deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12667
Published: 2017-08-07
Description: ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMATImage in coders\mat.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/commit/bfb7915d4b2e11acb6a819e451c382dc645277db; https://github.com/ImageMagick/ImageMagick/issues/553; https://github.com/ImageMagick/ImageMagick/commit/bfb7915d4b2e11acb6a819e451c382dc645277db
CVE: CVE-2017-12668
Published: 2017-08-07
Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/commit/2ba8f335fa06daf1165e[PII_REDACTED]028e633a74; https://github.com/ImageMagick/ImageMagick/issues/575; https://github.com/ImageMagick/ImageMagick/commit/2ba8f335fa06daf1165e[PII_REDACTED]028e633a74
CVE: CVE-2017-12669
Published: 2017-08-07
Description: ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/commit/73b6c35cede48ccb2e29dbe62c2d77488e5e70b7; https://github.com/ImageMagick/ImageMagick/issues/571; https://github.com/ImageMagick/ImageMagick/commit/73b6c35cede48ccb2e29dbe62c2d77488e5e70b7
CVE: CVE-2017-12670
Published: 2017-08-07
Description: In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to an assertion failure in the function DestroyImage in MagickCore/image.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-617
References: http://www.securityfocus.com/bid/100252; https://github.com/ImageMagick/ImageMagick/issues/610; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html
CVE: CVE-2017-12671
Published: 2017-08-07
Description: In ImageMagick 7.0.6-3, a missing NULL assignment was found in coders/png.c, leading to an invalid free in the function RelinquishMagickMemory in MagickCore/memory.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/ImageMagick/ImageMagick/issues/621; https://www.debian.org/security/2017/dsa-4019; https://github.com/ImageMagick/ImageMagick/issues/621
CVE: CVE-2017-12672
Published: 2017-08-07
Description: In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100224; https://github.com/ImageMagick/ImageMagick/issues/617; http://www.securityfocus.com/bid/100224
CVE: CVE-2017-12673
Published: 2017-08-07
Description: In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100228; https://github.com/ImageMagick/ImageMagick/issues/619; http://www.securityfocus.com/bid/100228
CVE: CVE-2017-12674
Published: 2017-08-07
Description: In ImageMagick 7.0.6-2, a CPU exhaustion vulnerability was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-834
References: https://github.com/ImageMagick/ImageMagick/issues/604; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE: CVE-2017-12675
Published: 2017-08-07
Description: In ImageMagick 7.0.6-3, a missing check for multidimensional data was found in coders/mat.c, leading to a memory leak in the function ReadImage in MagickCore/constitute.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/616; https://github.com/ImageMagick/ImageMagick/issues/616
CVE: CVE-2017-12676
Published: 2017-08-07
Description: In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-772
References: http://www.securityfocus.com/bid/100225; https://github.com/ImageMagick/ImageMagick/issues/618; http://www.securityfocus.com/bid/100225
CVE: CVE-2017-6866
Published: 2017-08-07
Description: A vulnerability was discovered in Siemens XHQ server 4 and 5 (4 before V4.7.1.3 and 5 before V5.0.0.2) that could allow an authenticated low-privileged remote user to gain read access to data in the XHQ solution exceeding his configured permission level.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/99247; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-945660.pdf; http://www.securityfocus.com/bid/99247
CVE: CVE-2017-6869
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload arbitrary code and execute it with the permissions of the operating-system user running the web server by sending specially crafted network packets to port 443/TCP or port 80/TCP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/99343; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-545214.pdf; http://www.securityfocus.com/bid/99343
CVE: CVE-2017-6870
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2). The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a Man-in-the-Middle (MitM) attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-300
References: http://www.securityfocus.com/bid/99582; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf; http://www.securityfocus.com/bid/99582
CVE: CVE-2017-6871
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (All versions before V1.0.2.2). An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass the app's authentication mechanism under certain conditions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-288, CWE-287
References: http://www.securityfocus.com/bid/99582; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf; http://www.securityfocus.com/bid/99582
CVE: CVE-2017-6872
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker with access to port 21/tcp to access or alter historical measurement data stored on the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-668
References: http://www.securityfocus.com/bid/99473; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-563539.pdf; http://www.securityfocus.com/bid/99473
CVE: CVE-2017-6873
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack on the integrated web server on port 443/tcp.
