deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8642
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100046; http://www.securitytracker.com/id/1039101; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8642
CVE: CVE-2017-8644
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8652 and CVE-2017-8662.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100044; http://www.securitytracker.com/id/1039101; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8644
CVE: CVE-2017-8645
Published: 2017-08-08
Description: Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100052; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8645
CVE: CVE-2017-8646
Published: 2017-08-08
Description: Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100053; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8646
CVE: CVE-2017-8647
Published: 2017-08-08
Description: Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100054; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8647
CVE: CVE-2017-8650
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to exploit a security feature bypass due to Microsoft Edge not properly enforcing same-origin policies, aka "Microsoft Edge Security Feature Bypass Vulnerability".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-346
References: http://www.securityfocus.com/bid/100048; http://www.securitytracker.com/id/1039101; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8650
CVE: CVE-2017-8651
Published: 2017-08-08
Description: Internet Explorer in Microsoft Windows Server 2008 SP2 and Windows Server 2012 allows an attacker to execute arbitrary code in the context of the current user due to Internet Explorer improperly accessing objects in memory, aka "Internet Explorer Memory Corruption Vulnerability".
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100058; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8651; http://www.securityfocus.com/bid/100058
CVE: CVE-2017-8652
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8644 and CVE-2017-8662.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100047; http://www.securitytracker.com/id/1039101; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8652
CVE: CVE-2017-8653
Published: 2017-08-08
Description: Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to Microsoft browsers improperly accessing objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8669.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100059; http://www.securitytracker.com/id/1039094; http://www.securitytracker.com/id/1039095
CVE: CVE-2017-8654
Published: 2017-08-08
Description: Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting (XSS) vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100064; http://www.securitytracker.com/id/1039111; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8654
CVE: CVE-2017-8655
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100027; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8655
CVE: CVE-2017-8656
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100033; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8656
CVE: CVE-2017-8657
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100035; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8657
CVE: CVE-2017-8659
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka "Scripting Engine Information Disclosure Vulnerability".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100029; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8659
CVE: CVE-2017-8661
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability".
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100037; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8661; http://www.securityfocus.com/bid/100037
CVE: CVE-2017-8662
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to disclose information due to how strings are validated in specific scenarios, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8644 and CVE-2017-8652.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100031; http://www.securitytracker.com/id/1039101; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8662
CVE: CVE-2017-8664
Published: 2017-08-08
Description: Windows Hyper-V in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability".
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100085; http://www.securitytracker.com/id/1039093; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8664
CVE: CVE-2017-8666
Published: 2017-08-08
Description: Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly handle objects in memory, aka "Win32k Information Disclosure Vulnerability".
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100089; http://www.securitytracker.com/id/1039105; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8666
CVE: CVE-2017-8668
Published: 2017-08-08
Description: The Volume Manager Extension Driver in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2 allows an attacker to run a specially crafted application and obtain kernel information, aka "Volume Manager Extension Driver Information Disclosure Vulnerability".
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100092; http://www.securitytracker.com/id/1039108; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8668
CVE: CVE-2017-8669
Published: 2017-08-08
Description: Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to Microsoft browsers improperly handling objects in memory while rendering content, aka "Microsoft Browser Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8653.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100068; http://www.securitytracker.com/id/1039094; http://www.securitytracker.com/id/1039095
CVE: CVE-2017-8670
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100070; http://www.securitytracker.com/id/1039094; http://www.securitytracker.com/id/1039095
CVE: CVE-2017-8671
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8672, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100071; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8671
CVE: CVE-2017-8672
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, and CVE-2017-8674.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100072; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8672
CVE: CVE-2017-8673
Published: 2017-08-08
Description: The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 10 1703 allows an attacker to connect to a target system using RDP and send specially crafted requests, aka "Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability."
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/100079; http://www.securitytracker.com/id/1039107; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8673
CVE: CVE-2017-8674
Published: 2017-08-08
Description: Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, and CVE-2017-8672.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100081; http://www.securitytracker.com/id/1039095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8674
CVE: CVE-2017-8691
Published: 2017-08-08
Description: Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow an attacker to execute code remotely on a target system when the Windows font library fails to properly handle specially crafted embedded fonts, aka "Express Compressed Fonts Remote Code Execution Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100090; http://www.securitytracker.com/id/1039096; https://fortiguard.com/zeroday/FG-VD-17-142
CVE: CVE-2017-11506
Published: 2017-08-09
Description: When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://www.securitytracker.com/id/1039141; https://www.tenable.com/security/tns-2017-11; http://www.securitytracker.com/id/1039141
CVE: CVE-2016-5716
Published: 2017-08-09
Description: The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: https://puppet.com/security/cve/pe-console-oct-2016; https://puppet.com/security/cve/pe-console-oct-2016
CVE: CVE-2017-5694
Published: 2017-08-09
Description: Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P, PSF109P allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00078&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00078&languageid=en-fr
CVE: CVE-2017-5695
Published: 2017-08-09
Description: Data corruption vulnerability in firmware in Intel Solid-State Drive Consumer, Professional, Embedded, Data Center affected firmware versions LSBG200, LSF031C, LSF036C, LBF010C, LSBG100, LSF031C, LSF036C, LBF010C, LSF031P, LSF036P, LBF010P, LSF031P, LSF036P, LBF010P, LSMG200, LSF031E, LSF036E, LSMG100, LSF031E, LSF036E, LSDG200, LSF031D, LSF036D allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://support.lenovo.com/us/en/solutions/LEN-26626; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00079&languageid=en-fr; http://support.lenovo.com/us/en/solutions/LEN-26626
CVE: CVE-2017-12754
Published: 2017-08-09
Description: Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67_0RT-AC5300 and earlier for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to execute arbitrary code on the router by sending a crafted http GET request packet that includes a long delete_offline_client parameter in the url.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://asuswrt.lostrealm.ca/changelog; https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/Asus_DeleteOfflineClientOverflow.txt; https://asuswrt.lostrealm.ca/changelog
CVE: CVE-2015-3405
Published: 2017-08-09
Description: ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.html
CVE: CVE-2015-4165
Published: 2017-08-09
Description: The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/132234/Elasticsearch-1.5.2-File-Creation.html; http://www.securityfocus.com/archive/1/535727/100/0/threaded; http://www.securityfocus.com/archive/1/536855/100/0/threaded
CVE: CVE-2015-5619
Published: 2017-08-09
Description: Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html; http://www.securityfocus.com/archive/1/536294/100/0/threaded; http://www.securityfocus.com/archive/1/536858/100/0/threaded
CVE: CVE-2015-6941
Published: 2017-08-09
Description: win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-534
References: https://bugzilla.redhat.com/show_bug.cgi?id=1273066; https://docs.saltstack.com/en/latest/topics/releases/2015.5.6.html; https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html
CVE: CVE-2015-7764
Published: 2017-08-09
Description: Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: http://www.openwall.com/lists/oss-security/2015/10/20/3; https://github.com/Netflix/lemur/issues/117; https://github.com/kvesteri/sqlalchemy-utils/issues/166
CVE: CVE-2017-9370
Published: 2017-08-09
Description: An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker who has legitimate access to BlackBerry Workspaces to gain access to another user's workspace by making multiple login requests to the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000045350; http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000045350
CVE: CVE-2012-2771
Published: 2017-08-09
Description: Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2773, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781.
CVSS Score: 9.8 (CRITICAL)
References: https://www.ffmpeg.org/security.html; https://www.ffmpeg.org/security.html