deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-17948
Published: 2017-12-28
Description: Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md
CVE: CVE-2017-17949
Published: 2017-12-28
Description: Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md
CVE: CVE-2017-17950
Published: 2017-12-28
Description: Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/cell.md
CVE: CVE-2017-17951
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17952
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17953
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17954
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17955
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17956
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17957
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17958
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17959
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17960
Published: 2017-12-28
Description: PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/PHP%20Multivendor%20Ecommerce.md
CVE: CVE-2017-17967
Published: 2017-12-28
Description: pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT file, aka CNVD-2017-35482.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.cnvd.org.cn/flaw/show/1169328; http://www.cnvd.org.cn/flaw/show/1169328
CVE: CVE-2014-4914
Published: 2017-12-29
Description: The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://framework.zend.com/security/advisory/ZF2014-04; http://jvn.jp/en/jp/JVN71730320/index.html; http://openwall.com/lists/oss-security/2014/07/11/4
CVE: CVE-2013-7400
Published: 2017-12-29
Description: The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/09/11/4; https://extensions.typo3.org/extension/direct_mail/; https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-014/
CVE: CVE-2014-3651
Published: 2017-12-29
Description: JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1144278; https://issues.jboss.org/browse/KEYCLOAK-699; https://bugzilla.redhat.com/show_bug.cgi?id=1144278
CVE: CVE-2016-3695
Published: 2017-12-29
Description: The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: http://www.securityfocus.com/bid/102327; https://bugzilla.redhat.com/show_bug.cgi?id=1322755; https://github.com/mjg59/linux/commit/d7a6be58edc01b1c66ecd8fcc91236bfbce0a420
CVE: CVE-2017-16876
Published: 2017-12-29
Description: Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1524596; https://github.com/lepture/mistune/blob/master/CHANGES.rst; https://github.com/lepture/mistune/commit/5f06d724bc05580e7f203db2d4a4905fc1127f98
CVE: CVE-2017-17968
Published: 2017-12-29
Description: A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/43408/; https://www.exploit-db.com/exploits/43408/
CVE: CVE-2017-17916
Published: 2017-12-29
Description: SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/; https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/
CVE: CVE-2017-17917
Published: 2017-12-29
Description: SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/; https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/
CVE: CVE-2017-17919
Published: 2017-12-29
Description: SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/; https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/
CVE: CVE-2017-17920
Published: 2017-12-29
Description: SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/; https://kay-malwarebenchmark.github.io/blog/ruby-on-rails-arbitrary-sql-injection/
CVE: CVE-2017-17760
Published: 2017-12-29
Description: OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102974; https://github.com/opencv/opencv/issues/10351; https://github.com/opencv/opencv/pull/10369/commits/7bbe1a53cfc097b82b1589f7915a2120de39274c
CVE: CVE-2017-17933
Published: 2017-12-29
Description: cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/145572/NetWin-SurgeFTP-23f2-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/145572/NetWin-SurgeFTP-23f2-Cross-Site-Scripting.html
CVE: CVE-2017-17971
Published: 2017-12-29
Description: The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Dolibarr/dolibarr/issues/8000; https://github.com/Dolibarr/dolibarr/issues/8000
CVE: CVE-2017-17910
Published: 2017-12-29
Description: On Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single radio transmission. An attacker can intercept an arbitrary radio frame exchanged between a BiSecur transmitter and a receiver to obtain the encrypted packet and the 32-bit serial number. The interception of the one-time pairing process is specifically not required. Due to use of AES-128 with an initial static random value and static data vector (all of this static information is the same across different customers' installations), the attacker can easily derive the utilized encryption key and decrypt the intercepted packet. The key can be verified by decrypting the intercepted packet and checking for known plaintext. Subsequently, an attacker can create arbitrary radio frames with the correct encryption key to control BiSecur garage and entrance gate operators and possibly other BiSecur systems as well ("wireless cloning"). To conduct the attack, a low cost Software Defined Radio (SDR) is sufficient. This affects Hoermann Hand Transmitter HS5-868-BS, HSE1-868-BS, and HSE2-868-BS devices.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330
References: https://docs.wixstatic.com/ugd/28ba71_6ecc3158975a484d827e935edda4fa17.pdf; https://www.trustworks.at/publications; https://docs.wixstatic.com/ugd/28ba71_6ecc3158975a484d827e935edda4fa17.pdf
CVE: CVE-2017-17973
Published: 2017-12-29
Description: In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://bugzilla.maptools.org/show_bug.cgi?id=2769; http://www.securityfocus.com/bid/102331; https://bugzilla.novell.com/show_bug.cgi?id=1074318
CVE: CVE-2017-17974
Published: 2017-12-29
Description: BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*) and ISC2000 devices allows remote attackers to obtain sensitive information via a request for isc/get_sid_js.aspx or isc/get_sid.aspx, as demonstrated by obtaining administrative access by subsequently using the credential information for the Supervisor/Administrator account.
