deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-0775
Published: 2017-09-08
Description: A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673179.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-834
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0776
Published: 2017-09-08
Description: A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38496660.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0777
Published: 2017-09-08
Description: A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-38342499.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0778
Published: 2017-09-08
Description: A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-62133227.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0779
Published: 2017-09-08
Description: A information disclosure vulnerability in the Android media framework (audioflinger). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38340117.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100649; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100649
CVE: CVE-2017-0780
Published: 2017-09-08
Description: A denial of service vulnerability in the Android runtime (android messenger). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37742976.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/100674; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100674
CVE: CVE-2017-0784
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Android system (nfc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37287958.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/100671; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100671
CVE: CVE-2017-0786
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37351060. References: B-V[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/100655; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100655
CVE: CVE-2017-0787
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37722970. References: B-V[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/100655; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100655
CVE: CVE-2017-0788
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37722328. References: B-V[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/100655; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100655
CVE: CVE-2017-0789
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37685267. References: B-V[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/100655; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100655
CVE: CVE-2017-0790
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37357704. References: B-V[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/100655; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100655
CVE: CVE-2017-0791
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37306719. References: B-V[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/100655; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100655
CVE: CVE-2017-0792
Published: 2017-09-08
Description: A information disclosure vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37305578. References: B-V[PII_REDACTED].
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100655; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100655
CVE: CVE-2017-0793
Published: 2017-09-08
Description: A information disclosure vulnerability in the N/A memory subsystem. Product: Android. Versions: Android kernel. Android ID: A-35764946.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100670; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100670
CVE: CVE-2017-0794
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the Upstream kernel scsi driver. Product: Android. Versions: Android kernel. Android ID: A-35644812.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/100667; https://source.android.com/security/bulletin/2017-09-01; https://usn.ubuntu.com/3798-1/
CVE: CVE-2017-0795
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek accessory detector driver. Product: Android. Versions: Android kernel. Android ID: A-36198473. References: M-ALPS03361480.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0796
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek auxadc driver. Product: Android. Versions: Android kernel. Android ID: A-62458865. References: M-ALPS03353884, M-ALPS03353886, M-ALPS03353887.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0797
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek accessory detector driver. Product: Android. Versions: Android kernel. Android ID: A-62459766. References: M-ALPS03353854.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0798
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek kernel. Product: Android. Versions: Android kernel. Android ID: A-36100671. References: M-ALPS03365532.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0799
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek lastbus. Product: Android. Versions: Android kernel. Android ID: A-36731602. References: M-ALPS03342072.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0800
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek teei. Product: Android. Versions: Android kernel. Android ID: A-37683975. References: M-ALPS03302988.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0801
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek libmtkomxvdec. Product: Android. Versions: Android kernel. Android ID: A-38447970. References: M-ALPS03337980.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0802
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek kernel. Product: Android. Versions: Android kernel. Android ID: A-36232120. References: M-ALPS03384818.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0803
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek accessory detector driver. Product: Android. Versions: Android kernel. Android ID: A-36136137. References: M-ALPS03361477.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-0804
Published: 2017-09-08
Description: A elevation of privilege vulnerability in the MediaTek mmc driver. Product: Android. Versions: Android kernel. Android ID: A-36274676. References: M-ALPS03361487.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/100652; https://source.android.com/security/bulletin/2017-09-01; http://www.securityfocus.com/bid/100652
CVE: CVE-2017-12699
Published: 2017-09-09
Description: An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or modify original application files with malicious ones.
CVSS Score: 7.1 (HIGH)
CWE: CWE-276, CWE-276
References: http://www.securityfocus.com/bid/100522; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-01; http://www.securityfocus.com/bid/100522
CVE: CVE-2017-12731
Published: 2017-09-09
Description: A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older than V175, V175-V189, V191-V195, and V16Q3.1. The application is vulnerable to injection of malicious SQL queries via the input from the client.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/100563; https://ics-cert.us-cert.gov/advisories/ICSA-17-243-04; http://www.securityfocus.com/bid/100563
CVE: CVE-2017-12733
Published: 2017-09-09
