deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-5318
Published: 2017-01-20
Description: Stack-based buffer overflow in the _TIFFVGetField function in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted tiff.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/04/27/6; http://www.openwall.com/lists/oss-security/2016/06/07/1; http://www.securityfocus.com/bid/88604
CVE: CVE-2016-5319
Published: 2017-01-20
Description: Heap-based buffer overflow in tif_packbits.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted bmp file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/04/27/6; http://www.openwall.com/lists/oss-security/2016/06/07/1; http://www.securityfocus.com/bid/88604
CVE: CVE-2016-5321
Published: 2017-01-20
Description: The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.html; http://www.debian.org/security/2017/dsa-3762; http://www.securityfocus.com/bid/91209
CVE: CVE-2016-5323
Published: 2017-01-20
Description: The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.html; http://www.debian.org/security/2017/dsa-3762; http://www.openwall.com/lists/oss-security/2016/06/15/6
CVE: CVE-2016-6253
Published: 2017-01-20
Description: mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://akat1.pl/?id=2; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.asc; http://packetstormsecurity.com/files/138021/NetBSD-mail.local-8-Local-Root.html
CVE: CVE-2016-9435
Published: 2017-01-20
Description: The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00084.html; http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407
CVE: CVE-2016-9436
Published: 2017-01-20
Description: parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a <i> tag.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00084.html; http://www.openwall.com/lists/oss-security/2016/11/18/3; http://www.securityfocus.com/bid/94407
CVE: CVE-2017-5545
Published: 2017-01-21
Description: The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/95702; https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee; https://github.com/libimobiledevice/libplist/issues/87
CVE: CVE-2016-10101
Published: 2017-01-23
Description: Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd. Users have the Read attribute, which allows an attacker to recover the encrypted password to access the Password Manager.
CVSS Score: 8.1 (HIGH)
CWE: CWE-255, CWE-326
References: http://www.securityfocus.com/bid/96840; https://rastamouse.me/guff/2016/automize/; http://www.securityfocus.com/bid/96840
CVE: CVE-2016-10102
Published: 2017-01-23
Description: hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords. This allows an attacker to retrieve the encrypted passwords from sshProfiles.jsd and encryptionProfiles.jsd and decrypt them to recover cleartext passwords. All 10.x up to and including 10.25 and all 11.x up to and including 11.14 are verified to be affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-326
References: http://www.securityfocus.com/bid/96848; https://rastamouse.me/guff/2016/automize/; http://www.securityfocus.com/bid/96848
CVE: CVE-2016-10103
Published: 2017-01-23
Description: Information Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attacker to recover encrypted passwords for GPG Encryption profiles. Verified in all 10.x versions up to and including 10.25, and all 11.x versions up to and including 11.14.
CVSS Score: 8.1 (HIGH)
CWE: CWE-255, CWE-326
References: http://www.securityfocus.com/bid/96850; https://rastamouse.me/guff/2016/automize/; http://www.securityfocus.com/bid/96850
CVE: CVE-2016-10104
Published: 2017-01-23
Description: Information Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attacker to recover encrypted passwords for SSH/SFTP profiles. Verified in all 10.x versions up to and including 10.25, and all 11.x versions up to and including 11.14.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://www.securityfocus.com/bid/96845; https://rastamouse.me/guff/2016/automize/; http://www.securityfocus.com/bid/96845
CVE: CVE-2016-10156
Published: 2017-01-23
Description: A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/95790; http://www.securitytracker.com/id/1037686; https://bugzilla.suse.com/show_bug.cgi?id=1020601
CVE: CVE-2016-10157
Published: 2017-01-23
Description: Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code within the Akamai NetSession process space.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/95995; https://packetstormsecurity.com/files/140366/Akamai-NetSession-1.9.3.1-DLL-Hijacking.html; http://www.securityfocus.com/bid/95995
CVE: CVE-2016-8213
Published: 2017-01-23
