deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-11455
Published: 2017-08-29
Description: diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CSRF tokens.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/100530; http://www.securitytracker.com/id/1039242; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40793
CVE: CVE-2017-12422
Published: 2017-08-29
Description: NetApp StorageGRID Webscale 10.2.x before 10.2.2.3, 10.3.x before 10.3.0.4, and 10.4.x before 10.4.0.2 allow remote authenticated users to delete arbitrary objects via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/100535; https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]; http://www.securityfocus.com/bid/100535
CVE: CVE-2017-12763
Published: 2017-08-29
Description: An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://www.nomachine.com/SU08O00185; https://www.nomachine.com/forums/topic/security-advisory-nomachine-privileges-escalation-vulnerability; https://www.nomachine.com/SU08O00185
CVE: CVE-2017-12775
Published: 2017-08-29
Description: qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.question2answer.org/versions.php; https://github.com/q2a/question2answer/commit/6013ca1c83bf232008f7be815c0e4821fb6b120a; http://www.question2answer.org/versions.php
CVE: CVE-2017-12797
Published: 2017-08-29
Description: Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://sourceforge.net/p/mpg123/bugs/254/; https://sourceforge.net/p/mpg123/mailman/message/35987663/; https://sourceforge.net/p/mpg123/bugs/254/
CVE: CVE-2017-12856
Published: 2017-08-29
Description: Cross-site scripting (XSS) vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter to index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cooltey/C.P.Sub/issues/2; https://github.com/cooltey/C.P.Sub/issues/2
CVE: CVE-2017-12867
Published: 2017-08-29
Description: The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-613
References: https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html; https://simplesamlphp.org/security/201708-01; https://www.debian.org/security/2018/dsa-4127
CVE: CVE-2017-12875
Published: 2017-08-29
Description: The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/ImageMagick/ImageMagick/issues/659; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE: CVE-2017-12865
Published: 2017-08-29
Description: Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the "name" variable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3956; http://www.securityfocus.com/bid/100498; https://01.org/security/intel-oss-10001/intel-oss-10001
CVE: CVE-2017-13673
Published: 2017-08-29
Description: The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html; http://www.openwall.com/lists/oss-security/2017/09/10/1; http://www.securityfocus.com/bid/100527
CVE: CVE-2016-0354
Published: 2017-08-29
Description: IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-0355
Published: 2017-08-29
Description: IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111894.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-0356
Published: 2017-08-29
Description: IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111895.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-10503
Published: 2017-08-29
Description: IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spoofing results of votes in the meeting. IBM X-Force ID: 113803.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; https://exchange.xforce.ibmcloud.com/vulnerabilities/113803; http://www.ibm.com/support/docview.wss?uid=swg22006439
CVE: CVE-2016-2959
Published: 2017-08-29
Description: IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges. IBM X-Force ID: 113804.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-2965
Published: 2017-08-29
Description: IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious link, a remote attacker could force the user to log out of Sametime. IBM X-Force ID: 113846.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-2969
Published: 2017-08-29
Description: IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force ID: 113850.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-2971
Published: 2017-08-29
Description: IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future attacks. IBM X-Force ID: 113898.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-2972
Published: 2017-08-29
Description: IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be accessed by a local user. IBM X-Force ID: 113855.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-2973
Published: 2017-08-29
Description: IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113899.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-2977
Published: 2017-08-29
Description: IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a malicious user to lower other users hands in the meeting. IBM X-Force ID: 113937.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2016-2979
Published: 2017-08-29
Description: IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113945.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22006439; http://www.securityfocus.com/bid/100599; http://www.securitytracker.com/id/1039231
CVE: CVE-2013-7426
Published: 2017-08-29
Description: Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.openwall.com/lists/oss-security/2015/02/12/7; http://www.securityfocus.com/bid/100537; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=712083
CVE: CVE-2013-7431
Published: 2017-08-29
Description: Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://securityvulns.ru/docs29645.html; http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.html; http://www.openwall.com/lists/oss-security/2015/02/26/11
CVE: CVE-2013-7432
Published: 2017-08-29
Description: The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://securityvulns.ru/docs29645.html; http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.html; http://www.openwall.com/lists/oss-security/2015/02/26/11
CVE: CVE-2013-7433
Published: 2017-08-29
Description: Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://securityvulns.ru/docs29645.html; http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.html; http://www.openwall.com/lists/oss-security/2015/02/26/11
CVE: CVE-2014-9497
Published: 2017-08-29
Description: Buffer overflow in mpg123 before 1.18.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/01/04/5; https://security.gentoo.org/glsa/201502-01; https://sourceforge.net/p/mpg123/bugs/201/
CVE: CVE-2016-8752
Published: 2017-08-29
Description: Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://lists.apache.org/thread.html/f7435d66b840daa2a38ad1329d639b70f5a9476e7580ae885d422e86%40%3Cdev.atlas.apache.org%3E; https://lists.apache.org/thread.html/f7435d66b840daa2a38ad1329d639b70f5a9476e7580ae885d422e86%40%3Cdev.atlas.apache.org%3E
CVE: CVE-2017-3150
Published: 2017-08-29
