deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-13141
Published: 2017-08-23
Description: In ImageMagick before 6.9.9-4 and 7.x before 7.0.6-4, a crafted file could trigger a memory leak in ReadOnePNGImage in coders/png.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870116; https://github.com/ImageMagick/ImageMagick/issues/600; https://security.gentoo.org/glsa/201711-07
CVE: CVE-2017-13142
Published: 2017-08-23
Description: In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an insufficient check for short files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870105; https://github.com/ImageMagick/ImageMagick/commit/46e3aabbf8d59a1bdebdbb65acb9b9e0484577d3; https://github.com/ImageMagick/ImageMagick/commit/aa84944b405acebbeefe871d0f64969b9e9f31ac
CVE: CVE-2017-13143
Published: 2017-08-23
Description: In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870012; https://github.com/ImageMagick/ImageMagick/commit/51b0ae01709adc1e4a9245e158ef17b85a110960; https://github.com/ImageMagick/ImageMagick/issues/362
CVE: CVE-2017-13144
Published: 2017-08-23
Description: In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the image dimensions are too large, as demonstrated by use of the mpc coder.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869728; https://security.gentoo.org/glsa/201711-07; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-13145
Published: 2017-08-23
Description: In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly validate the channel geometry, leading to a crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869830; https://github.com/ImageMagick/ImageMagick/commit/acee073df34aa4d491bf5cb74d3a15fc80f0a3aa; https://github.com/ImageMagick/ImageMagick/commit/f13c6b54a879aaa771ec64b5a066b939e8f8e7f0
CVE: CVE-2017-13146
Published: 2017-08-23
Description: In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870013; https://github.com/ImageMagick/ImageMagick/commit/79e5dbcdd1fc2f714f9bae548bc55d5073f3ed20; https://security.gentoo.org/glsa/201711-07
CVE: CVE-2017-11610
Published: 2017-08-23
Description: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: http://www.debian.org/security/2017/dsa-3942; https://access.redhat.com/errata/RHSA-2017:3005; https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt
CVE: CVE-2017-12791
Published: 2017-08-23
Description: Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.securityfocus.com/bid/100384; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399; https://bugzilla.redhat.com/show_bug.cgi?id=1482006
CVE: CVE-2017-12844
Published: 2017-08-23
Description: Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain administrators to inject arbitrary web script or HTML via a crafted user name.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://youtu.be/MI4dhEia1d4; https://youtu.be/MI4dhEia1d4
CVE: CVE-2017-12858
Published: 2017-08-23
Description: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://www.securityfocus.com/bid/100459; https://github.com/nih-at/libzip/commit/2217022b7d[PII_REDACTED]d891e00b3d2d9179b796; http://www.securityfocus.com/bid/100459
CVE: CVE-2017-12904
Published: 2017-08-23
Description: Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-943
References: http://www.debian.org/security/2017/dsa-3947; https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b[PII_REDACTED]307; https://github.com/akrennmair/newsbeuter/issues/591
CVE: CVE-2017-13137
Published: 2017-08-23
Description: The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/143116/WordPress-FormCraft-Basic-1.0.5-SQL-Injection.html; https://packetstormsecurity.com/files/143116/WordPress-FormCraft-Basic-1.0.5-SQL-Injection.html
CVE: CVE-2017-13138
Published: 2017-08-23
Description: DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bridge.qodeinteractive.com/change-log/; http://imgur.com/a/OT9vl; https://wpvulndb.com/vulnerabilities/8892
CVE: CVE-2015-5224
Published: 2017-08-23
Description: The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-377
References: http://www.openwall.com/lists/oss-security/2015/08/24/3; http://www.securityfocus.com/bid/76467; https://bugzilla.redhat.com/show_bug.cgi?id=1256686
CVE: CVE-2017-11159
Published: 2017-08-23
Description: Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-426
References: https://www.synology.com/en-global/support/security/Synology_SA_17_45_Photo_Station_Uploader; https://www.synology.com/en-global/support/security/Synology_SA_17_45_Photo_Station_Uploader
CVE: CVE-2017-12809
Published: 2017-08-23
Description: QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2017/dsa-3991; http://www.openwall.com/lists/oss-security/2017/08/21/2; http://www.securityfocus.com/bid/100451
CVE: CVE-2017-12965
Published: 2017-08-23
