deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-10087
Published: 2017-01-30
Description: The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2016/12/29/2; http://www.openwall.com/lists/oss-security/2016/12/30/4; http://www.securityfocus.com/bid/95157
CVE: CVE-2016-2217
Published: 2017-01-30
Description: The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain the shared secret.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-320
References: http://www.dest-unreach.org/socat/contrib/socat-secadv7.html; http://www.openwall.com/lists/oss-security/2016/02/01/4; http://www.openwall.com/lists/oss-security/2016/02/04/1
CVE: CVE-2016-2399
Published: 2017-01-30
Description: Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3800; http://www.nemux.org/2016/02/23/libquicktime-1-2-4/; http://www.securityfocus.com/bid/95880
CVE: CVE-2016-2402
Published: 2017-01-30
Description: OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2016/02/10/8; http://www.openwall.com/lists/oss-security/2016/02/18/7; https://koz.io/pinning-cve-2016-2402/
CVE: CVE-2016-5026
Published: 2017-01-30
Description: hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/05/23/5; http://www.openwall.com/lists/oss-security/2016/05/24/9; http://www.securityfocus.com/bid/90821
CVE: CVE-2016-5434
Published: 2017-01-30
Description: libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service (infinite loop or out-of-bounds read) via a crafted signature file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-399
References: http://www.openwall.com/lists/oss-security/2016/06/11/4; http://www.openwall.com/lists/oss-security/2016/06/14/6; http://www.openwall.com/lists/oss-security/2020/04/21/9
CVE: CVE-2016-6167
Published: 2017-01-30
Description: Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) UxTheme.dll or (2) ntmarta.dll file in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/archive/1/538848/100/0/threaded; http://www.securitytracker.com/id/1036236; https://packetstormsecurity.com/files/137742/Putty-Beta-0.67-DLL-Hijacking.html
CVE: CVE-2016-6266
Published: 2017-01-30
Description: ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) host or (2) apikey parameter in a register action, (3) enable parameter in a save_stting action, or (4) host or (5) apikey parameter in a test_connection action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/; https://success.trendmicro.com/solution/1114913; https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/
CVE: CVE-2016-6267
Published: 2017-01-30
Description: SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3) spare_AllowGroupNetmask parameter to admin_notification.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/; https://success.trendmicro.com/solution/1114913; https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/
CVE: CVE-2016-6268
Published: 2017-01-30
Description: Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/; https://success.trendmicro.com/solution/1114913; https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/
CVE: CVE-2016-6269
Published: 2017-01-30
Description: Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allow remote attackers to read and delete arbitrary files via the tmpfname parameter to (1) log_mgt_adhocquery_ajaxhandler.php, (2) log_mgt_ajaxhandler.php, (3) log_mgt_ajaxhandler.php or (4) tf parameter to wcs_bwlists_handler.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/; https://success.trendmicro.com/solution/1114913; https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/
CVE: CVE-2016-6270
Published: 2017-01-30
Description: The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to api/v1/cfg/oauth/save_identify_pfx/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/95884; https://qkaiser.github.io/pentesting/trendmicro/2016/10/08/trendmicro-vmi/; https://success.trendmicro.com/solution/1115411
CVE: CVE-2016-6604
Published: 2017-01-30
Description: NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via unknown vectors. The Samsung ID is SVE-2016-6382.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://security.samsungmobile.com/smrupdate.html#SMR-AUG-2016; http://www.openwall.com/lists/oss-security/2016/08/05/3; http://www.openwall.com/lists/oss-security/2016/08/18/10
CVE: CVE-2016-7798
Published: 2017-01-30
Description: The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.openwall.com/lists/oss-security/2016/09/19/9; http://www.openwall.com/lists/oss-security/2016/09/30/6; http://www.openwall.com/lists/oss-security/2016/10/01/2
CVE: CVE-2016-9119
Published: 2017-01-30
Description: Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2016/dsa-3715; http://www.securityfocus.com/bid/94501; http://www.ubuntu.com/usn/USN-3137-1
CVE: CVE-2016-9132
Published: 2017-01-30
Description: In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.securityfocus.com/bid/95879; https://github.com/randombit/botan/commit/987ad747db6d0d7e36f840398f3cf02e2fbfd90f; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OUDGVRQYQUL7F5MRP3LAV7EHRJG4BBE/
CVE: CVE-2016-9249
Published: 2017-01-31
Description: An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/95825; http://www.securitytracker.com/id/1037715; https://support.f5.com/csp/article/K71282001
CVE: CVE-2016-10043
Published: 2017-01-31
Description: An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character (|) to inject arbitrary OS commands and retrieve the output in the application's responses. Attackers could execute unauthorized commands, which could then be used to disable the software, or read, write, and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner (apache user).
