deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14372
Published: 2017-10-11
Description: RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA Archer Help pages. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Oct/12; http://www.securityfocus.com/bid/101195; http://www.securitytracker.com/id/1039518
CVE: CVE-2017-8016
Published: 2017-10-11
Description: RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Oct/12; http://www.securitytracker.com/id/1039518; http://seclists.org/fulldisclosure/2017/Oct/12
CVE: CVE-2017-8017
Published: 2017-10-11
Description: EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x is affected by a reflected cross-site scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Oct/11; http://www.securityfocus.com/bid/101194; http://www.securitytracker.com/id/1039517
CVE: CVE-2017-8025
Published: 2017-10-11
Description: RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2017/Oct/12; http://www.securityfocus.com/bid/101195; http://www.securitytracker.com/id/1039518
CVE: CVE-2017-5789
Published: 2017-10-11
Description: HPE LoadRunner before 12.53 Patch 4 and HPE Performance Center before 12.53 Patch 4 allow remote attackers to execute arbitrary code via unspecified vectors. At least in LoadRunner, this is a libxdrutil.dll mxdr_string heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101224; http://www.securityfocus.com/bid/96774; http://www.securitytracker.com/id/1038028
CVE: CVE-2017-5791
Published: 2017-10-11
Description: The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/101224; http://www.securityfocus.com/bid/96815; http://www.securitytracker.com/id/1037983
CVE: CVE-2017-12192
Published: 2017-10-12
Description: The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ operation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=37863c43b2c6464f252862bf2e9768264e961678; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.5; https://access.redhat.com/errata/RHSA-2018:0151
CVE: CVE-2017-15274
Published: 2017-10-12
Description: security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5649645d725c73df4302428ee4e02c869248b4c5; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5; http://www.securityfocus.com/bid/101292
CVE: CVE-2017-15277
Published: 2017-10-12
Description: ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/ImageMagick/ImageMagick/commit/9fd10cf630832b36a588c1545d8736539b2f1fb5; https://github.com/ImageMagick/ImageMagick/issues/592; https://github.com/neex/gifoeb
CVE: CVE-2017-15278
Published: 2017-10-12
Description: Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.queries.php). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsteampassnet/TeamPass/blob/master/changelog.md; https://github.com/nilsteampassnet/TeamPass/commit/f5a765381f051fe624386866ddb1f6b5e7eb929b; https://github.com/nilsteampassnet/TeamPass/releases/tag/2.1.27.9
CVE: CVE-2017-15279
Published: 2017-10-12
Description: Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://issues.umbraco.org/issue/U4-10497; https://github.com/umbraco/Umbraco-CMS/commit/fe2b86b681455ac975b294652064b2718d4e2ba2; http://issues.umbraco.org/issue/U4-10497
CVE: CVE-2017-15280
Published: 2017-10-12
Description: XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://issues.umbraco.org/issue/U4-10506; https://github.com/umbraco/Umbraco-CMS/commit/5dde2efe0d2b3a47d17439e03acabb7ea2befb64; http://issues.umbraco.org/issue/U4-10506
CVE: CVE-2017-15281
Published: 2017-10-12
Description: ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101276; https://github.com/ImageMagick/ImageMagick/issues/832; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-15284
Published: 2017-10-12
Description: Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2; https://packetstormsecurity.com/files/144587/OctoberCMS-1.0.425-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/42978/
CVE: CVE-2017-15285
Published: 2017-10-12
Description: X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is to upload an image file in the Attachments section of a product catalog, upload a .php file with an "Add File Via URL" action, and change the image's Description URL to reference the .php URL in the attachments/ directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://sxcurity.github.io/PHP%20Code%20Injection%20in%20X-Cart.pdf; https://sxcurity.github.io/PHP%20Code%20Injection%20in%20X-Cart.pdf
CVE: CVE-2017-15286
Published: 2017-10-12
Description: SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/101285; https://github.com/Ha0Team/crash-of-sqlite3/blob/master/poc.md; http://www.securityfocus.com/bid/101285
CVE: CVE-2017-9514
Published: 2017-10-12
Description: Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded. An attacker who can log in to Bamboo as a user is able to exploit this vulnerability to execute Java code of their choice on systems that have vulnerable versions of Bamboo.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/101269; https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-10-11-938843921.html; http://www.securityfocus.com/bid/101269
CVE: CVE-2017-10857
Published: 2017-10-12
Description: Cybozu Office 10.0.0 to 10.6.1 allows authenticated attackers to bypass access restriction to perform arbitrary actions via "Cabinet" function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: http://jvn.jp/en/jp/JVN14658424/index.html; https://support.cybozu.com/ja-jp/article/9811; http://jvn.jp/en/jp/JVN14658424/index.html
CVE: CVE-2017-10862
Published: 2017-10-12
Description: jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: https://github.com/reallylabs/jwt-scala; https://jvn.jp/en/vu/JVNVU90916766/index.html; https://github.com/reallylabs/jwt-scala
CVE: CVE-2017-10863
Published: 2017-10-12
Description: Untrusted search path vulnerability in HIBUN Confidential File Decryption program prior to 10.50.0.5 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Note this is a separate vulnerability from CVE-2017-10865.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.hitachi-solutions.co.jp/hibun/sp/support/importance/20170929.html; https://jvn.jp/en/jp/JVN58909026/index.html; http://www.hitachi-solutions.co.jp/hibun/sp/support/importance/20170929.html
CVE: CVE-2017-10864
Published: 2017-10-12
Description: Untrusted search path vulnerability in Installer of HIBUN Confidential File Viewer prior to 11.20.0001 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.hitachi-solutions.co.jp/hibun/sp/support/importance/20170929.html; https://jvn.jp/en/jp/JVN94056834/index.html; http://www.hitachi-solutions.co.jp/hibun/sp/support/importance/20170929.html
CVE: CVE-2017-10865
Published: 2017-10-12
Description: Untrusted search path vulnerability in HIBUN Confidential File Decryption program prior to 10.50.0.5 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Note this is a separate vulnerability from CVE-2017-10863.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.hitachi-solutions.co.jp/hibun/sp/support/importance/20170929.html; https://jvn.jp/en/jp/JVN55516206/index.html; http://www.hitachi-solutions.co.jp/hibun/sp/support/importance/20170929.html