Description: Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt; http://packetstormsecurity.com/files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html; http://www.securityfocus.com/bid/100447
CVE: CVE-2017-12970
Published: 2017-08-23
Description: Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that (1) add or (2) delete user accounts via a request to phpsftpd/users.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt; http://packetstormsecurity.com/files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html; http://www.securityfocus.com/bid/100447
CVE: CVE-2017-12971
Published: 2017-08-23
Description: Cross-site scripting (XSS) vulnerability in Apache2Triad 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the account parameter to phpsftpd/users.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt; http://packetstormsecurity.com/files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html; http://www.securityfocus.com/bid/100447
CVE: CVE-2017-11317
Published: 2017-08-23
Description: Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326, CWE-326
References: http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html; http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/unrestricted-file-upload; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0006
CVE: CVE-2017-11357
Published: 2017-08-23
Description: Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference; https://www.exploit-db.com/exploits/43874/; http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference
CVE: CVE-2017-13147
Published: 2017-08-23
Description: In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://sourceforge.net/p/graphicsmagick/bugs/446/; https://usn.ubuntu.com/4206-1/; https://sourceforge.net/p/graphicsmagick/bugs/446/
CVE: CVE-2017-9506
Published: 2017-08-23
Description: The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-918
References: http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html; https://ecosystem.atlassian.net/browse/OAUTH-344; https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
CVE: CVE-2017-12847
Published: 2017-08-23
Description: Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-665
References: http://www.securityfocus.com/bid/100403; https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog; https://github.com/NagiosEnterprises/nagioscore/commit/1b197346d490df2e2d3b1dcce5ac6134ad0c8752
CVE: CVE-2017-13648
Published: 2017-08-23
Description: In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/; https://sourceforge.net/p/graphicsmagick/bugs/433/
CVE: CVE-2017-13649
Published: 2017-08-23
Description: UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command. NOTE: the vendor indicates that there is no common or recommended scenario in which a root script would execute this kill command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: http://www.securityfocus.com/bid/100507; https://bugs.unrealircd.org/view.php?id=4990; http://www.securityfocus.com/bid/100507
CVE: CVE-2017-0805
Published: 2017-08-24
Description: A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37237701.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://source.android.com/security/bulletin/2017-08-01; https://source.android.com/security/bulletin/2017-08-01
CVE: CVE-2017-13658
Published: 2017-08-24
Description: In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870019; https://github.com/ImageMagick/ImageMagick/commit/e5c063a1007506ba69e97a35effcdef944421c89; https://github.com/ImageMagick/ImageMagick/issues/598
CVE: CVE-2017-13666
Published: 2017-08-24
Description: An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.5, as used in libbpg and other products. A small height value can cause an integer underflow, which leads to a crash. This is a different vulnerability than CVE-2017-8906.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://bitbucket.org/multicoreware/x265/issues/364/integer-overflow-and-affect-top-level; https://bitbucket.org/multicoreware/x265/issues/364/integer-overflow-and-affect-top-level
CVE: CVE-2017-12134
Published: 2017-08-24
Description: The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682
References: http://www.debian.org/security/2017/dsa-3981; http://www.openwall.com/lists/oss-security/2017/08/15/4; http://www.securityfocus.com/bid/100343
CVE: CVE-2017-12135
Published: 2017-08-24
Description: Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors involving transitive grants.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682
References: http://www.debian.org/security/2017/dsa-3969; http://www.openwall.com/lists/oss-security/2017/08/15/1; http://www.openwall.com/lists/oss-security/2017/08/17/6
CVE: CVE-2017-12136
Published: 2017-08-24
