deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9611
Published: 2017-07-26
Description: The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=c7c55972758a93350882c32147801a3485b010fe; http://www.debian.org/security/2017/dsa-3986; http://www.securityfocus.com/bid/99975
CVE: CVE-2017-9612
Published: 2017-07-26
Description: The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=98f6da60b9d463c617e631fc254cf6d66f2e8e3c; http://www.debian.org/security/2017/dsa-3986; http://www.securityfocus.com/bid/99979
CVE: CVE-2017-9618
Published: 2017-07-26
Description: The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3c2aebbedd37fab054e80f2e315de07d7e9b5bdb; http://www.securityfocus.com/bid/99993; https://bugs.ghostscript.com/show_bug.cgi?id=698044
CVE: CVE-2017-9619
Published: 2017-07-26
Description: The xps_true_callback_glyph_name function in xps/xpsttf.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (Segmentation Violation and application crash) via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=c53183d4e7103e87368b7cfa15367a47d559e323; http://www.securityfocus.com/bid/99988; https://bugs.ghostscript.com/show_bug.cgi?id=698042
CVE: CVE-2017-9620
Published: 2017-07-26
Description: The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document, related to the xps_encode_font_char_imp function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3ee55637480d5e319a5de0481b01c3346855cbc9; http://www.securityfocus.com/bid/99990; https://bugs.ghostscript.com/show_bug.cgi?id=698050
CVE: CVE-2017-9726
Published: 2017-07-26
Description: The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://bugs.ghostscript.com/show_bug.cgi?id=698055; http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=7755e67116e8973ee0e3b22d653df026a84fa01b; http://www.debian.org/security/2017/dsa-3986
CVE: CVE-2017-9727
Published: 2017-07-26
Description: The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://bugs.ghostscript.com/show_bug.cgi?id=698056; http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=937ccd17ac65935633b2ebc06cb7089b91e17e6b; http://www.debian.org/security/2017/dsa-3986
CVE: CVE-2017-9739
Published: 2017-07-26
Description: The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=c501a58f8d5650c8ba21d447c0d6f07eafcb0f15; http://www.debian.org/security/2017/dsa-3986; http://www.securityfocus.com/bid/99987
CVE: CVE-2017-9740
Published: 2017-07-26
Description: The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=961b10cdd71403072fb99401a45f3bef6ce53626; http://www.securityfocus.com/bid/99983; https://bugs.ghostscript.com/show_bug.cgi?id=698064
CVE: CVE-2017-9835
Published: 2017-07-26
Description: The gs_alloc_ref_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=cfde94be1d4286bc47633c6e6eaf4e659bd78066; http://www.debian.org/security/2017/dsa-3986; http://www.securityfocus.com/bid/99991
CVE: CVE-2017-11667
Published: 2017-07-26
Description: OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-613
References: https://github.com/opf/openproject/commit/0fdd7578909d2ec50abc275fc4962e99566437ee; https://www.openproject.org/openproject-6-1-6-released-security-fix/; https://www.openproject.org/openproject-7-0-3-released/
CVE: CVE-2017-11671
Published: 2017-07-26
Description: Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-338
References: http://openwall.com/lists/oss-security/2017/07/27/2; http://www.securityfocus.com/bid/100018; https://access.redhat.com/errata/RHSA-2018:0849
CVE: CVE-2017-7659
Published: 2017-07-26
Description: A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.debian.org/security/2017/dsa-3896; http://www.securityfocus.com/bid/99132; http://www.securitytracker.com/id/1038711
CVE: CVE-2017-11673
Published: 2017-07-27
Description: Reporter.exe in Acunetix 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed PRE file, related to a "User Mode Write AV starting at reporter!madTraceProcess."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://code610.blogspot.com/2017/07/readwrite-access-violation-acunetix.html; http://code610.blogspot.com/2017/07/readwrite-access-violation-acunetix.html
CVE: CVE-2017-11674
Published: 2017-07-27
Description: Reporter.exe in Acunetix 8 allows remote attackers to cause a denial of service (application crash) via a malformed PRE file, related to a "Read Access Violation starting at reporter!madTraceProcess."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://code610.blogspot.com/2017/07/readwrite-access-violation-acunetix.html; http://code610.blogspot.com/2017/07/readwrite-access-violation-acunetix.html
CVE: CVE-2017-11675
Published: 2017-07-27
Description: The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/imp0wd3r/vuln-papers/tree/master/zencart-155e-auth-rce; https://github.com/imp0wd3r/vuln-papers/tree/master/zencart-155e-auth-rce
CVE: CVE-2017-11677
Published: 2017-07-27
Description: Cross-site scripting (XSS) vulnerability in Hashtopus 1.5g allows remote attackers to inject arbitrary web script or HTML via the query string to admin.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99974; https://github.com/curlyboi/hashtopus/issues/63; http://www.securityfocus.com/bid/99974
CVE: CVE-2017-11678
Published: 2017-07-27