CVSS Score: 7.4 (HIGH)
CWE: CWE-306
References: http://www.securityfocus.com/bid/99473; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-563539.pdf; http://www.securityfocus.com/bid/99473
CVE: CVE-2017-9938
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens SIMATIC Logon (All versions before V1.6) that could allow specially crafted packets sent to the SIMATIC Logon Remote Access service on port 16389/tcp to cause a Denial-of-Service condition. The service restarts automatically.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-20
References: http://www.securityfocus.com/bid/99539; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-804859.pdf; https://www.tenable.com/security/research/tra-2017-34
CVE: CVE-2017-9939
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with network access to the SiPass integrated server to bypass the authentication mechanism and perform administrative operations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/99578; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf; http://www.securityfocus.com/bid/99578
CVE: CVE-2017-9940
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with access to a low-privileged user account to read or write files on the file system of the SiPass integrated server over the network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269, CWE-269
References: http://www.securityfocus.com/bid/99578; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf; http://www.securityfocus.com/bid/99578
CVE: CVE-2017-9941
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker in a Man-in-the-Middle position between the SiPass integrated server and SiPass integrated clients to read or modify the network communication.
CVSS Score: 7.4 (HIGH)
CWE: CWE-300
References: http://www.securityfocus.com/bid/99578; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf; http://www.securityfocus.com/bid/99578
CVE: CVE-2017-9942
Published: 2017-08-08
Description: A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated server or SiPass integrated client to potentially obtain credentials from the systems.
CVSS Score: 7.8 (HIGH)
CWE: CWE-257
References: http://www.securityfocus.com/bid/99578; https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-339433.pdf; http://www.securityfocus.com/bid/99578
CVE: CVE-2017-12677
Published: 2017-08-08
Description: IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/IdentityServer/IdentityServer3/releases/tag/2.6.1; https://github.com/IdentityServer/IdentityServer3/releases/tag/2.6.1
CVE: CVE-2017-12678
Published: 2017-08-08
Description: In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/taglib/taglib/commit/cb9f07d9dcd791b63e622da43f7b232adaec0a9a; https://github.com/taglib/taglib/issues/829; https://github.com/taglib/taglib/pull/831
CVE: CVE-2017-10000
Published: 2017-08-08
Description: Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications (subcomponent: Reporting). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. While the vulnerability is in Oracle Hospitality Reporting and Analytics, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).
CVSS Score: 7.7 (HIGH)
CWE: CWE-269
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securitytracker.com/id/1038941; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2017-10001
Published: 2017-08-08
Description: Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Core). The supported version that is affected is 1.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Simphony First Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony First Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Simphony First Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony First Edition. CVSS 3.0 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H).
CVSS Score: 7.6 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securitytracker.com/id/1038941; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2017-10002
Published: 2017-08-08
Description: Vulnerability in the Oracle Hospitality Inventory Management component of Oracle Hospitality Applications (subcomponent: Settings and Config). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Inventory Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Inventory Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Inventory Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99699; http://www.securitytracker.com/id/1038941
CVE: CVE-2017-10003
Published: 2017-08-08
Description: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Network Services Library). The supported version that is affected is 10. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 4.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVSS Score: 4.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99848; http://www.securitytracker.com/id/1038938
CVE: CVE-2017-10004
Published: 2017-08-08
Description: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 6.7 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99843; http://www.securitytracker.com/id/1038938
CVE: CVE-2017-10005
Published: 2017-08-08
Description: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99766; http://www.securitytracker.com/id/1038934
CVE: CVE-2017-10006
Published: 2017-08-08
Description: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99716; http://www.securitytracker.com/id/1038934
CVE: CVE-2017-10007
Published: 2017-08-08
Description: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99812; http://www.securitytracker.com/id/1038934
CVE: CVE-2017-10008
Published: 2017-08-08
Description: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/100266; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2017-10009
Published: 2017-08-08
Description: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99792; http://www.securitytracker.com/id/1038934
CVE: CVE-2017-10010
Published: 2017-08-08
Description: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: FileUploads). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
CVSS Score: 4.6 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99829; http://www.securitytracker.com/id/1038934
CVE: CVE-2017-10011
Published: 2017-08-08
Description: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle FLEXCUBE Private Banking executes to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 5.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99675; http://www.securitytracker.com/id/1038934
CVE: CVE-2017-10012
Published: 2017-08-08
Description: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/99862; http://www.securitytracker.com/id/1038934