deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6610
Published: 2017-04-20
Description: A vulnerability in the Internet Key Exchange Version 1 (IKEv1) XAUTH code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of an affected system. The vulnerability is due to insufficient validation of the IKEv1 XAUTH parameters passed during an IKEv1 negotiation. An attacker could exploit this vulnerability by sending crafted parameters. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability only affects systems configured in routed firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 or IPv6 traffic. A valid IKEv1 Phase 1 needs to be established to exploit this vulnerability, which means that an attacker would need to have knowledge of a pre-shared key or have a valid certificate for phase 1 authentication. This vulnerability affects Cisco ASA Software running on the following products: Cisco ASA 1000V Cloud Firewall, Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA 5500-X Series Next-Generation Firewalls, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Cisco Adaptive Security Virtual Appliance (ASAv), Cisco ASA for Firepower 9300 Series, Cisco ISA 3000 Industrial Security Appliance. Fixed versions: 9.1(7.7) 9.2(4.11) 9.4(4) 9.5(3) 9.6(1.5). Cisco Bug IDs: CSCuz11685.
CVSS Score: 7.7 (HIGH)
CWE: CWE-399, CWE-20
References: http://www.securityfocus.com/bid/97934; http://www.securitytracker.com/id/1038314; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-xauth
CVE: CVE-2017-6611
Published: 2017-04-20
Description: A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting the malicious code. An exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCuw65830.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/97931; http://www.securitytracker.com/id/1038330; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cpi
CVE: CVE-2017-6613
Published: 2017-04-20
Description: A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause the DNS process to momentarily restart, which could lead to a partial denial of service (DoS) condition on the affected system. The vulnerability is due to incomplete DNS packet header validation when the packet is received by the application. An attacker could exploit this vulnerability by sending a malformed DNS packet to the application. An exploit could allow the attacker to cause the DNS process to restart, which could lead to a DoS condition. This vulnerability affects Cisco Prime Network Registrar on all software versions prior to 8.3.5. Cisco Bug IDs: CSCvb55412.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-399, CWE-20
References: http://www.securityfocus.com/bid/97924; http://www.securitytracker.com/id/1038331; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-prime-dns
CVE: CVE-2017-6614
Published: 2017-04-20
Description: A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an authenticated, remote attacker to download and view any system file by using the affected software. The vulnerability is due to the absence of role-based access control (RBAC) for file-download requests that are sent to the affected software. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to download and view any system file by using the affected software. Cisco Bug IDs: CSCvd11628.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/97926; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-findit; http://www.securityfocus.com/bid/97926
CVE: CVE-2017-6615
Published: 2017-04-20
Description: A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a race condition that could occur when the affected software processes an SNMP read request that contains certain criteria for a specific object ID (OID) and an active crypto session is disconnected on an affected device. An attacker who can authenticate to an affected device could trigger this vulnerability by issuing an SNMP request for a specific OID on the device. A successful exploit will cause the device to restart due to an attempt to access an invalid memory region. The attacker does not control how or when crypto sessions are disconnected on the device. Cisco Bug IDs: CSCvb94392.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-399, CWE-125, CWE-362
References: http://www.securityfocus.com/bid/97930; http://www.securitytracker.com/id/1038328; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-ios-xe-snmp
CVE: CVE-2017-6616
Published: 2017-04-20
Description: A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize specific values that are received as part of a user-supplied HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the user on the affected system. Cisco Bug IDs: CSCvd14578.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/97928; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc3; http://www.securityfocus.com/bid/97928
CVE: CVE-2017-6617
Published: 2017-04-20
Description: A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not assign a new session identifier to a user session when a user authenticates to the web-based GUI. An attacker could exploit this vulnerability by using a hijacked session identifier to connect to the software through the web-based GUI. A successful exploit could allow the attacker to hijack an authenticated user's browser session on the affected system. Cisco Bug IDs: CSCvd14583.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/97929; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc2; http://www.securityfocus.com/bid/97929
