deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-13758
Published: 2017-08-29
Description: In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securitytracker.com/id/1039246; https://security.gentoo.org/glsa/201711-07; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-13760
Published: 2017-08-29
Description: In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in tsk_img_read() in tsk/img/img_io.c in libtskimg.a.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/sleuthkit/sleuthkit/issues/906; https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html; https://github.com/sleuthkit/sleuthkit/issues/906
CVE: CVE-2017-13762
Published: 2017-08-30
Description: ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.onosproject.org/#/c/14031/; https://gerrit.onosproject.org/#/c/14049/; https://gerrit.onosproject.org/#/c/14050/
CVE: CVE-2017-13763
Published: 2017-08-30
Description: ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://gerrit.onosproject.org/#/c/13831/; https://gerrit.onosproject.org/#/c/14318/; https://gerrit.onosproject.org/#/c/13831/
CVE: CVE-2016-10504
Published: 2017-08-30
Description: Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-4013; http://www.securityfocus.com/bid/100564; https://github.com/uclouvain/openjpeg/commit/397f62c0a838e15d667ef50e27d5d011d2c79c04
CVE: CVE-2016-10505
Published: 2017-08-30
Description: NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/uclouvain/openjpeg/issues/776; https://github.com/uclouvain/openjpeg/issues/784; https://github.com/uclouvain/openjpeg/issues/785
CVE: CVE-2016-10506
Published: 2017-08-30
Description: Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://www.securityfocus.com/bid/100573; https://github.com/uclouvain/openjpeg/commit/d27ccf01c68a31ad62b33d2dc1ba2bb1eeaafe7b; https://github.com/uclouvain/openjpeg/issues/731
CVE: CVE-2016-10507
Published: 2017-08-30
Description: Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://www.securityfocus.com/bid/100567; https://github.com/uclouvain/openjpeg/commit/da940424816e11d624362ce080bc026adffa26e8; https://github.com/uclouvain/openjpeg/issues/833
CVE: CVE-2017-13764
Published: 2017-08-30
Description: In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/packet-mbtcp.c by adding length validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100545; http://www.securitytracker.com/id/1039254; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13925
CVE: CVE-2017-13765
Published: 2017-08-30
Description: In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application crash. This was addressed in plugins/irda/packet-ircomm.c by adding length validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100551; http://www.securitytracker.com/id/1039254; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13929
CVE: CVE-2017-13766
Published: 2017-08-30
Description: In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/100542; http://www.securitytracker.com/id/1039254; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13847
CVE: CVE-2017-13767
Published: 2017-08-30
Description: In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-msdp.c by adding length validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-835
References: http://www.securityfocus.com/bid/100549; http://www.securitytracker.com/id/1039254; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13933
CVE: CVE-2017-13768
Published: 2017-08-30
Description: Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100569; https://github.com/ImageMagick/ImageMagick/issues/706; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-13769
Published: 2017-08-30
Description: The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/705; https://security.gentoo.org/glsa/201711-07; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-13774
Published: 2017-08-30
Description: Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://ipvm.com/reports/hik-vms-pass; https://ipvm.com/reports/hik-vms-pass
CVE: CVE-2017-13775
Published: 2017-08-30
Description: GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may be consumed although the file itself does not support the requests.
CVSS Score: 6.5 (MEDIUM)
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/b037d79b6ccd; http://openwall.com/lists/oss-security/2017/08/31/3; http://www.securityfocus.com/bid/100570
CVE: CVE-2017-13776
Published: 2017-08-30
Description: GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e; http://openwall.com/lists/oss-security/2017/08/31/2; http://www.securityfocus.com/bid/100574
CVE: CVE-2017-13777
Published: 2017-08-30
Description: GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e; http://openwall.com/lists/oss-security/2017/08/31/1; http://www.securityfocus.com/bid/100575
CVE: CVE-2017-13778
Published: 2017-08-30
Description: Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/FiyoCMS/FiyoCMS/issues/8; https://github.com/FiyoCMS/FiyoCMS/issues/8
CVE: CVE-2017-3163
Published: 2017-08-30
Description: When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://access.redhat.com/errata/RHSA-2018:1447; https://access.redhat.com/errata/RHSA-2018:1448; https://access.redhat.com/errata/RHSA-2018:1449
CVE: CVE-2016-4462
Published: 2017-08-30
Description: By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html; http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html
CVE: CVE-2016-6800
Published: 2017-08-30
Description: The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaScript code in these form fields. This code gets executed from the browser of every user who is visiting this article. Mitigation: Upgrade to Apache OFBiz 16.11.01.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/28987cffe0237fa67eca9de8bbbc04a917ac8785342ad9e5a196c978%40%3Cuser.ofbiz.apache.org%3E; https://s.apache.org/Owsz; https://lists.apache.org/thread.html/28987cffe0237fa67eca9de8bbbc04a917ac8785342ad9e5a196c978%40%3Cuser.ofbiz.apache.org%3E
CVE: CVE-2017-13780
Published: 2017-08-30
Description: The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/EyesOfNetworkCommunity/eonweb/issues/8; https://github.com/EyesOfNetworkCommunity/eonweb/issues/8
CVE: CVE-2017-12698
Published: 2017-08-30
Description: An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/100526; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02; http://www.securityfocus.com/bid/100526
CVE: CVE-2017-12702
Published: 2017-08-30
Description: An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134, CWE-134
References: http://www.securityfocus.com/bid/100526; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02; http://www.securityfocus.com/bid/100526
CVE: CVE-2017-12704
Published: 2017-08-30
Description: A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-119
References: http://www.securityfocus.com/bid/100526; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02; http://www.securityfocus.com/bid/100526
CVE: CVE-2017-12706
Published: 2017-08-30