Description: EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; and EMC Documentum Capital Projects Version 1.9, prior to P30 and Version 1.10, prior to P17; and EMC Documentum Administrator Version 7.0, Version 7.1, and Version 7.2 prior to P18 contain a Stored Cross-Site Scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/540019/30/0/threaded; http://www.securityfocus.com/bid/95625; http://www.securitytracker.com/id/1037626
CVE: CVE-2016-9870
Published: 2017-01-23
Description: EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon OneFS 7.1.0.x is affected by an LDAP injection vulnerability that could potentially be exploited by a malicious user to compromise the system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-90
References: http://www.securityfocus.com/archive/1/540020/30/0/threaded; http://www.securityfocus.com/bid/95626; http://www.securityfocus.com/archive/1/540020/30/0/threaded
CVE: CVE-2017-5539
Published: 2017-01-23
Description: The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://b2evolution.net/downloads/6-8-5; http://www.securityfocus.com/bid/95700; https://github.com/b2evolution/b2evolution/commit/e35f7c195d8c1103d2d981a48cda5ab45ecac48a
CVE: CVE-2017-5544
Published: 2017-01-23
Description: An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking tool to establish SSH connections quickly. This will trigger an increase in the SSH login timeout (each of the login attempts will occupy a connection slot for a longer time). Once this occurs, legitimate login attempts via SSH/telnet will be refused, resulting in a denial of service; you must restart the device.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: http://www.nfcwar.com; http://www.securityfocus.com/bid/95708; http://www.nfcwar.com
CVE: CVE-2017-5553
Published: 2017-01-23
Description: Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://b2evolution.net/downloads/6-8-5; http://www.securityfocus.com/bid/95704; https://github.com/b2evolution/b2evolution/commit/ce5b36e44b714b18b0bcd34c6db0187b8d13bab8
CVE: CVE-2017-5554
Published: 2017-01-23
Description: An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform's SELinux in permissive mode, which severely weakens it, by issuing: fastboot oem selinux permissive.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/95706; https://securityresear.ch/2017/01/11/fastboot-oem-selinux-permissive/; https://www.xda-developers.com/oneplus-33t-bootloader-vulnerability-allows-changing-of-selinux-to-permissive-mode-in-fastboot/
CVE: CVE-2017-5556
Published: 2017-01-23
Description: The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. The vulnerability could lead to information disclosure; an attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/95353; http://www.zerodayinitiative.com/advisories/ZDI-17-039/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2017-5563
Published: 2017-01-23
Description: LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://bugzilla.maptools.org/show_bug.cgi?id=2664; http://www.securityfocus.com/bid/95705; https://security.gentoo.org/glsa/201709-27
CVE: CVE-2017-5574
Published: 2017-01-23
Description: SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95701; https://github.com/semplon/GeniXCMS/issues/69; https://github.com/semplon/GeniXCMS/releases/tag/v1.0.0
CVE: CVE-2017-5575
Published: 2017-01-23
Description: SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95703; https://github.com/semplon/GeniXCMS/issues/68; https://github.com/semplon/GeniXCMS/releases/tag/v1.0.0
CVE: CVE-2017-5182
Published: 2017-01-23
Description: Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to OES2015 SP1 before Maintenance Update 11080, OES2015 before Maintenance Update 11079, OES11 SP3 before Maintenance Update 11078, OES11 SP2 before Maintenance Update 11077).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-200
References: http://www.securityfocus.com/bid/95743; http://www.securitytracker.com/id/1037689; https://www.novell.com/support/kb/doc.php?id=7018503
CVE: CVE-2017-5569
Published: 2017-01-23
Description: An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be exploited without the need of authentication and via an HTTP POST request, and which can be used to dump database data out to a malicious server, using an out-of-band technique such as select_loadfile().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95741; https://gist.github.com/malerisch/d32d127a002ac1f10bce39333ca9a4dc; http://www.securityfocus.com/bid/95741
CVE: CVE-2017-5570
Published: 2017-01-23
Description: An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the messageJson.jsp, which can only be exploited by authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band technique such as select_loadfile().
