deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12919
Published: 2017-08-28
Description: Heap-based buffer overflow in OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2017/08/17/13; https://blogs.gentoo.org/ago/2017/08/09/libfpx-heap-based-buffer-overflow-in-olestreamwritevt_lpstr-olestrm-cpp/; http://www.openwall.com/lists/oss-security/2017/08/17/13
CVE: CVE-2017-12920
Published: 2017-08-28
Description: CDirectory::GetDirEntry in dir.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2017/08/17/12; https://blogs.gentoo.org/ago/2017/08/09/libfpx-null-pointer-dereference-in-cdirectorygetdirentry-dir-cxx/; http://www.openwall.com/lists/oss-security/2017/08/17/12
CVE: CVE-2017-12921
Published: 2017-08-28
Description: PFileFlashPixView::GetGlobalInfoProperty in f_fpxvw.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2017/08/17/10; https://blogs.gentoo.org/ago/2017/08/09/libfpx-null-pointer-dereference-in-pfileflashpixviewgetglobalinfoproperty-f_fpxvw-cpp/; http://www.openwall.com/lists/oss-security/2017/08/17/10
CVE: CVE-2017-12922
Published: 2017-08-28
Description: wchar.c in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2017/08/17/11; https://blogs.gentoo.org/ago/2017/08/09/libfpx-null-pointer-dereference-in-wchar-c/; http://www.openwall.com/lists/oss-security/2017/08/17/11
CVE: CVE-2017-12923
Published: 2017-08-28
Description: OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2017/08/17/9; https://blogs.gentoo.org/ago/2017/08/09/libfpx-null-pointer-dereference-in-olestreamwritevt_lpstr-olestrm-cpp/; http://www.openwall.com/lists/oss-security/2017/08/17/9
CVE: CVE-2017-12924
Published: 2017-08-28
Description: CDirVector::GetTable in dirfunc.hxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted fpx image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://www.openwall.com/lists/oss-security/2017/08/17/8; https://blogs.gentoo.org/ago/2017/08/09/libfpx-divide-by-zero-in-cdirvectorgettable-dirfunc-hxx/; http://www.openwall.com/lists/oss-security/2017/08/17/8
CVE: CVE-2017-12925
Published: 2017-08-28
Description: Double free vulnerability in DfFromLB in docfile.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: http://www.openwall.com/lists/oss-security/2017/08/17/14; https://blogs.gentoo.org/ago/2017/08/09/libfpx-double-free-in-dffromlb-docfile-cxx/; http://www.openwall.com/lists/oss-security/2017/08/17/14
CVE: CVE-2017-12950
Published: 2017-08-28
Description: The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2017/Aug/39; https://www.exploit-db.com/exploits/42546/; http://seclists.org/fulldisclosure/2017/Aug/39
CVE: CVE-2017-12951
Published: 2017-08-28
Description: The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted gig file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/39; https://www.exploit-db.com/exploits/42546/; http://seclists.org/fulldisclosure/2017/Aug/39
CVE: CVE-2017-12952
Published: 2017-08-28
Description: The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2017/Aug/39; https://www.exploit-db.com/exploits/42546/; http://seclists.org/fulldisclosure/2017/Aug/39
CVE: CVE-2017-12953
Published: 2017-08-28
Description: The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory write and application crash) via a crafted gig file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2017/Aug/39; https://www.exploit-db.com/exploits/42546/; http://seclists.org/fulldisclosure/2017/Aug/39
CVE: CVE-2017-12954
Published: 2017-08-28
Description: The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted gig file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Aug/39; https://www.exploit-db.com/exploits/42546/; http://seclists.org/fulldisclosure/2017/Aug/39
CVE: CVE-2017-13712
Published: 2017-08-28
Description: NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100525; https://sourceforge.net/p/lame/bugs/472/; http://www.securityfocus.com/bid/100525
CVE: CVE-2017-3735
Published: 2017-08-28
Description: While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2017-6594
Published: 2017-08-28
Description: The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-updates/2017-08/msg00062.html; http://www.h5l.org/advisories.html?show=2017-04-13; https://github.com/heimdal/heimdal/commit/b1e699103f08d6a0ca46a122193c9da65f6cf837
CVE: CVE-2017-9978
Published: 2017-08-28
Description: On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the system. An attacker could leverage this information to fine-tune and enumerate valid accounts on the system by searching for common usernames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.html; http://seclists.org/fulldisclosure/2017/Aug/23; http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt
CVE: CVE-2017-9979
Published: 2017-08-28
Description: On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.html; http://seclists.org/fulldisclosure/2017/Aug/23; http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt
CVE: CVE-2015-8300
Published: 2017-08-28
