deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-8931
Published: 2017-02-01
Description: IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg21992072; http://www.securityfocus.com/bid/95451; http://www.ibm.com/support/docview.wss?uid=swg21992072
CVE: CVE-2016-8932
Published: 2017-02-01
Description: IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg21992072; http://www.securityfocus.com/bid/95443; http://www.ibm.com/support/docview.wss?uid=swg21992072
CVE: CVE-2016-8933
Published: 2017-02-01
Description: IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitrary files on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.ibm.com/support/docview.wss?uid=swg21992072; http://www.securityfocus.com/bid/95435; http://www.ibm.com/support/docview.wss?uid=swg21992072
CVE: CVE-2016-8938
Published: 2017-02-01
Description: IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production applications.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg2C1000237; http://www.securityfocus.com/bid/95289; http://www.ibm.com/support/docview.wss?uid=swg2C1000237
CVE: CVE-2016-8963
Published: 2017-02-01
Description: IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21995029; http://www.securityfocus.com/bid/95282; http://www.ibm.com/support/docview.wss?uid=swg21995029
CVE: CVE-2016-8977
Published: 2017-02-01
Description: IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21995014; http://www.securityfocus.com/bid/95308; http://www.ibm.com/support/docview.wss?uid=swg21995014
CVE: CVE-2016-8982
Published: 2017-02-01
Description: IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21995895; http://www.securityfocus.com/bid/95651; http://www.securitytracker.com/id/1037616
CVE: CVE-2016-8999
Published: 2017-02-01
Description: IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21995155; http://www.securityfocus.com/bid/95325; http://www.securitytracker.com/id/1037563
CVE: CVE-2016-9000
Published: 2017-02-01
Description: IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21995257; http://www.securityfocus.com/bid/95324; http://www.securitytracker.com/id/1037564
CVE: CVE-2016-9008
Published: 2017-02-01
Description: IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg2C1000238; http://www.securityfocus.com/bid/95283; http://www.ibm.com/support/docview.wss?uid=swg2C1000238
CVE: CVE-2016-9703
Published: 2017-02-01
Description: IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information.
CVSS Score: 2.4 (LOW)
CWE: CWE-384
References: http://www.ibm.com/support/docview.wss?uid=swg21996761; http://www.securityfocus.com/bid/95327; http://www.securitytracker.com/id/1037765
CVE: CVE-2016-9704
Published: 2017-02-01
Description: IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21996761; http://www.securityfocus.com/bid/95323; http://www.securitytracker.com/id/1037765
CVE: CVE-2016-9739
Published: 2017-02-01
Description: IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.ibm.com/support/docview.wss?uid=swg21996761; http://www.securityfocus.com/bid/95326; http://www.securitytracker.com/id/1037765
CVE: CVE-2017-5630
Published: 2017-02-01
Description: PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://pear.php.net/bugs/bug.php?id=21171; http://www.securityfocus.com/bid/95882; https://www.exploit-db.com/exploits/41185/
CVE: CVE-2017-5218
Published: 2017-02-02
Description: A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user's session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=<VALID-SID>&database=1';WAITFOR DELAY '0:0:5'-- URI is a Proof of Concept.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218/; http://www.securityfocus.com/bid/95968; http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218/
CVE: CVE-2017-5219
Published: 2017-02-02
Description: An issue was discovered in SageCRM 7.x before 7.3 SP3. The Component Manager functionality, provided by SageCRM, permits additional components to be added to the application to enhance provided functionality. This functionality allows a zip file to be uploaded, containing a valid .ecf component file, which will be extracted to the inf directory outside of the webroot. By creating a zip file containing an empty .ecf file, to pass file-validation checks, any other file provided in zip file will be extracted onto the filesystem. In this case, a web shell with the filename '..\WWWRoot\CustomPages\aspshell.asp' was included within the zip file that, when extracted, traversed back out of the inf directory and into the SageCRM webroot. This permitted remote interaction with the underlying filesystem with the highest privilege level, SYSTEM.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218/; http://www.securityfocus.com/bid/95968; http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218/
CVE: CVE-2016-1566
Published: 2017-02-02
Description: Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location shared by multiple users, allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename.  NOTE: this vulnerability was fixed in guacamole.war on 2016-01-13, but the version number was not changed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/guacamole/news/2016/02/security-advisory---stored-xss-cve-2016-1566--guac-1465/; https://sourceforge.net/p/guacamole/news/2016/02/security-advisory---stored-xss-cve-2016-1566--guac-1465/
