizing signed binaries shipped with Junos OS itself. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D67; 12.3X48 prior to 12.3X48-D51, 12.3X48-D55; 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R2-S10, 14.1R8-S4, 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D122, 14.1X53-D45, 14.1X53-D50; 14.2 prior to 14.2R4-S9, 14.2R7-S7, 14.2R8; 15.1 prior to 15.1F2-S18, 15.1F6-S7, 15.1R4-S8, 15.1R5-S5, 15.1R6-S1, 15.1R7; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D231, 15.1X53-D47, 15.1X53-D48, 15.1X53-D57, 15.1X53-D64, 15.1X53-D70; 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R4-S4, 16.1R5; 16.2 prior to 16.2R2; 17.1 prior to 17.1R1-S3, 17.1R2; 17.2 prior to 17.2R1-S1, 17.2R2; 17.2X75 prior to 17.2X75-D30. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99556; http://www.securitytracker.com/id/1038896; https://kb.juniper.net/JSA10792
CVE: CVE-2017-2345
Published: 2017-07-17
Description: On Junos OS devices with SNMP enabled, a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to crash and restart by sending a crafted SNMP packet. Repeated crashes of the snmpd daemon can result in a partial denial of service condition. Additionally, it may be possible to craft a malicious SNMP packet in a way that can result in remote code execution. SNMP is disabled in Junos OS by default. Junos OS devices with SNMP disabled are not affected by this issue. No other Juniper Networks products or platforms are affected by this issue.  NOTE: This is a different issue than Cisco CVE-2017-6736, CVE-2017-6737, and CVE-2017-6738. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D67; 12.3X48 prior to 12.3X48-D51, 12.3X48-D55; 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R2-S10, 14.1R8-S4, 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D122, 14.1X53-D44, 14.1X53-D50; 14.2 prior to 14.2R4-S9, 14.2R7-S7, 14.2R8; 15.1 prior to 15.1F2-S18, 15.1F6-S7, 15.1R4-S8, 15.1R5-S5, 15.1R6-S1, 15.1R7; 15.1X49 prior to 15.1X49-D100, 15.1X49-D110; 15.1X53 prior to 15.1X53-D231, 15.1X53-D47, 15.1X53-D48, 15.1X53-D57, 15.1X53-D64, 15.1X53-D70; 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R4-S4, 16.1R5; 16.2 prior to 16.2R2, 16.2R3; 17.1 prior to 17.1R1-S3, 17.1R2, 17.1R3; 17.2 prior to 17.2R1-S1, 17.2R2; 17.2X75 prior to 17.2X75-D30. Junos releases prior to 10.2 are not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99567; http://www.securitytracker.com/id/1038903; https://kb.juniper.net/JSA10793
CVE: CVE-2017-2346
Published: 2017-07-17
Description: An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway (ALG). Repeated crashes of the Service PC can result in an extended denial of service condition. The issue can be seen only if NAT or stateful-firewall rules are configured with ALGs enabled. This issue was caused by the code change for PR 1182910 in Junos OS 14.1X55-D30, 14.1X55-D35, 14.2R7, 15.1R5, and 16.1R2. No other versions of Junos OS and no other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS on MX platforms running: 14.1X55 from 14.1X55-D30 to releases prior to 14.1X55-D35; 14.2R from 14.2R7 to releases prior to 14.2R7-S4, 14.2R8; 15.1R from 15.1R5 to releases prior to 15.1R5-S2, 15.1R6; 16.1R from 16.1R2 to releases prior to 16.1R3-S2, 16.1R4.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securitytracker.com/id/1038895; https://kb.juniper.net/JSA10794; http://www.securitytracker.com/id/1038895
CVE: CVE-2017-2347
Published: 2017-07-17
Description: A denial of service vulnerability in rpd daemon of Juniper Networks Junos OS allows a malformed MPLS ping packet to crash the rpd daemon if MPLS OAM is configured. Repeated crashes of the rpd daemon can result in an extended denial of service condition for the device. The affected releases are Junos OS 12.3X48 prior to 12.3X48-D50, 12.3X48-D55; 13.3 prior to 13.3R10; 14.1 prior to 14.1R4-S13, 14.1R8-S3, 14.1R9; 14.1X53 prior to 14.1X53-D42, 14.1X53-D50; 14.2 prior to 14.2R4-S8, 14.2R7-S6, 14.2R8; 15.1 prior to 15.1F2-S14, 15.1F5-S7, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5-S1, 15.1R6; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D105, 15.1X53-D47, 15.1X53-D62, 15.1X53-D70; 16.1 prior to 16.1R3-S3, 16.1R4. No other Juniper Networks products or platforms are affected by this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100236; http://www.securitytracker.com/id/1038892; https://kb.juniper.net/JSA10795
CVE: CVE-2017-2348
Published: 2017-07-17