Description: Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free list corruption and host crash) or gain privileges on the host via vectors involving maptrack free list handling.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://www.debian.org/security/2017/dsa-3969; http://www.openwall.com/lists/oss-security/2017/08/15/3; http://www.securityfocus.com/bid/100346
CVE: CVE-2017-12137
Published: 2017-08-24
Description: arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://www.debian.org/security/2017/dsa-3969; http://www.openwall.com/lists/oss-security/2017/08/15/2; http://www.securityfocus.com/bid/100342
CVE: CVE-2017-12836
Published: 2017-08-24
Description: CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
CVSS Score: 7.5 (HIGH)
References: http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html; http://www.debian.org/security/2017/dsa-3940; http://www.openwall.com/lists/oss-security/2017/08/11/1
CVE: CVE-2017-11424
Published: 2017-08-24
Description: In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2017/dsa-3979; https://github.com/jpadilla/pyjwt/pull/277; http://www.debian.org/security/2017/dsa-3979
CVE: CVE-2017-12679
Published: 2017-08-24
Description: SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/bingtanguan/cve/blob/master/201701; https://github.com/bingtanguan/cve/blob/master/201701
CVE: CVE-2017-13669
Published: 2017-08-24
Description: SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/bingtanguan/cve/blob/master/201701; https://github.com/bingtanguan/cve/blob/master/201701
CVE: CVE-2017-9507
Published: 2017-08-24
Description: The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CRUC-8043; https://jira.atlassian.com/browse/CRUC-8043
CVE: CVE-2017-9508
Published: 2017-08-24
Description: Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CRUC-8044; https://jira.atlassian.com/browse/FE-6898; https://jira.atlassian.com/browse/CRUC-8044
CVE: CVE-2017-9509
Published: 2017-08-24
Description: The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CRUC-8046; https://jira.atlassian.com/browse/CRUC-8046
CVE: CVE-2017-9510
Published: 2017-08-24
Description: The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/FE-6890; https://jira.atlassian.com/browse/FE-6890
CVE: CVE-2017-9512
Published: 2017-08-24
Description: The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://jira.atlassian.com/browse/CRUC-8053; https://jira.atlassian.com/browse/FE-6892; https://jira.atlassian.com/browse/CRUC-8053
CVE: CVE-2017-12074
Published: 2017-08-24
Description: Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domain_name parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.synology.com/en-global/support/security/Synology_SA_17_46_DNS_Server; https://www.synology.com/en-global/support/security/Synology_SA_17_46_DNS_Server
CVE: CVE-2017-9511
Published: 2017-08-24
Description: The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://jira.atlassian.com/browse/CRUC-8049; https://jira.atlassian.com/browse/FE-6891; https://jira.atlassian.com/browse/CRUC-8049
CVE: CVE-2017-12879
Published: 2017-08-24
Description: Cross-site scripting (XSS-STORED) vulnerability in the DEVICES OR SENSORS functionality in Paessler PRTG Network Monitor before 17.3.33.2654 allows authenticated remote attackers to inject arbitrary web script or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/open?id=0B6WbMqXSfqQFODZHUGtLdzU3eDA; https://www.paessler.com/prtg/history/preview; https://www.paessler.com/prtg/history/stable
CVE: CVE-2017-13671
Published: 2017-08-24
Description: app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100533; https://github.com/MISP/MISP/commit/6eba658d4a648b41b357025d864c19a67412b8aa; http://www.securityfocus.com/bid/100533
CVE: CVE-2017-9555
Published: 2017-08-24
Description: Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.synology.com/en-global/support/security/Synology_SA_17_47_Photo_Station; https://www.synology.com/en-global/support/security/Synology_SA_17_47_Photo_Station
CVE: CVE-2014-4616
Published: 2017-08-24
Description: Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-129
References: http://bugs.python.org/issue21529; http://lists.opensuse.org/opensuse-updates/2014-07/msg00015.html; http://openwall.com/lists/oss-security/2014/06/24/7
CVE: CVE-2015-1800
Published: 2017-08-24
Description: The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/09/21/13; http://www.openwall.com/lists/oss-security/2015/09/21/4; http://www.openwall.com/lists/oss-security/2015/09/22/18
CVE: CVE-2015-1801
Published: 2017-08-24
Description: The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a denial of service (memory corruption) or gain privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/09/21/13; http://www.openwall.com/lists/oss-security/2015/09/21/4; http://www.securityfocus.com/bid/76807