CVE: CVE-2017-5600
Published: 2017-02-02
Description: The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privileged account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/96041; https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]; http://www.securityfocus.com/bid/96041
CVE: CVE-2016-6234
Published: 2017-02-02
Description: The process_file function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service (crash) via a crafted jpeg file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/07/17/6; https://github.com/dropbox/lepton/issues/26; http://www.openwall.com/lists/oss-security/2016/07/17/6
CVE: CVE-2016-6235
Published: 2017-02-02
Description: The setup_imginfo_jpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service (segmentation fault) via a crafted jpeg file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/07/17/6; https://github.com/dropbox/lepton/issues/26; http://www.openwall.com/lists/oss-security/2016/07/17/6
CVE: CVE-2016-6236
Published: 2017-02-02
Description: The setup_imginfo_jpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/07/17/6; https://github.com/dropbox/lepton/issues/26; http://www.openwall.com/lists/oss-security/2016/07/17/6
CVE: CVE-2016-6237
Published: 2017-02-02
Description: The build_huffcodes function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service (out-of-bounds write) via a crafted jpeg file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2016/07/17/6; https://github.com/dropbox/lepton/issues/26; http://www.openwall.com/lists/oss-security/2016/07/17/6
CVE: CVE-2016-6238
Published: 2017-02-02
Description: The write_ujpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service (out-of-bounds read) via a crafted jpeg file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/07/17/6; https://github.com/dropbox/lepton/issues/26; http://www.openwall.com/lists/oss-security/2016/07/17/6
CVE: CVE-2016-5935
Published: 2017-02-02
Description: IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21997711; http://www.securityfocus.com/bid/96003; http://www.ibm.com/support/docview.wss?uid=swg21997711
CVE: CVE-2016-6095
Published: 2017-02-02
Description: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.ibm.com/support/docview.wss?uid=swg21997802; http://www.securityfocus.com/bid/95965; http://www.ibm.com/support/docview.wss?uid=swg21997802
CVE: CVE-2016-6099
Published: 2017-02-02
Description: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21997924; http://www.securityfocus.com/bid/95958; http://www.ibm.com/support/docview.wss?uid=swg21997924
CVE: CVE-2016-6103
Published: 2017-02-02
Description: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg21997949; http://www.securityfocus.com/bid/95950; http://www.ibm.com/support/docview.wss?uid=swg21997949
CVE: CVE-2016-6116
Published: 2017-02-02
Description: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21997805; http://www.securityfocus.com/bid/95966; http://www.ibm.com/support/docview.wss?uid=swg21997805
CVE: CVE-2017-1093
Published: 2017-02-02
Description: IBM AIX 6.1, 7.1, and 7.2 could allow a local user to exploit a vulnerability in the bellmail binary to gain root privileges.
CVSS Score: 7.8 (HIGH)
References: http://aix.software.ibm.com/aix/efixes/security/bellmail_advisory2.asc; http://www.securityfocus.com/bid/95891; http://www.securitytracker.com/id/1037748
CVE: CVE-2016-0890
Published: 2017-02-03
Description: EMC PowerPath Virtual (Management) Appliance 2.0, EMC PowerPath Virtual (Management) Appliance 2.0 SP1 is affected by a sensitive information disclosure vulnerability that may potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/540065/30/0/threaded; http://www.securityfocus.com/bid/95832; http://www.securityfocus.com/archive/1/540065/30/0/threaded
CVE: CVE-2016-0919
Published: 2017-02-03
Description: EMC RSA Web Threat Detection version 5.0, RSA Web Threat Detection version 5.1, RSA Web Threat Detection version 5.1.2 has a cross site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/540057/30/0/threaded; http://www.securityfocus.com/bid/95820; http://www.securitytracker.com/id/1037726
CVE: CVE-2016-6648
Published: 2017-02-03
Description: EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by sensitive information disclosure vulnerability as a result of incorrect permissions set on a sensitive system file. A malicious administrator with configuration privileges may access this sensitive system file and compromise the affected system.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-275
References: http://www.securityfocus.com/archive/1/540058/30/0/threaded; http://www.securityfocus.com/bid/95821; http://www.securitytracker.com/id/1037727
CVE: CVE-2016-6649
Published: 2017-02-03
Description: EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by multiple command injection vulnerabilities where a malicious administrator with configuration privileges may bypass the user interface and escalate his privileges to root.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77
References: http://www.securityfocus.com/archive/1/540058/30/0/threaded; http://www.securityfocus.com/bid/95821; http://www.securitytracker.com/id/1037727