CVSS Score: 9.8 (CRITICAL)
References: http://misteralfa-hack.blogspot.cl/2017/12/ba-system-improper-access-control.html; https://github.com/ezelf/baCK_system; http://misteralfa-hack.blogspot.cl/2017/12/ba-system-improper-access-control.html
CVE: CVE-2013-4578
Published: 2017-12-29
Description: jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d5f36e1c927e; http://www.openwall.com/lists/oss-security/2015/02/08/6; http://www.openwall.com/lists/oss-security/2015/02/09/9
CVE: CVE-2014-0120
Published: 2017-12-29
Description: Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=1072681; https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113; https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf
CVE: CVE-2014-0121
Published: 2017-12-29
Description: The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=1072716; https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1e; https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf
CVE: CVE-2014-3630
Published: 2017-12-29
Description: XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://groups.google.com/forum/#%21msg/play-framework/7uNX_ImTW08/AogWSjsTAyQJ; https://groups.google.com/forum/#%21topic/play-framework/WdbFvemsFDQ; https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf
CVE: CVE-2014-4978
Published: 2017-12-29
Description: The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162109.html; http://www.openwall.com/lists/oss-security/2014/07/16/15; http://www.securityfocus.com/bid/68671
CVE: CVE-2014-8119
Published: 2017-12-29
Description: The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156571.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157508.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157713.html
CVE: CVE-2014-9515
Published: 2017-12-29
Description: Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.securityfocus.com/bid/107970; https://github.com/DozerMapper/dozer/issues/217; https://github.com/DozerMapper/dozer/issues/410
CVE: CVE-2015-3302
Published: 2017-12-29
Description: The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html; http://www.securityfocus.com/archive/1/535396/100/1100/threaded; http://www.securityfocus.com/bid/74395
CVE: CVE-2015-8008
Published: 2017-12-29
Description: The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170961.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170979.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171007.html
CVE: CVE-2017-17901
Published: 2017-12-29
Description: ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packets with a TTL of 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://packetstormsecurity.com/files/145548/ZyXEL-P-660HW-TTL-Expiry-Denial-Of-Service.html; https://www.zyxel.com/support/announcement_denial_of_service.shtml; http://packetstormsecurity.com/files/145548/ZyXEL-P-660HW-TTL-Expiry-Denial-Of-Service.html
CVE: CVE-2017-17975
Published: 2017-12-30
Description: Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://linuxtesting.org/pipermail/ldv-project/2017-November/001008.html; http://www.securityfocus.com/bid/102330; https://usn.ubuntu.com/3653-1/
CVE: CVE-2017-17981
Published: 2017-12-30
Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE: CVE-2017-17982
Published: 2017-12-30
Description: PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE: CVE-2017-17983
Published: 2017-12-30
Description: PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE: CVE-2017-17984
Published: 2017-12-30
Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE: CVE-2017-17985
Published: 2017-12-30
Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE: CVE-2017-17986
Published: 2017-12-30
Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE: CVE-2017-17987
Published: 2017-12-30
Description: PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE: CVE-2017-17988
Published: 2017-12-30
Description: PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Muslim%20Matrimonial%20Script.md
CVE: CVE-2017-17989
Published: 2017-12-30
Description: Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md
CVE: CVE-2017-17990
Published: 2017-12-30
Description: Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md; https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md