Description: The Juniper Enhanced jdhcpd daemon may experience high CPU utilization, or crash and restart upon receipt of an invalid IPv6 UDP packet. Both high CPU utilization and repeated crashes of the jdhcpd daemon can result in a denial of service as DHCP service is interrupted. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 14.1X53 prior to 14.1X53-D12, 14.1X53-D38, 14.1X53-D40 on QFX, EX, QFabric System; 15.1 prior to 15.1F2-S18, 15.1R4 on all products and platforms; 15.1X49 prior to 15.1X49-D80 on SRX; 15.1X53 prior to 15.1X53-D51, 15.1X53-D60 on NFX, QFX, EX.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securitytracker.com/id/1038899; https://kb.juniper.net/JSA10800; http://www.securitytracker.com/id/1038899
CVE: CVE-2017-2349
Published: 2017-07-17
Description: A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to the device to execute shell commands and elevate privileges. Affected releases are Juniper Networks Junos OS 12.1X44 prior to 12.1X44-D60; 12.1X46 prior to 12.1X46-D50; 12.1X47 prior to 12.1X47-D30, 12.1X47-D35; 12.3X48 prior to 12.3X48-D20, 12.3X48-D30; 15.1X49 prior to 15.1X49-D20, 15.1X49-D30.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77
References: http://www.securitytracker.com/id/1038898; https://kb.juniper.net/JSA10801; http://www.securitytracker.com/id/1038898
CVE: CVE-2017-3080
Published: 2017-07-17
Description: Adobe Flash Player versions 26.0.0.131 and earlier have a security bypass vulnerability related to the Flash API used by Internet Explorer. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/99519; http://www.securitytracker.com/id/1038845; https://access.redhat.com/errata/RHSA-2017:1731
CVE: CVE-2017-3099
Published: 2017-07-17
Description: Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/99520; http://www.securitytracker.com/id/1038845; https://access.redhat.com/errata/RHSA-2017:1731
CVE: CVE-2017-3100
Published: 2017-07-17
Description: Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/99523; http://www.securitytracker.com/id/1038845; https://access.redhat.com/errata/RHSA-2017:1731
CVE: CVE-2017-3101
Published: 2017-07-17
Description: Adobe Connect versions 9.6.1 and earlier have a clickjacking vulnerability. Successful exploitation could lead to a clickjacking attack.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/99521; http://www.securitytracker.com/id/1038846; https://helpx.adobe.com/security/products/connect/apsb17-22.html
CVE: CVE-2017-3102
Published: 2017-07-17
Description: Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation could lead to a reflected cross-site scripting attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99517; http://www.securitytracker.com/id/1038846; https://helpx.adobe.com/security/products/connect/apsb17-22.html
CVE: CVE-2017-3103
Published: 2017-07-17
Description: Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to a stored cross-site scripting attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99518; http://www.securitytracker.com/id/1038846; https://helpx.adobe.com/security/products/connect/apsb17-22.html
CVE: CVE-2017-7663
Published: 2017-07-17
Description: Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://markmail.org/message/aka2z2dq7icfw2p2; http://www.securityfocus.com/bid/99577; http://markmail.org/message/aka2z2dq7icfw2p2
CVE: CVE-2017-7664
Published: 2017-07-17
Description: Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-611
References: http://markmail.org/message/cwr552iapmhukb45; http://www.securityfocus.com/bid/99576; http://markmail.org/message/cwr552iapmhukb45
CVE: CVE-2017-7666
Published: 2017-07-17
Description: Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: http://markmail.org/message/fkesu4e5hhz5xdbg; http://markmail.org/message/fkesu4e5hhz5xdbg
CVE: CVE-2017-7673
Published: 2017-07-17
Description: Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-326
References: http://markmail.org/message/3hshl26omwjo6c5i; http://www.securityfocus.com/bid/99587; http://markmail.org/message/3hshl26omwjo6c5i
CVE: CVE-2017-7680
Published: 2017-07-17
Description: Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.
CVSS Score: 7.5 (HIGH)
References: http://markmail.org/message/whhibri7ervbjvda; http://markmail.org/message/whhibri7ervbjvda
CVE: CVE-2017-7681
Published: 2017-07-17
Description: Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://markmail.org/message/j774dp5ro5xmkmg6; http://markmail.org/message/j774dp5ro5xmkmg6