Description: A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older than V175, V175-V189, V191-V195, and V16Q3.1. An attacker may create an application user account to gain administrative privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://www.securityfocus.com/bid/100563; https://ics-cert.us-cert.gov/advisories/ICSA-17-243-04; http://www.securityfocus.com/bid/100563
CVE: CVE-2017-14222
Published: 2017-09-09
Description: In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "item_count" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: http://www.debian.org/security/2017/dsa-3996; http://www.securityfocus.com/bid/100701; https://github.com/FFmpeg/FFmpeg/commit/9cb4eb772839c5e1de2855d126bf74ff16d13382
CVE: CVE-2017-14223
Published: 2017-09-09
Description: In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.debian.org/security/2017/dsa-3996; http://www.securityfocus.com/bid/100703; https://github.com/FFmpeg/FFmpeg/commit/afc9c683ed9db01edb357bc8c19edad4282b3a97
CVE: CVE-2017-14224
Published: 2017-09-09
Description: A heap-based buffer overflow in WritePCXImage in coders/pcx.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service or code execution via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100702; https://github.com/ImageMagick/ImageMagick/issues/733; https://security.gentoo.org/glsa/201711-07
CVE: CVE-2017-5147
Published: 2017-09-09
Description: An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1. An uncontrolled search path element vulnerability has been identified, which may execute malicious DLL files that have been placed within the search path.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-427, CWE-427
References: http://www.securityfocus.com/bid/100522; https://ics-cert.us-cert.gov/advisories/ICSA-17-241-01; http://www.securityfocus.com/bid/100522
CVE: CVE-2017-8040
Published: 2017-09-09
Description: In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/100617; https://pivotal.io/security/cve-2017-8040; http://www.securityfocus.com/bid/100617
CVE: CVE-2017-8041
Published: 2017-09-09
Description: In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain Single Sign-On service UI pages by inputting code in the text field for an organization name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100615; https://pivotal.io/security/cve-2017-8041; http://www.securityfocus.com/bid/100615
CVE: CVE-2017-14225
Published: 2017-09-09
Description: The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://www.debian.org/security/2017/dsa-3996; http://www.securityfocus.com/bid/100704; https://github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61d75d2
CVE: CVE-2017-14226
Published: 2017-09-09
Description: WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.documentfoundation.org/show_bug.cgi?id=112269; https://bugzilla.redhat.com/show_bug.cgi?id=1489337; https://cgit.freedesktop.org/libreoffice/core/commit/?id=dd89afa6ee8166b69e7a1e86f22616ca8fc122c9
CVE: CVE-2017-14227
Published: 2017-09-09
Description: In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100825; https://bugzilla.redhat.com/show_bug.cgi?id=1489355; https://bugzilla.redhat.com/show_bug.cgi?id=1489356
CVE: CVE-2017-14228
Published: 2017-09-09
Description: In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392423; https://security.gentoo.org/glsa/201903-19; https://usn.ubuntu.com/3694-1/
CVE: CVE-2017-14229
Published: 2017-09-09
Description: There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13. It will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/100861; https://github.com/mdadams/jasper/issues/146; https://security.gentoo.org/glsa/201908-03
CVE: CVE-2017-14230
Published: 2017-09-10
Description: In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obtain sensitive information or cause a denial of service (daemon crash) via a 'LIST "" "Other Users"' command.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://github.com/cyrusimap/cyrus-imapd/commit/6bd33275368edfa71ae117de[PII_REDACTED]78ac79; https://github.com/cyrusimap/cyrus-imapd/issues/2132; https://lists.andrew.cmu.edu/pipermail/cyrus-announce/2017-September/000145.html
CVE: CVE-2017-14231
Published: 2017-09-10
Description: GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service (account blockage) by leveraging the mishandling of certain username substring relationships, such as the admin<script> username versus the admin username, related to register.php, User.class.php, and Type.class.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/semplon/GeniXCMS/issues/78; https://github.com/semplon/GeniXCMS/releases/tag/v1.1.0; https://github.com/semplon/GeniXCMS/issues/78
CVE: CVE-2017-14238
Published: 2017-09-11
Description: SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548; https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548
CVE: CVE-2017-14239
Published: 2017-09-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548; https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548
CVE: CVE-2017-14240
Published: 2017-09-11
Description: There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548; https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548
CVE: CVE-2017-14241
Published: 2017-09-11
Description: Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548; https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548
CVE: CVE-2017-14242
Published: 2017-09-11
Description: SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Dolibarr/dolibarr/commit/33e2179b65331d9d9179b59d746817c5be1fecdb; https://github.com/Dolibarr/dolibarr/commit/33e2179b65331d9d9179b59d746817c5be1fecdb
CVE: CVE-2017-14247
Published: 2017-09-11
Description: SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user_id cookie to header.php, a related issue to CVE-2[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.sstrunk.com/cve/eonweb_Translator.class.html; http://www.sstrunk.com/cve/eonweb_Translator.class.html
CVE: CVE-2017-14248
Published: 2017-09-11
Description: A heap-based buffer over-read in SampleImage() in MagickCore/resize.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/717; https://security.gentoo.org/glsa/201711-07; https://github.com/ImageMagick/ImageMagick/issues/717
CVE: CVE-2017-14249
Published: 2017-09-11
Description: ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelCacheTileSize in MagickCore/cache.c, allowing remote attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/ImageMagick/ImageMagick/issues/708; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE: CVE-2017-14251
Published: 2017-09-11
Description: Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://blog.emaze.net/2017/12/typo3-unrestricted-file-upload-remote.html; http://www.securityfocus.com/bid/100620; http://www.securitytracker.com/id/1039295
CVE: CVE-2017-14252
Published: 2017-09-11
Description: SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.sstrunk.com/cve/eonweb_side.md; http://www.sstrunk.com/cve/eonweb_side.md
CVE: CVE-2017-14257
Published: 2017-09-11
Description: In the SDK in Bento4 1.5.0-616, AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp contains a Read Memory Access Violation vulnerability. It is possible to exploit this vulnerability by opening a crafted .MP4 file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/axiomatic-systems/Bento4/issues/181; https://github.com/axiomatic-systems/Bento4/issues/181