deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7272
Published: 2017-04-10
Description: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20441859; http://www.securityfocus.com/bid/97532; http://en.community.dell.com/techcenter/extras/m/white_papers/20441859
CVE: CVE-2015-7273
Published: 2017-04-10
Description: Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20441859; http://en.community.dell.com/techcenter/extras/m/white_papers/20441859
CVE: CVE-2015-7274
Published: 2017-04-10
Description: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20441859; http://www.securityfocus.com/bid/97545; http://www.securityfocus.com/bid/97546
CVE: CVE-2015-7275
Published: 2017-04-10
Description: Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20441859; http://www.securityfocus.com/bid/97520; http://en.community.dell.com/techcenter/extras/m/white_papers/20441859
CVE: CVE-2015-7292
Published: 2017-04-10
Description: Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://marcograss.github.io/security/android/cve/2016/01/15/cve-2015-7292-amazon-kernel-stack-buffer-overflow.html; https://marcograss.github.io/security/android/cve/2016/01/15/cve-2015-7292-amazon-kernel-stack-buffer-overflow.html
CVE: CVE-2015-8255
Published: 2017-04-10
Description: AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/41626/; https://www.exploit-db.com/exploits/41626/
CVE: CVE-2015-8258
Published: 2017-04-10
Description: AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://www.exploit-db.com/exploits/41625/; https://www.exploit-db.com/exploits/41625/
CVE: CVE-2015-8275
Published: 2017-04-10
Description: LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://cert.lv/en/2016/01/new-cve-information-avialable; https://cert.lv/en/2016/01/new-cve-information-avialable
CVE: CVE-2015-8276
Published: 2017-04-10
Description: LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://cert.lv/en/2016/01/new-cve-information-avialable; https://cert.lv/en/2016/01/new-cve-information-avialable
CVE: CVE-2016-1516
Published: 2017-04-10
Description: OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://arxiv.org/pdf/1701.04739.pdf; https://github.com/opencv/opencv/issues/5956; https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
CVE: CVE-2016-1517
Published: 2017-04-10
Description: OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://arxiv.org/pdf/1701.04739.pdf; https://github.com/opencv/opencv/issues/5956; https://arxiv.org/pdf/1701.04739.pdf
CVE: CVE-2016-4317
Published: 2017-04-10
Description: Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97513; https://confluence.atlassian.com/doc/confluence-5-9-11-release-notes-827123763.html; https://jira.atlassian.com/browse/CONF-42713
CVE: CVE-2016-4318
Published: 2017-04-10
Description: Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97516; https://confluence.atlassian.com/jiracore/jira-core-7-1-x-release-notes-802161668.html#JIRACore7.1.xreleasenotes-v7.1.9v7.1.9-06July2016; https://jira.atlassian.com/browse/JRA-61861
CVE: CVE-2016-4319
Published: 2017-04-10
Description: Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/97517; https://confluence.atlassian.com/jiracore/jira-core-7-1-x-release-notes-802161668.html#JIRACore7.1.xreleasenotes-v7.1.9v7.1.9-06July2016; https://jira.atlassian.com/browse/JRA-61803
CVE: CVE-2016-4320
Published: 2017-04-10
Description: Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/97515; https://confluence.atlassian.com/bitbucketserver/bitbucket-server-4-7-release-notes-829052416.html; https://jira.atlassian.com/browse/BSERV-8819
CVE: CVE-2016-4334
Published: 2017-04-10
Description: Jive before 2016.3.1 has an open redirect from the external-link.jspa page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.ericgoldman.name/en/2016/vulnerability-report-jive-open-redirect/; http://www.ericgoldman.name/en/2016/vulnerability-report-jive-open-redirect/
CVE: CVE-2016-5051
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5052
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5053
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5054
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5055
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5056
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5057
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5058
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5059
Published: 2017-04-10
Description: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Containers/Data/Application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059; https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE: CVE-2016-5065
Published: 2017-04-10
Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://carvesystems.com/sierra-wireless-2016-advisory.html; https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE: CVE-2016-5066
Published: 2017-04-10
Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: https://carvesystems.com/sierra-wireless-2016-advisory.html; https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE: CVE-2016-5067
Published: 2017-04-10
Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://carvesystems.com/sierra-wireless-2016-advisory.html; https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE: CVE-2016-5068
Published: 2017-04-10
Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://carvesystems.com/sierra-wireless-2016-advisory.html; https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE: CVE-2016-5069
Published: 2017-04-10
Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://carvesystems.com/sierra-wireless-2016-advisory.html; https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE: CVE-2016-5070
Published: 2017-04-10
Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: https://carvesystems.com/sierra-wireless-2016-advisory.html; https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE: CVE-2016-5071
Published: 2017-04-10
Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://carvesystems.com/sierra-wireless-2016-advisory.html; https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE: CVE-2016-5072