CVE: CVE-2016-8211
Published: 2017-02-03
Description: EMC Data Protection Advisor 6.1.x, EMC Data Protection Advisor 6.2, EMC Data Protection Advisor 6.2.1, EMC Data Protection Advisor 6.2.2, EMC Data Protection Advisor 6.2.3 prior to patch 446 has a path traversal vulnerability that may potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/540067/30/0/threaded; http://www.securityfocus.com/bid/95833; http://www.securitytracker.com/id/1037729
CVE: CVE-2016-8212
Published: 2017-02-03
Description: An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/archive/1/540066/30/0/threaded; http://www.securityfocus.com/bid/95831; http://www.securitytracker.com/id/1037732
CVE: CVE-2016-8216
Published: 2017-02-03
Description: EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10 has a command injection vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/540059/30/0/threaded; http://www.securityfocus.com/bid/95829; http://www.securitytracker.com/id/1037728
CVE: CVE-2016-8217
Published: 2017-02-03
Description: EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS#12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS#12 file to the toolkit and guess the current MAC one byte at a time. This is possible because Crypto-J uses a non-constant-time method to compare the stored MAC with the calculated MAC. This vulnerability is similar to the issue described in CVE-2015-2601.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/540066/30/0/threaded; http://www.securityfocus.com/bid/95831; http://www.securitytracker.com/id/1037732
CVE: CVE-2016-9871
Published: 2017-02-03
Description: EMC Isilon OneFS 7.2.1.0 - 7.2.1.3, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, EMC Isilon OneFS 7.1.0.x is affected by a privilege escalation vulnerability that could potentially be exploited by attackers to compromise the affected system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/540050/30/0/threaded; http://www.securityfocus.com/bid/95800; http://www.securityfocus.com/archive/1/540050/30/0/threaded
CVE: CVE-2016-9872
Published: 2017-02-03
Description: EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has Reflected Cross-Site Scripting Vulnerabilities that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/540060/30/0/threaded; http://www.securityfocus.com/bid/95824; http://www.securitytracker.com/id/1037733
CVE: CVE-2016-9873
Published: 2017-02-03
Description: EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information, modify data or disrupt services by causing execution of arbitrary DQL commands on the application.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: http://www.securityfocus.com/archive/1/540060/30/0/threaded; http://www.securityfocus.com/bid/95828; http://www.securitytracker.com/id/1037733
CVE: CVE-2017-2766
Published: 2017-02-03
Description: EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: http://www.securityfocus.com/archive/1/540077/30/0/threaded; http://www.securityfocus.com/bid/95893; http://www.securityfocus.com/archive/1/540077/30/0/threaded
CVE: CVE-2017-2767
Published: 2017-02-03
Description: EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Configuration Manager (NCM) 9.4.2.x contains a Java RMI Remote Code Execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/540085/30/0/threaded; http://www.securityfocus.com/bid/95938; http://www.securitytracker.com/id/1037761
CVE: CVE-2017-2768
Published: 2017-02-03
Description: EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Configuration Manager (NCM) 9.4.2.x contains an Improper Authentication vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/540085/30/0/threaded; http://www.securityfocus.com/bid/95936; http://www.securitytracker.com/id/1037761
CVE: CVE-2017-3806
Published: 2017-02-03
Description: A vulnerability in CLI command processing in the Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to inject arbitrary shell commands that are executed by the device. More Information: CSCvb61343. Known Affected Releases: 2.0(1.68). Known Fixed Releases: 2.0(1.118) 2.1(1.47) 92.1(1.1646) 92.1(1.1763) 92.2(1.101).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: http://www.securityfocus.com/bid/95943; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fpw; http://www.securityfocus.com/bid/95943
CVE: CVE-2017-3809
Published: 2017-02-03
Description: A vulnerability in the Policy deployment module of the Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to prevent deployment of a complete and accurate rule base. More Information: CSCvb95281. Known Affected Releases: 6.1.0 6.2.0. Known Fixed Releases: 6.1.0.1 6.2.0.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/95941; http://www.securitytracker.com/id/1037776; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fmc
CVE: CVE-2017-3810
Published: 2017-02-03
Description: A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against a user who is logged in to an affected system. More Information: CSCvb21745. Known Affected Releases: 10.0_R2_tanggula.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/95947; http://www.securitytracker.com/id/1037772; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-psc