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95742; https://gist.github.com/malerisch/898c7ae46abde5da15748beb1e6e886f; http://www.securityfocus.com/bid/95742
CVE: CVE-2013-7451
Published: 2017-01-23
Description: The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; https://nodesecurity.io/advisories/41; http://www.openwall.com/lists/oss-security/2016/04/20/11
CVE: CVE-2013-7452
Published: 2017-01-23
Description: The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; https://nodesecurity.io/advisories/41; http://www.openwall.com/lists/oss-security/2016/04/20/11
CVE: CVE-2013-7453
Published: 2017-01-23
Description: The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; https://nodesecurity.io/advisories/41; http://www.openwall.com/lists/oss-security/2016/04/20/11
CVE: CVE-2013-7454
Published: 2017-01-23
Description: The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; https://nodesecurity.io/advisories/41; http://www.openwall.com/lists/oss-security/2016/04/20/11
CVE: CVE-2014-8362
Published: 2017-01-23
Description: Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via the Web-enabled interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/136040/Vivint-Sky-Control-Panel-Unauthenticated-Access.html; http://packetstormsecurity.com/files/136040/Vivint-Sky-Control-Panel-Unauthenticated-Access.html
CVE: CVE-2014-9772
Published: 2017-01-23
Description: The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/97102; https://nodesecurity.io/advisories/43
CVE: CVE-2015-4626
Published: 2017-01-23
Description: B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a negative value in an overdraft.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: https://packetstormsecurity.com/files/136450/C2Box-4.0.0-r19171-Validation-Bypass.html; https://packetstormsecurity.com/files/136450/C2Box-4.0.0-r19171-Validation-Bypass.html
CVE: CVE-2015-7743
Published: 2017-01-23
Description: XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://packetstormsecurity.com/files/137255/Paessler-PRTG-Network-Monitor-14.4.12.3282-XXE-Injection.html; https://www.paessler.com/prtg/history/stable#16.2.23.3077; https://packetstormsecurity.com/files/137255/Paessler-PRTG-Network-Monitor-14.4.12.3282-XXE-Injection.html
CVE: CVE-2015-8315
Published: 2017-01-23
Description: The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/96389; https://nodesecurity.io/advisories/46
CVE: CVE-2015-8854
Published: 2017-01-23
Description: The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO2RMVVZVV6NFTU46B5RYRK7ZCXYARZS/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6BJG6RGDH7ZWVVAUFBFI5L32RSMQN2S/
CVE: CVE-2015-8855
Published: 2017-01-23
Description: The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/86957; https://nodesecurity.io/advisories/31
CVE: CVE-2015-8856
Published: 2017-01-23
Description: Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/96392; https://nodesecurity.io/advisories/34
CVE: CVE-2015-8857
Published: 2017-01-23
Description: The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/96410; https://nodesecurity.io/advisories/39
CVE: CVE-2015-8858
Published: 2017-01-23
Description: The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/96409; https://nodesecurity.io/advisories/48
CVE: CVE-2015-8859
Published: 2017-01-23
Description: The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/96435; https://nodesecurity.io/advisories/56
CVE: CVE-2015-8860
Published: 2017-01-23
Description: The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; https://nodesecurity.io/advisories/57; http://www.openwall.com/lists/oss-security/2016/04/20/11
CVE: CVE-2015-8861
Published: 2017-01-23
Description: The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/96434; https://www.sourceclear.com/blog/handlebars_vulnerability_research_findings/
CVE: CVE-2015-8862
Published: 2017-01-23
Description: mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.securityfocus.com/bid/96436; https://nodesecurity.io/advisories/62
CVE: CVE-2015-8971
Published: 2017-01-23
Description: Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are written to the terminal, a similar issue to CVE-2003-0063.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: http://www.debian.org/security/2016/dsa-3712; http://www.openwall.com/lists/oss-security/2016/11/04/12; http://www.openwall.com/lists/oss-security/2016/11/04/15
CVE: CVE-2015-8972
Published: 2017-01-23
Description: Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.gnu.org/archive/html/bug-gnu-chess/2015-10/msg00002.html; http://svn.savannah.gnu.org/viewvc/chess?revision=134&view=revision; http://www.openwall.com/lists/oss-security/2016/11/13/2
CVE: CVE-2016-0765
Published: 2017-01-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/02/02/3; http://www.securityfocus.com/bid/82347; http://www.vapid.dhs.org/advisory.php?v=160