CVE: CVE-2017-6618
Published: 2017-04-20
Description: A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by persuading an authenticated user of the web-based GUI on an affected system to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary code in the context of the web-based GUI on the affected system. Cisco Bug IDs: CSCvd14587.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/97927; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc1; http://www.securityfocus.com/bid/97927
CVE: CVE-2017-6619
Published: 2017-04-20
Description: A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize user-supplied HTTP input. An attacker could exploit this vulnerability by sending an HTTP POST request that contains crafted, deserialized user data to the affected software. A successful exploit could allow the attacker to execute arbitrary commands with root-level privileges on the affected system, which the attacker could use to conduct further attacks. Cisco Bug IDs: CSCvd14591.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/97925; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc; http://www.securityfocus.com/bid/97925
CVE: CVE-2017-7990
Published: 2017-04-21
Description: The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/openmrs/openmrs-module-reporting/pull/141/commits/0023a659288538d[PII_REDACTED]d3414ecb18b931a#diff-50e25eddc5909110fa3d31090877c2fd; https://www.youtube.com/watch?v=pfrIaNvIuFY; https://github.com/openmrs/openmrs-module-reporting/pull/141/commits/0023a659288538d[PII_REDACTED]d3414ecb18b931a#diff-50e25eddc5909110fa3d31090877c2fd
CVE: CVE-2016-4075
Published: 2017-04-21
Description: Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://abhikafle.com.np/opera-url-spoofing-poc/; http://www.securityfocus.com/bid/98004; http://abhikafle.com.np/opera-url-spoofing-poc/
CVE: CVE-2017-7220
Published: 2017-04-21
Description: OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s SET user_privileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4532.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://seclists.org/bugtraq/2017/Apr/61; https://gist.github.com/andreybpanfilov/d8792484e13971982c0719ae59ab8c7c; https://gist.github.com/andreybpanfilov/e0e60ae9d525a34cca04eb4c89a21e04
CVE: CVE-2017-7409
Published: 2017-04-21
Description: Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97953; http://www.securitytracker.com/id/1038355; https://security.paloaltonetworks.com/CVE-2017-7409
CVE: CVE-2017-7951
Published: 2017-04-21
Description: WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/robiso/wondercms/releases/tag/2.0.3; https://www.wondercms.com/forum/viewtopic.php?f=8&p=1684; https://github.com/robiso/wondercms/releases/tag/2.0.3
CVE: CVE-2016-0833
Published: 2017-04-21
Description: Android allows users to cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/98009; https://www.linkedin.com/in/jose-maria-ariel-martinez-juarez-7910a189/; http://www.securityfocus.com/bid/98009/info
CVE: CVE-2016-1148
Published: 2017-04-21
Description: Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN22578691/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000019.html; https://akerun.com/2016-02-12-akerun-ios-app-security-update/
CVE: CVE-2016-1184
Published: 2017-04-21
Description: Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN00272277/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000049.html; http://www.tokyostarbank.co.jp/important151222.html
CVE: CVE-2016-1194
Published: 2017-04-21
Description: Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://jvn.jp/en/jp/JVN26298347/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000080.html; https://support.cybozu.com/ja-jp/article/8983
CVE: CVE-2016-4829
Published: 2017-04-21
Description: DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN39594409/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000120.html; http://jvn.jp/en/jp/JVN39594409/index.html
CVE: CVE-2016-4830
Published: 2017-04-21
Description: Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN30260727/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000122.html; http://www.securityfocus.com/bid/91490
CVE: CVE-2016-4832
Published: 2017-04-21
Description: WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN68364327/index.html; http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-000124.html; http://www.securityfocus.com/bid/91789
CVE: CVE-2016-4840
Published: 2017-04-21
Description: Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN06920277/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000133.html; http://www.securityfocus.com/bid/92314
CVE: CVE-2016-4841
Published: 2017-04-21
Description: Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN01353821/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000135.html; http://www.securityfocus.com/bid/92459
CVE: CVE-2016-4846
Published: 2017-04-21