Description: Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-275
References: http://packetstormsecurity.com/files/134523/Polycom-BTOE-Connector-2.3.0-Local-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2015/Nov/88; https://github.com/sbaresearch/advisories/tree/public/2015/Polycom_20150513
CVE: CVE-2015-8332
Published: 2017-08-28
Description: Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462985.htm; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462985.htm
CVE: CVE-2017-13716
Published: 2017-08-28
Description: The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://sourceware.org/bugzilla/show_bug.cgi?id=22009; https://sourceware.org/bugzilla/show_bug.cgi?id=22009
CVE: CVE-2014-8393
Published: 2017-08-29
Description: DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://packetstormsecurity.com/files/129922/Corel-Software-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2015/Jan/33; http://secunia.com/advisories/62210
CVE: CVE-2014-8872
Published: 2017-08-29
Description: Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/130040/AVM-FRITZ-Box-Firmware-Signature-Bypass.html; http://seclists.org/fulldisclosure/2015/Jan/86; http://www.securityfocus.com/archive/1/534522/100/0/threaded
CVE: CVE-2015-0234
Published: 2017-08-29
Description: Multiple temporary file creation vulnerabilities in pki-core 10.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1183176; https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-0234.html; https://bugzilla.redhat.com/show_bug.cgi?id=1183176
CVE: CVE-2016-2970
Published: 2017-08-29
Description: IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attackers. IBM X-Force ID: 113851.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006233; http://www.securityfocus.com/bid/100529; http://www.securitytracker.com/id/1039228
CVE: CVE-2016-9732
Published: 2017-08-29
Description: IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119761.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22007156; https://exchange.xforce.ibmcloud.com/vulnerabilities/119761; http://www.ibm.com/support/docview.wss?uid=swg22007156
CVE: CVE-2017-10812
Published: 2017-08-29
Description: Untrusted search path vulnerability in Photo Collection PC Software Ver.4.0.2 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN67954465/index.html; https://jvn.jp/en/jp/JVN67954465/index.html
CVE: CVE-2017-10826
Published: 2017-08-29
Description: Untrusted search path vulnerability in Security Kinou Mihariban v1.0.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://flets-w.com/topics/mihariban_vulnerability/; https://jvn.jp/en/jp/JVN11601216/index.html; http://flets-w.com/topics/mihariban_vulnerability/
CVE: CVE-2017-10827
Published: 2017-08-29
Description: Untrusted search path vulnerability in Flets Azukeru for Windows Auto Backup Tool v1.0.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://flets-w.com/topics/azukeru_vulnerability/; https://jvn.jp/en/jp/JVN14658714/index.html; http://flets-w.com/topics/azukeru_vulnerability/
CVE: CVE-2017-10828
Published: 2017-08-29
Description: Untrusted search path vulnerability in Flets Install Tool all versions distributed through the website till 2017 August 8 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://flets-w.com/topics/inst_tool_vulnerability/; https://jvn.jp/en/jp/JVN14926025/index.html; http://flets-w.com/topics/inst_tool_vulnerability/
CVE: CVE-2017-10830
Published: 2017-08-29
Description: Untrusted search path vulnerability in Security Setup Tool all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://f-security.jp/v6/support/information/100161.html; https://jvn.jp/en/jp/JVN36303528/index.html; http://f-security.jp/v6/support/information/100161.html
CVE: CVE-2017-10831
Published: 2017-08-29
Description: Untrusted search path vulnerability in The electronic authentication system based on the commercial registration system "The CRCA user's Software" Ver1.8 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.moj.go.jp/MINJI/minji06_00027.html; https://jvn.jp/en/jp/JVN30866130/index.html; http://www.moj.go.jp/MINJI/minji06_00027.html
CVE: CVE-2017-10832
Published: 2017-08-29
Description: "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf; https://jvn.jp/en/jp/JVN87410770/index.html; http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf
CVE: CVE-2017-10833
Published: 2017-08-29
Description: "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to bypass access restriction to view information or modify configurations via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-425
References: http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf; https://jvn.jp/en/jp/JVN87410770/index.html; http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf
CVE: CVE-2017-10834
Published: 2017-08-29
Description: Directory traversal vulnerability in "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf; https://jvn.jp/en/jp/JVN87410770/index.html; http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf
CVE: CVE-2017-10835
Published: 2017-08-29
Description: "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to conduct code injection attacks via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf; https://jvn.jp/en/jp/JVN87410770/index.html; http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf
CVE: CVE-2017-10836
Published: 2017-08-29
Description: Untrusted search path vulnerability in Optimal Guard 1.1.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN87540575/index.html; https://www.optim.co.jp/contents/23246; https://jvn.jp/en/jp/JVN87540575/index.html
CVE: CVE-2017-10837
Published: 2017-08-29
Description: Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN58559719/index.html; https://wordpress.org/plugins/backup/#developers; https://jvn.jp/en/jp/JVN58559719/index.html
CVE: CVE-2017-10838
Published: 2017-08-29
Description: Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN39628662/index.html; https://jvn.jp/en/jp/JVN39628662/index.html
CVE: CVE-2017-10839
Published: 2017-08-29
Description: SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN39628662/index.html; https://jvn.jp/en/jp/JVN39628662/index.html
CVE: CVE-2017-10840
Published: 2017-08-29
Description: Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/craigk5n/webcalendar/releases/tag/v1.2.8; https://jvn.jp/en/jp/JVN23340457/index.html; https://github.com/craigk5n/webcalendar/releases/tag/v1.2.8
CVE: CVE-2017-10841
Published: 2017-08-29
Description: Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/craigk5n/webcalendar/releases/tag/v1.2.8; https://jvn.jp/en/jp/JVN23340457/index.html; https://github.com/craigk5n/webcalendar/releases/tag/v1.2.8
CVE: CVE-2017-10842
Published: 2017-08-29
Description: SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN78151490/index.html; https://basercms.net/security/JVN78151490; http://jvn.jp/en/jp/JVN78151490/index.html
CVE: CVE-2017-10843
Published: 2017-08-29
Description: baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" field is being used in the mail form.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN78151490/index.html; https://basercms.net/security/JVN78151490; http://jvn.jp/en/jp/JVN78151490/index.html
CVE: CVE-2017-10844
Published: 2017-08-29
Description: baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN78151490/index.html; https://basercms.net/security/JVN78151490; http://jvn.jp/en/jp/JVN78151490/index.html
CVE: CVE-2017-1110
Published: 2017-08-29
Description: IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents of a higher privileged user. IBM X-Force ID: 120915.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22007161; https://exchange.xforce.ibmcloud.com/vulnerabilities/120915; http://www.ibm.com/support/docview.wss?uid=swg22007161
CVE: CVE-2017-13715
Published: 2017-08-29
Description: The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a6e544b0a88b53114bfa5a57e21b7be7a8dfc9d0; http://seclists.org/oss-sec/2017/q3/345; http://www.securityfocus.com/bid/100517
CVE: CVE-2017-1376
Published: 2017-08-29
Description: A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-829
References: http://www.ibm.com/support/docview.wss?uid=swg22007305&myns=swgtiv&mynp=OCSSJQQ3&mync=E&cm_sp=swgtiv-_-OCSSJQQ3-_-E; https://access.redhat.com/errata/RHSA-2017:2469; https://access.redhat.com/errata/RHSA-2017:2481
CVE: CVE-2017-1489
Published: 2017-08-29
Description: IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an e-community domain. IBM X-Force ID: 128687.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22006959; http://www.securityfocus.com/bid/100592; http://www.securitytracker.com/id/1039227
CVE: CVE-2017-2242
Published: 2017-08-29
Description: Untrusted search path vulnerability in Flets Setsuzoku Tool for Windows all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://flets-w.com/topics/setsuzoku_tool_vulnerability/; https://jvn.jp/en/jp/JVN22272314/index.html; http://flets-w.com/topics/setsuzoku_tool_vulnerability/
CVE: CVE-2017-2254
Published: 2017-08-29
Description: Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN63564682/index.html; https://support.cybozu.com/ja-jp/article/9751; https://jvn.jp/en/jp/JVN63564682/index.html
CVE: CVE-2017-2255
Published: 2017-08-29
Description: Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Space".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN63564682/index.html; https://support.cybozu.com/ja-jp/article/9746; https://jvn.jp/en/jp/JVN63564682/index.html
CVE: CVE-2017-2256
Published: 2017-08-29
Description: Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Memo".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN63564682/index.html; https://support.cybozu.com/ja-jp/article/9744; https://jvn.jp/en/jp/JVN63564682/index.html
CVE: CVE-2017-2257
Published: 2017-08-29
Description: Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN63564682/index.html; https://support.cybozu.com/ja-jp/article/9765; https://jvn.jp/en/jp/JVN63564682/index.html