Description: A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/100526; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02; http://www.securityfocus.com/bid/100526
CVE: CVE-2017-12708
Published: 2017-08-30
Description: An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an attacker to execute arbitrary code or cause the system to crash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/100526; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02; http://www.securityfocus.com/bid/100526
CVE: CVE-2017-12710
Published: 2017-08-30
Description: A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/100526; http://www.zerodayinitiative.com/advisories/ZDI-17-712/; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02
CVE: CVE-2017-12711
Published: 2017-08-30
Description: An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-in user account has been granted a sensitive privilege that may allow a user to elevate to administrative privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: http://www.securityfocus.com/bid/100526; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02; http://www.securityfocus.com/bid/100526
CVE: CVE-2017-12713
Published: 2017-08-30
Description: An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: http://www.securityfocus.com/bid/100526; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02; http://www.securityfocus.com/bid/100526
CVE: CVE-2017-12717
Published: 2017-08-30
Description: An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: http://www.securityfocus.com/bid/100526; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02; http://www.securityfocus.com/bid/100526
CVE: CVE-2016-5001
Published: 2017-08-30
Description: This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/oss-sec/2016/q4/698; http://www.securityfocus.com/bid/94950; https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E
CVE: CVE-2017-12069
Published: 2017-08-30
Description: An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 (All versions V8.1 and earlier), SIMATIC WinCC (All versions < V7.4 SP1), SIMATIC WinCC Runtime Professional (All versions < V14 SP1), SIMATIC NET PC Software, and SIMATIC IT Production Suite. By sending specially crafted packets to the OPC Discovery Server at port 4840/tcp, an attacker might cause the system to access various resources chosen by the attacker.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/100559; http://www.securitytracker.com/id/1039510; https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-12069.pdf
CVE: CVE-2017-12734
Published: 2017-08-30
Description: A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V1.81.2). An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use the integrated webserver on port 80/tcp only in trusted networks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-895, CWE-200
References: http://www.securityfocus.com/bid/100560; https://cert-portal.siemens.com/productcert/pdf/ssa-087240.pdf; http://www.securityfocus.com/bid/100560
CVE: CVE-2017-12735
Published: 2017-08-30
Description: A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic.
CVSS Score: 7.4 (HIGH)
CWE: CWE-300
References: http://www.securityfocus.com/bid/100561; https://cert-portal.siemens.com/productcert/pdf/ssa-087240.pdf; http://www.securityfocus.com/bid/100561
CVE: CVE-2017-9945
Published: 2017-08-30
Description: In the Siemens 7KM PAC Switched Ethernet PROFINET expansion module (All versions < V2.1.3), a Denial-of-Service condition could be induced by a specially crafted PROFINET DCP packet sent as a local Ethernet (Layer 2) broadcast. The affected component requires a manual restart via the main device to recover.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100562; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-771218.pdf; http://www.securityfocus.com/bid/100562
CVE: CVE-2017-11157
Published: 2017-08-30
Description: Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://www.synology.com/en-global/support/security/Synology_SA_17_50_Cloud_Station_Backup; https://www.synology.com/en-global/support/security/Synology_SA_17_50_Cloud_Station_Backup
CVE: CVE-2017-14032
Published: 2017-08-30
Description: ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www.debian.org/security/2017/dsa-3967; https://bugs.debian.org/873557; https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32
CVE: CVE-2017-14035
Published: 2017-08-30
Description: CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://crushftp.com/version8.html; https://crushftp.com/version8.html
CVE: CVE-2017-14036
Published: 2017-08-30
Description: CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://crushftp.com/version7.html; https://crushftp.com/version8.html; https://crushftp.com/version7.html
CVE: CVE-2017-14037
Published: 2017-08-30
Description: CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: https://crushftp.com/version7.html; https://crushftp.com/version8.html; https://crushftp.com/version7.html
CVE: CVE-2017-14038
Published: 2017-08-30
Description: CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://crushftp.com/version7.html; https://crushftp.com/version8.html; https://crushftp.com/version7.html
CVE: CVE-2017-1440
Published: 2017-08-30
Description: IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM X-Force ID: 128105.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www-01.ibm.com/support/docview.wss?uid=swg22005550; http://www.securityfocus.com/bid/99542; https://exchange.xforce.ibmcloud.com/vulnerabilities/128105
CVE: CVE-2017-1441
Published: 2017-08-30
Description: IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to improper access control. IBM X-Force ID: 128106.
CVSS Score: 5.5 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg22005550; http://www.securityfocus.com/bid/99547; https://exchange.xforce.ibmcloud.com/vulnerabilities/128106
CVE: CVE-2017-1442
Published: 2017-08-30
Description: IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg22005550; http://www.securityfocus.com/bid/99542; https://exchange.xforce.ibmcloud.com/vulnerabilities/128107
CVE: CVE-2017-1443
Published: 2017-08-30
Description: IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128109.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg22005550; http://www.securityfocus.com/bid/99542; https://exchange.xforce.ibmcloud.com/vulnerabilities/128109
CVE: CVE-2017-1445
Published: 2017-08-30
Description: IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128170.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg22005787; http://www.securityfocus.com/bid/99541; https://exchange.xforce.ibmcloud.com/vulnerabilities/128170
CVE: CVE-2017-1446
Published: 2017-08-30
Description: IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128171.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg22005787; http://www.securityfocus.com/bid/99541; https://exchange.xforce.ibmcloud.com/vulnerabilities/128171