Description: Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN45583702/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000139.html; http://www.securebrain.co.jp/about/news/2016/08/160817.html
CVE: CVE-2017-7992
Published: 2017-04-21
Description: Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hps/heartland-php/issues/28; https://github.com/hps/heartland-php/issues/28
CVE: CVE-2016-0720
Published: 2017-04-21
Description: Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178261.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178384.html; http://rhn.redhat.com/errata/RHSA-2016-2596.html
CVE: CVE-2016-0721
Published: 2017-04-21
Description: Session fixation vulnerability in pcsd in pcs before 0.9.157.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178261.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178384.html; http://rhn.redhat.com/errata/RHSA-2016-2596.html
CVE: CVE-2016-10091
Published: 2017-04-21
Description: Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to the (1) cmd_expand function, (2) cmd_emboss function, or (3) cmd_engrave function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://hg.savannah.gnu.org/hgweb/unrtf/rev/3b16893a6406; http://www.openwall.com/lists/oss-security/2016/12/31/3; http://www.openwall.com/lists/oss-security/2017/01/01/1
CVE: CVE-2016-1555
Published: 2017-04-21
Description: (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2016/Feb/112; https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic
CVE: CVE-2016-1556
Published: 2017-04-21
Description: Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allows remote attackers to read the wireless WPS PIN or passphrase by visiting unauthenticated webpages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2016/Feb/112; https://kb.netgear.com/30481/CVE-2016-1556-Notification?cid=wmt_netgear_organic
CVE: CVE-2016-1557
Published: 2017-04-21
Description: Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2016/Feb/112; https://kb.netgear.com/30482/CVE-2016-1557-Notification?cid=wmt_netgear_organic
CVE: CVE-2016-1558
Published: 2017-04-21
Description: Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. B1 3.05 and earlier, DAP-2660 1.11 and earlier, DAP-2690 3.15 and earlier, DAP-2695 1.16 and earlier, DAP-3320 1.00 and earlier, and DAP-3662 1.01 and earlier allows remote attackers to have unspecified impact via a crafted 'dlink_uid' cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2016/Feb/112; http://www.dlink.com/mk/mk/support/support-news/2016/march/16/firmadyne-cve_2016_1558-cve_2016_1559
CVE: CVE-2016-1559
Published: 2017-04-21
Description: D-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ver. A1 1.16 and earlier reveal wireless passwords and administrative usernames and passwords over SNMP.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2016/Feb/112; http://www.dlink.com/mk/mk/support/support-news/2016/march/16/firmadyne-cve_2016_1558-cve_2016_1559
CVE: CVE-2016-6519
Published: 2017-04-21
Description: Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-2115.html; http://rhn.redhat.com/errata/RHSA-2016-2116.html; http://rhn.redhat.com/errata/RHSA-2016-2117.html
CVE: CVE-2017-7994
Published: 2017-04-21
Description: The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97980; https://github.com/icepng/PoC/tree/master/PoC1; https://icepng.github.io/2017/04/21/PoDoFo-1/
CVE: CVE-2017-8050
Published: 2017-04-21
Description: Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password.
CVSS Score: 7.5 (HIGH)
References: http://www.tenable.com/security/tns-2017-07; https://vulndb.cyberriskanalytics.com/153134; http://www.tenable.com/security/tns-2017-07
CVE: CVE-2017-8051
Published: 2017-04-21
Description: Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_appliance_session_user parameter, a remote attacker can inject arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.tenable.com/security/tns-2017-07; https://vulndb.cyberriskanalytics.com/153135; https://www.exploit-db.com/exploits/41892/
CVE: CVE-2016-1186
Published: 2017-04-21
Description: Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN91816422/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000056.html; http://www.securityfocus.com/bid/97976
CVE: CVE-2016-1187
Published: 2017-04-21
Description: Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN11994518/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000060.html; https://support.cybozu.com/ja-jp/article/9446
CVE: CVE-2016-1198
Published: 2017-04-21
Description: Photopt for Android before 2.0.1 does not verify SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN11815655/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000050.html; https://mypocket.ntt.com/photopt/info/info_001.html
CVE: CVE-2016-1210
Published: 2017-04-21
Description: The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN11877654/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000065.html; http://jvn.jp/en/jp/JVN11877654/index.html
CVE: CVE-2016-1221
Published: 2017-04-21
Description: Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN43529183/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000067.html; http://jvn.jp/en/jp/JVN43529183/index.html