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://www.exploit-db.com/exploits/41179/; https://www.exploit-db.com/exploits/41179/
CVE: CVE-2016-2050
Published: 2017-01-31
Description: The get_abbrev_array_info function in libdwarf-20151114 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted elf file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/01/19/9; http://www.openwall.com/lists/oss-security/2016/01/25/3; http://www.openwall.com/lists/oss-security/2016/01/19/9
CVE: CVE-2016-3176
Published: 2017-01-31
Description: Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-287
References: https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html; https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html; https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html
CVE: CVE-2016-5117
Published: 2017-01-31
Description: OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers to bypass the man-in-the-middle mitigations via a crafted timestamp constraint with a valid certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/constraint.c.diff?r1=1.27&r2=1.28; http://www.openntpd.org/txt/release-6.0p1.txt; http://www.openwall.com/lists/oss-security/2016/05/23/2
CVE: CVE-2016-6621
Published: 2017-01-31
Description: The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: http://www.securityfocus.com/bid/95914; https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html; https://www.phpmyadmin.net/security/PMASA-2016-44/
CVE: CVE-2016-9039
Published: 2017-01-31
Description: An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploited this will result in memory exhaustion, resulting in a full system denial of service.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/95916; http://www.talosintelligence.com/reports/TALOS-2016-0257/; http://www.securityfocus.com/bid/95916
CVE: CVE-2015-8973
Published: 2017-01-31
Description: xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94397
CVE: CVE-2015-8974
Published: 2017-01-31
Description: SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94397
CVE: CVE-2015-8975
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94397
CVE: CVE-2015-8976
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94397
CVE: CVE-2015-8977
Published: 2017-01-31
Description: MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94397
CVE: CVE-2016-6285
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/140548/Atlassian-Jira-7.1.7-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2017/Jan/41; http://www.securityfocus.com/bid/95913
CVE: CVE-2016-6329
Published: 2017-01-31
Description: OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697; http://www-01.ibm.com/support/docview.wss?uid=swg21991482; http://www-01.ibm.com/support/docview.wss?uid=swg21995039
CVE: CVE-2016-8685
Published: 2017-01-31
Description: The findnext function in decompose.c in potrace 1.13 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted BMP image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/10/08/17; http://www.openwall.com/lists/oss-security/2016/10/16/9; http://www.securityfocus.com/bid/93470
CVE: CVE-2016-8686
Published: 2017-01-31
Description: The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/10/16/10; http://www.securityfocus.com/bid/93777; https://blogs.gentoo.org/ago/2016/08/29/potrace-memory-allocation-failure/
CVE: CVE-2016-8694
Published: 2017-01-31
Description: The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8695 and CVE-2016-8696.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-8695
Published: 2017-01-31
Description: The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8694 and CVE-2016-8696.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-8696
Published: 2017-01-31
Description: The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8694 and CVE-2016-8695.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-8697
Published: 2017-01-31
Description: The bm_new function in bitmap.h in potrace before 1.13 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted BMP image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12; http://www.securityfocus.com/bid/93778
CVE: CVE-2016-8698
Published: 2017-01-31
Description: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-8699
Published: 2017-01-31
Description: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-8700
Published: 2017-01-31
Description: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-8701
Published: 2017-01-31
Description: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8702, and CVE-2016-8703.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-8702
Published: 2017-01-31
Description: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8703.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-8703
Published: 2017-01-31
Description: Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://potrace.sourceforge.net/ChangeLog; http://www.openwall.com/lists/oss-security/2016/08/18/11; http://www.openwall.com/lists/oss-security/2016/10/16/12
CVE: CVE-2016-9260
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN12796388/index.html; http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000013.html; http://www.securityfocus.com/bid/95772
CVE: CVE-2016-9402
Published: 2017-01-31
Description: SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9403
Published: 2017-01-31
Description: newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9404
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9405
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395