Published: 2017-04-10
Description: OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://oxidforge.org/en/security-bulletin-2016-001.html; https://oxidforge.org/en/security-bulletin-2016-001.html
CVE: CVE-2016-5073
Published: 2017-04-10
Description: CloudView NMS before 2.10a has XSS via SNMP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2; https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE: CVE-2016-5074
Published: 2017-04-10
Description: CloudView NMS before 2.10a has a format string issue exploitable over SNMP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: http://www.securityfocus.com/bid/98723; https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2; http://www.securityfocus.com/bid/98723
CVE: CVE-2016-5075
Published: 2017-04-10
Description: CloudView NMS before 2.10a has XSS via a TELNET login.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2; https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE: CVE-2016-5076
Published: 2017-04-10
Description: CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2; https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE: CVE-2016-5077
Published: 2017-04-10
Description: Netikus EventSentry before 3.2.1.44 has XSS via SNMP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2; https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE: CVE-2016-5078
Published: 2017-04-10
Description: Paessler PRTG before 16.2.24.4045 has XSS via SNMP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2; https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE: CVE-2016-5642
Published: 2017-04-10
Description: Opmantek NMIS before 8.5.12G has XSS via SNMP.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2; https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE: CVE-2016-5682
Published: 2017-04-10
Description: Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.rapid7.com/community/infosec/blog/2016/09/02/r7-2016-19-persistent-xss-via-unescaped-parameters-in-swagger-ui; https://community.rapid7.com/community/infosec/blog/2016/09/02/r7-2016-19-persistent-xss-via-unescaped-parameters-in-swagger-ui
CVE: CVE-2016-6534
Published: 2017-04-10
Description: Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affected in non-default configurations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2; https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE: CVE-2017-7286
Published: 2017-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-7319
Published: 2017-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-8378
Published: 2017-04-10
Description: In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive information by reading the .xml dotfile.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://bugs.debian.org/791858; https://www.keepassx.org/changelog; http://bugs.debian.org/791858
CVE: CVE-2016-10304
Published: 2017-04-10
Description: The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service instability) via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: https://erpscan.io/advisories/erpscan-16-029-sap-netweaver-java-7-5-deserialization-untrusted-user-value-trustmanagementservlet/; https://erpscan.io/advisories/erpscan-16-029-sap-netweaver-java-7-5-deserialization-untrusted-user-value-trustmanagementservlet/
CVE: CVE-2016-10321
Published: 2017-04-10
Description: web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254
References: https://github.com/web2py/web2py/commit/944d8bd8f3c5cf8ae296fc03d149056c65358426; https://github.com/web2py/web2py/issues/1585#issuecomment-284317919; https://usn.ubuntu.com/4030-1/
CVE: CVE-2016-6605
Published: 2017-04-10
Description: Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_all_product_issues.html#tsb_174; https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_all_product_issues.html#tsb_174
CVE: CVE-2017-6190
Published: 2017-04-10
Description: Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary files via a .. (dot dot) in a "GET /uir/" request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/97620; https://cxsecurity.com/blad/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/41840/
CVE: CVE-2017-7616
Published: 2017-04-10
Description: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-388
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cf01fb9985e8deb25ccf0ea54d916b8871ae0e62; http://www.securityfocus.com/bid/97527; http://www.securitytracker.com/id/1038503
CVE: CVE-2017-7617
Published: 2017-04-10
Description: Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://downloads.asterisk.org/pub/security/AST-2017-001.html; http://www.securityfocus.com/bid/97377; https://bugs.debian.org/859910
CVE: CVE-2017-7618
Published: 2017-04-10
Description: crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://marc.info/?l=linux-crypto-vger&m=[PII_REDACTED]3850&w=2; http://www.securityfocus.com/bid/97534; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us
CVE: CVE-2017-7619
Published: 2017-04-10
Description: In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.debian.org/security/2017/dsa-3863; http://www.securityfocus.com/bid/98689; https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=31506
CVE: CVE-2015-7824
Published: 2017-04-10
Description: botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://botan.randombit.net/security.html#id3; https://bugzilla.redhat.com/show_bug.cgi?id=1311613; https://botan.randombit.net/security.html#id3
CVE: CVE-2015-7825
Published: 2017-04-10
Description: botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a certificate with a loop in the certificate chain.
CVSS Score: 7.5 (HIGH)
References: https://botan.randombit.net/security.html#id3; https://bugzilla.redhat.com/show_bug.cgi?id=1311618; https://botan.randombit.net/security.html#id3
CVE: CVE-2015-7826
Published: 2017-04-10
Description: botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://botan.randombit.net/security.html#id3; https://bugzilla.redhat.com/show_bug.cgi?id=1311620; https://botan.randombit.net/security.html#id3