Description: SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter in admin.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/99982; https://github.com/curlyboi/hashtopus/issues/63; http://www.securityfocus.com/bid/99982
CVE: CVE-2017-11679
Published: 2017-07-27
Description: Cross-Site Request Forgery (CSRF) exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/99984; https://github.com/curlyboi/hashtopus/issues/63; http://www.securityfocus.com/bid/99984
CVE: CVE-2017-11680
Published: 2017-07-27
Description: Cross-Site Request Forgery (CSRF) exists in Hashtopussy 0.4.0, allowing an admin password change via users.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/s3inlc/hashtopussy/issues/241; https://github.com/s3inlc/hashtopussy/issues/241
CVE: CVE-2017-11681
Published: 2017-07-27
Description: Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrative roles, as demonstrated by an action=createVoucher request to agents.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/s3inlc/hashtopussy/issues/241; https://github.com/s3inlc/hashtopussy/issues/241
CVE: CVE-2017-11682
Published: 2017-07-27
Description: Stored Cross-site scripting vulnerability in Hashtopussy 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) version, (2) url, or (3) rootdir parameter in hashcat.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/s3inlc/hashtopussy/issues/241; https://github.com/s3inlc/hashtopussy/issues/241
CVE: CVE-2017-11683
Published: 2017-07-27
Description: There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://www.securityfocus.com/bid/100030; https://bugzilla.redhat.com/show_bug.cgi?id=1475124; https://lists.debian.org/debian-lts-announce/2022/11/msg00013.html
CVE: CVE-2017-11684
Published: 2017-07-27
Description: There is an illegal address access in the build_table function in libavcodec/bitstream.c of Libav 12.1 that will lead to remote denial of service via crafted input.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/99980; https://bugzilla.libav.org/show_bug.cgi?id=1073; http://www.securityfocus.com/bid/99980
CVE: CVE-2017-11685
Published: 2017-07-27
Description: Multiple Reflective cross-site scripting (XSS) vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML, as demonstrated by the fName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://init6.me/exploiting-manageengine-eventlog-analyzer.html; http://init6.me/exploiting-manageengine-eventlog-analyzer.html
CVE: CVE-2017-11686
Published: 2017-07-27
Description: Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows remote attackers to obtain an authenticated user's password via XSS vulnerabilities or sniffing non-SSL traffic on the network, because the password is represented in a cookie with a reversible encoding method.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://init6.me/exploiting-manageengine-eventlog-analyzer.html; http://init6.me/exploiting-manageengine-eventlog-analyzer.html
CVE: CVE-2017-11687
Published: 2017-07-27
Description: Multiple Persistent cross-site scripting (XSS) vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML via syslog.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://init6.me/exploiting-manageengine-eventlog-analyzer.html; http://init6.me/exploiting-manageengine-eventlog-analyzer.html
CVE: CVE-2017-11691
Published: 2017-07-27
Description: Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100022; http://www.securitytracker.com/id/1038982; https://github.com/Cacti/cacti/commit/104090aeead4aa433bf1f18cd6d52dcfeb71236c
CVE: CVE-2017-9258
Published: 2017-07-27
Description: The TDStretch::processSamples function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted wav file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://seclists.org/fulldisclosure/2017/Jul/62; https://www.exploit-db.com/exploits/42389/; http://seclists.org/fulldisclosure/2017/Jul/62
CVE: CVE-2017-9259
Published: 2017-07-27
Description: The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (memory allocation error and application crash) via a crafted wav file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://seclists.org/fulldisclosure/2017/Jul/62; http://www.securityfocus.com/bid/100095; https://www.exploit-db.com/exploits/42389/
CVE: CVE-2017-9260
Published: 2017-07-27
Description: The TDStretchSSE::calcCrossCorr function in source/SoundTouch/sse_optimized.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted wav file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Jul/62; https://www.exploit-db.com/exploits/42389/; http://seclists.org/fulldisclosure/2017/Jul/62
CVE: CVE-2017-9410
Published: 2017-07-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-9101. Reason: This candidate is a duplicate of CVE-2015-9101. Notes: All CVE users should reference CVE-2015-9101 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CWE: CWE-125
CVE: CVE-2017-9411
Published: 2017-07-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-9100. Reason: This candidate is a duplicate of CVE-2015-9100. Notes: All CVE users should reference CVE-2015-9100 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-9412
Published: 2017-07-27
Description: The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2017/Jul/63; https://www.exploit-db.com/exploits/42390/; http://seclists.org/fulldisclosure/2017/Jul/63
CVE: CVE-2017-9545
Published: 2017-07-27