Description: Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100536; https://lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea%40%3Cdev.atlas.apache.org%3E; http://www.securityfocus.com/bid/100536
CVE: CVE-2017-3151
Published: 2017-08-29
Description: Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100547; https://lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea%40%3Cdev.atlas.apache.org%3E; http://www.securityfocus.com/bid/100547
CVE: CVE-2017-3152
Published: 2017-08-29
Description: Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100577; https://lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea%40%3Cdev.atlas.apache.org%3E; http://www.securityfocus.com/bid/100577
CVE: CVE-2017-3153
Published: 2017-08-29
Description: Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100578; https://lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea%40%3Cdev.atlas.apache.org%3E; http://www.securityfocus.com/bid/100578
CVE: CVE-2017-3154
Published: 2017-08-29
Description: Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100581; https://lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea%40%3Cdev.atlas.apache.org%3E; http://www.securityfocus.com/bid/100581
CVE: CVE-2017-3155
Published: 2017-08-29
Description: Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100587; https://lists.apache.org/thread.html/4a4fef91e067fd0d9da569e30867c1fa65e2a0520acde71ddefee0ea%40%3Cdev.atlas.apache.org%3E; http://www.securityfocus.com/bid/100587
CVE: CVE-2016-0358
Published: 2017-08-29
Description: IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was not invited to. IBM X-Force ID: 111928.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006441; http://www.securityfocus.com/bid/100572; https://exchange.xforce.ibmcloud.com/vulnerabilities/111928
CVE: CVE-2016-2964
Published: 2017-08-29
Description: IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application. IBM X-Force ID: 113813.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006441; http://www.securityfocus.com/bid/100572; https://exchange.xforce.ibmcloud.com/vulnerabilities/113813
CVE: CVE-2016-2966
Published: 2017-08-29
Description: IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006441; http://www.securityfocus.com/bid/100572; https://exchange.xforce.ibmcloud.com/vulnerabilities/113847
CVE: CVE-2016-2967
Published: 2017-08-29
Description: IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Sametime away message altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113848.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22006441; http://www.securityfocus.com/bid/100572; https://exchange.xforce.ibmcloud.com/vulnerabilities/113848
CVE: CVE-2016-2974
Published: 2017-08-29
Description: IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime environment as well as other users on the local machine of the user. IBM X-Force ID: 113934.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006444; http://www.securityfocus.com/bid/100528; https://exchange.xforce.ibmcloud.com/vulnerabilities/113934
CVE: CVE-2016-2975
Published: 2017-08-29
Description: IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113935.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22006441; http://www.securityfocus.com/bid/100572; https://exchange.xforce.ibmcloud.com/vulnerabilities/113935
CVE: CVE-2016-2976
Published: 2017-08-29
Description: IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the meeting report history. IBM X-Force ID: 113936.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006441; http://www.securityfocus.com/bid/100572; https://exchange.xforce.ibmcloud.com/vulnerabilities/113936
CVE: CVE-2016-2978
Published: 2017-08-29
Description: IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local user. IBM X-Force ID: 113938.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22006441; http://www.securityfocus.com/bid/100572; https://exchange.xforce.ibmcloud.com/vulnerabilities/113938
CVE: CVE-2016-2980
Published: 2017-08-29
Description: The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM X-Force ID: 113993.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74
References: http://www.ibm.com/support/docview.wss?uid=swg22006447; http://www.securityfocus.com/bid/100531; https://exchange.xforce.ibmcloud.com/vulnerabilities/113993
CVE: CVE-2017-1195
Published: 2017-08-29
Description: IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 123670.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=swg22007160; https://exchange.xforce.ibmcloud.com/vulnerabilities/123670; http://www.ibm.com/support/docview.wss?uid=swg22007160
CVE: CVE-2017-1427
Published: 2017-08-29
Description: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127579.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22007242; https://exchange.xforce.ibmcloud.com/vulnerabilities/127579; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-1428
Published: 2017-08-29
Description: IBM Cognos Analytics 11.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 127583.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://www.ibm.com/support/docview.wss?uid=swg22007242; https://exchange.xforce.ibmcloud.com/vulnerabilities/127583; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-1485
Published: 2017-08-29
Description: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128623.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22007242; https://exchange.xforce.ibmcloud.com/vulnerabilities/128623; http://www.ibm.com/support/docview.wss?uid=swg22007242
CVE: CVE-2017-1535
Published: 2017-08-29
Description: IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130677.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22007242; http://www.securityfocus.com/bid/100834; https://exchange.xforce.ibmcloud.com/vulnerabilities/130677
CVE: CVE-2017-0379
Published: 2017-08-29
Description: Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/100503; http://www.securitytracker.com/id/1041294
CVE: CVE-2017-13755
Published: 2017-08-29
Description: In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/sleuthkit/sleuthkit/issues/913; https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html; https://github.com/sleuthkit/sleuthkit/issues/913
CVE: CVE-2017-13756
Published: 2017-08-29
Description: In The Sleuth Kit (TSK) 4.4.2, opening a crafted disk image triggers infinite recursion in dos_load_ext_table() in tsk/vs/dos.c in libtskvs.a, as demonstrated by mmls.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/sleuthkit/sleuthkit/issues/914; https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html; https://github.com/sleuthkit/sleuthkit/issues/914
CVE: CVE-2017-13757
Published: 2017-08-29
Description: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100532; https://sourceware.org/bugzilla/show_bug.cgi?id=22018; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=90efb6422939ca031804266fba669f77c22a274a