CVE: CVE-2015-6358
Published: 2017-10-12
Description: Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ci; http://www.kb.cert.org/vuls/id/566724; http://www.securityfocus.com/bid/78047
CVE: CVE-2017-12849
Published: 2017-10-12
Description: Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.silverstripe.org/download/security-releases/ss-2017-005; https://www.silverstripe.org/download/security-releases/ss-2017-005
CVE: CVE-2017-15268
Published: 2017-10-12
Description: Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/101277; https://access.redhat.com/errata/RHSA-2018:0816; https://access.redhat.com/errata/RHSA-2018:1104
CVE: CVE-2017-15287
Published: 2017-10-12
Description: There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fireshellsecurity.team/assets/pdf/Vulnerability-XSS-Dreambox.pdf; https://www.exploit-db.com/exploits/42986/; https://fireshellsecurity.team/assets/pdf/Vulnerability-XSS-Dreambox.pdf
CVE: CVE-2016-9263
Published: 2017-10-12
Description: WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101294; https://opnsec.com/2017/10/cve-2016-9263-unpatched-xsf-vulnerability-in-wordpress/; http://www.securityfocus.com/bid/101294
CVE: CVE-2017-15290
Published: 2017-10-12
Description: Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data is sent from a server to a client, and not all of this data is required for the client functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://ipvm.com/forums/video-surveillance/topics/mirasys-happy-with-bad-security-unless-hit-with-bad-press; https://www.dropbox.com/s/un43q74ie55wtpe/mirasys-vms-leak-2017.zip?dl=1; https://ipvm.com/forums/video-surveillance/topics/mirasys-happy-with-bad-security-unless-hit-with-bad-press
CVE: CVE-2016-8736
Published: 2017-10-12
Description: Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://openmeetings.markmail.org/thread/tr47byaaopnemvne; http://www.securityfocus.com/bid/94145; http://openmeetings.markmail.org/thread/tr47byaaopnemvne
CVE: CVE-2016-5789
Published: 2017-10-13
Description: A Cross-site Request Forgery issue was discovered in JanTek JTC-200, all versions. An attacker could perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-283-02; https://ics-cert.us-cert.gov/advisories/ICSA-17-283-02
CVE: CVE-2016-5791
Published: 2017-10-13
Description: An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell accessible over the TELNET service without any authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-283-02; https://ics-cert.us-cert.gov/advisories/ICSA-17-283-02
CVE: CVE-2017-11762
Published: 2017-10-13
Description: The Microsoft Graphics Component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way it handles specially crafted embedded fonts, aka "Microsoft Graphics Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-11763.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101108; http://www.securitytracker.com/id/1039536; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11762
CVE: CVE-2017-11763
Published: 2017-10-13
Description: The Microsoft Graphics Component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way it handles specially crafted embedded fonts, aka "Microsoft Graphics Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-11763.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101109; http://www.securitytracker.com/id/1039536; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11763
CVE: CVE-2017-11765
Published: 2017-10-13
Description: The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11784, CVE-2017-11785, and CVE-2017-11814.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101111; http://www.securitytracker.com/id/1039526; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11765
CVE: CVE-2017-11769
Published: 2017-10-13
Description: The Microsoft Windows TRIE component on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way it handles loading dll files, aka "TRIE Remote Code Execution Vulnerability".
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/101112; http://www.securitytracker.com/id/1039535; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11769
CVE: CVE-2017-11771
Published: 2017-10-13
Description: The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly handle DNS responses, aka "Windows Search Remote Code Execution Vulnerability".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101114; http://www.securitytracker.com/id/1039538; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11771
CVE: CVE-2017-11772
Published: 2017-10-13
Description: The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure when it fails to properly handle objects in memory, aka "Microsoft Search Information Disclosure Vulnerability".
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101116; http://www.securitytracker.com/id/1039538; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11772
CVE: CVE-2017-11774
Published: 2017-10-13
Description: Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/101098; http://www.securitytracker.com/id/1039542; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774
CVE: CVE-2017-11775
Published: 2017-10-13
Description: Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11777 and CVE-2017-11820.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101105; http://www.securitytracker.com/id/1039540; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11775
CVE: CVE-2017-11776
Published: 2017-10-13
Description: Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user email content, aka "Microsoft Outlook Information Disclosure Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101106; http://www.securitytracker.com/id/1039542; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11776
CVE: CVE-2017-11777
Published: 2017-10-13
Description: Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11775 and CVE-2017-11820.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101155; http://www.securitytracker.com/id/1039540; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11777
CVE: CVE-2017-11779
Published: 2017-10-13
Description: The Microsoft Windows Domain Name System (DNS) DNSAPI.dll on Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly handle DNS responses, aka "Windows DNSAPI Remote Code Execution Vulnerability".
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/101166; http://www.securitytracker.com/id/1039533; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11779
CVE: CVE-2017-11780
Published: 2017-10-13
Description: The Server Message Block 1.0 (SMBv1) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows a remote code execution vulnerability when it fails to properly handle certain requests, aka "Windows SMB Remote Code Execution Vulnerability".
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/101110; http://www.securitytracker.com/id/1039528; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11780