Description: The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of service (buffer over-read) via a crafted mp3 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2017/Jul/65; http://seclists.org/fulldisclosure/2017/Jul/65
CVE: CVE-2017-9614
Published: 2017-07-27
Description: The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file. NOTE: Maintainer asserts the issue is due to a bug in downstream code caused by misuse of the libjpeg API
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/143518/libjpeg-turbo-1.5.1-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2017/Jul/66; http://seclists.org/fulldisclosure/2017/Jul/66
CVE: CVE-2017-11665
Published: 2017-07-27
Description: The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash) via a crafted stream.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3957; http://www.securityfocus.com/bid/100017; https://github.com/FFmpeg/FFmpeg/commit/ffcc82219cef0928bed2d558b19ef6ea35634130
CVE: CVE-2017-8869
Published: 2017-07-27
Description: Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42384/; https://www.exploit-db.com/exploits/42384/
CVE: CVE-2016-10402
Published: 2017-07-27
Description: Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/84841; https://bugs.chromium.org/p/project-zero/issues/detail?id=765; http://www.securityfocus.com/bid/84841
CVE: CVE-2016-10399
Published: 2017-07-27
Description: Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensitive system files via a specially crafted URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-538
References: https://sendio.com/support/software-release-history/; https://sendio.com/support/software-release-history/
CVE: CVE-2017-8870
Published: 2017-07-27
Description: Buffer overflow in AudioCoder 0.8.46 allows remote attackers to execute arbitrary code via a crafted .m3u file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42385/; https://www.exploit-db.com/exploits/42385/
CVE: CVE-2016-0736
Published: 2017-07-27
Description: In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2017-1415.html; http://www.debian.org/security/2017/dsa-3796; http://www.securityfocus.com/bid/95078
CVE: CVE-2016-2161
Published: 2017-07-27
Description: In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-823, CWE-20
References: http://rhn.redhat.com/errata/RHSA-2017-1415.html; http://www.debian.org/security/2017/dsa-3796; http://www.securityfocus.com/bid/95076
CVE: CVE-2016-8743
Published: 2017-07-27
Description: Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
CVSS Score: 7.5 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2017-1415.html; http://www.debian.org/security/2017/dsa-3796; http://www.securityfocus.com/bid/95077
CVE: CVE-2017-11183
Published: 2017-07-28
Description: front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://github.com/glpi-project/glpi/issues/2450; https://github.com/glpi-project/glpi/releases/tag/9.1.5; https://github.com/glpi-project/glpi/issues/2450
CVE: CVE-2017-11184
Published: 2017-07-28
Description: SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/issues/2449; https://github.com/glpi-project/glpi/releases/tag/9.1.5; https://github.com/glpi-project/glpi/issues/2449
CVE: CVE-2017-11645
Published: 2017-07-28
Description: NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 do not require authentication for logfile.html, status.html, or system_config.html.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://iscouncil.blogspot.com/2017/07/access-violation-vulnerability-in.html; https://iscouncil.blogspot.com/2017/07/access-violation-vulnerability-in.html
CVE: CVE-2017-11646
Published: 2017-07-28
Description: NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to CSRF attacks, as demonstrated by using administration.html to disable the firewall. They does not contain any token that can mitigate CSRF vulnerabilities within the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://iscouncil.blogspot.com/2017/07/cross-site-request-forgery.html; https://iscouncil.blogspot.com/2017/07/cross-site-request-forgery.html
CVE: CVE-2017-11647
Published: 2017-07-28
Description: NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to stored cross-site scripting attacks. Creating an SSID with an XSS payload results in successful exploitation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://iscouncil.blogspot.com/2017/07/cross-site-scripting-vulnerability-in.html; https://iscouncil.blogspot.com/2017/07/cross-site-scripting-vulnerability-in.html
CVE: CVE-2017-11703
Published: 2017-07-28
Description: A memory leak vulnerability was found in the function parseSWF_DOACTION in util/parser.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://somevulnsofadlab.blogspot.jp/2017/07/libmingmemory-leak-in-parseswfdoaction.html; https://github.com/libming/libming/issues/72; http://somevulnsofadlab.blogspot.jp/2017/07/libmingmemory-leak-in-parseswfdoaction.html
CVE: CVE-2017-11704
Published: 2017-07-28
Description: A heap-based buffer over-read was found in the function decompileIF in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://somevulnsofadlab.blogspot.jp/2017/07/libmingheap-buffer-overflow-in.html; https://github.com/libming/libming/issues/76; http://somevulnsofadlab.blogspot.jp/2017/07/libmingheap-buffer-overflow-in.html