deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12912
Published: 2017-09-07
Description: The "mpglibDBL/layer3.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a read access violation when opening a crafted MP3 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://drive.google.com/open?id=0B9DojFnTUSNGeS1hZlJkeGVkYlU; https://drive.google.com/open?id=0B9DojFnTUSNGeS1hZlJkeGVkYlU
CVE: CVE-2017-14147
Published: 2017-09-07
Description: An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply browsing to the link http://[Default-Router-IP]/restoreinfo.cgi & execute it. Due to improper authentication on this page, the software accepts the request hence allowing attacker to reset the router to its default configurations which later could allow attacker to login to router by using default username/password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/144022/FiberHome-Unauthenticated-ADSL-Router-Factory-Reset.html; https://beefaaubee09.github.io/fiberhome-adsls-dos/; https://www.exploit-db.com/exploits/42649/
CVE: CVE-2017-9779
Published: 2017-09-07
Description: OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact."
CVSS Score: 7.8 (HIGH)
References: https://caml.inria.fr/mantis/view.php?id=7557; https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html; https://caml.inria.fr/mantis/view.php?id=7557
CVE: CVE-2017-9834
Published: 2017-09-07
Description: SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpvulndb.com/vulnerabilities/8897; https://www.exploit-db.com/exploits/42291/; https://wpvulndb.com/vulnerabilities/8897
CVE: CVE-2013-7428
Published: 2017-09-07
Description: The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://seclists.org/fulldisclosure/2013/Jul/158; http://www.mapsplugin.com/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.html; http://www.openwall.com/lists/oss-security/2015/02/26/11
CVE: CVE-2017-1098
Published: 2017-09-07
Description: IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120658.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005824; https://exchange.xforce.ibmcloud.com/vulnerabilities/120658; http://www.ibm.com/support/docview.wss?uid=swg22005824
CVE: CVE-2017-1189
Published: 2017-09-07
Description: IBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123558.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22008028; http://www.securityfocus.com/bid/100699; http://www.securitytracker.com/id/1039268
CVE: CVE-2017-14181
Published: 2017-09-07
Description: DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x[PII_REDACTED]30, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/; https://github.com/teknoraver/aacplusenc/issues/1; https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/
CVE: CVE-2017-1502
Published: 2017-09-07
Description: IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129577.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22006941; https://exchange.xforce.ibmcloud.com/vulnerabilities/129577; http://www.ibm.com/support/docview.wss?uid=swg22006941
CVE: CVE-2017-14192
Published: 2017-09-07
Description: The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity; http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity
CVE: CVE-2017-14193
Published: 2017-09-07
Description: The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity; http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity
CVE: CVE-2017-14194
Published: 2017-09-07
Description: The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity; http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity
CVE: CVE-2017-14195
Published: 2017-09-07
Description: The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity; http://bendawang.site/article/finecms-V5.0.11-multi-vulnerablity
CVE: CVE-2014-9565
Published: 2017-09-07
Description: Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000 and earlier.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/74930; https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5098173; http://www.securityfocus.com/bid/74930
CVE: CVE-2015-3169
Published: 2017-09-07
Description: Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/05/14/3; http://www.securityfocus.com/bid/74689; https://bugzilla.redhat.com/show_bug.cgi?id=1221616
CVE: CVE-2015-3222
Published: 2017-09-07
Description: syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/132281/OSSEC-2.8.1-Local-Root-Escalation.html; http://www.openwall.com/lists/oss-security/2015/06/11/1; http://www.securityfocus.com/bid/75148
CVE: CVE-2015-3313
Published: 2017-09-07
Description: SQL injection vulnerability in WordPress Community Events plugin before 1.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/131530/WordPress-Community-Events-1.3.5-SQL-Injection.html; http://www.openwall.com/lists/oss-security/2015/04/16/10; http://www.openwall.com/lists/oss-security/2015/05/08/3
CVE: CVE-2015-3314
Published: 2017-09-07
Description: SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/131558/WordPress-Tune-Library-1.5.4-SQL-Injection.html; http://www.openwall.com/lists/oss-security/2015/04/16/10; http://www.openwall.com/lists/oss-security/2015/05/08/3
CVE: CVE-2015-3991
Published: 2017-09-07
Description: strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164276.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164278.html; http://www.securityfocus.com/bid/76861
CVE: CVE-2015-4085
Published: 2017-09-07
Description: Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2015/05/26/3; https://github.com/ether/etherpad-lite/commit/5409eb314c4e072b9760b8d30b985fa0bb96a006; http://www.openwall.com/lists/oss-security/2015/05/26/3
CVE: CVE-2015-4619
Published: 2017-09-07
Description: Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b[PII_REDACTED]300c493735e75.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/06/16/20; http://www.securityfocus.com/bid/75216; https://github.com/denkGroot/Spina/commit/bfe44f289e336f80b[PII_REDACTED]300c493735e75
CVE: CVE-2015-4627
Published: 2017-09-07
Description: SQL injection vulnerability in Pragyan CMS 3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/delta/pragyan/issues/207; https://github.com/delta/pragyan/issues/207
CVE: CVE-2015-4629
Published: 2017-09-07
Description: Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/75194; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-441178.htm; http://www.securityfocus.com/bid/75194
CVE: CVE-2015-4697
Published: 2017-09-07
Description: Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2015/Jun/57; http://www.openwall.com/lists/oss-security/2015/06/21/5; http://www.securityfocus.com/bid/75325
CVE: CVE-2015-4721
Published: 2017-09-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://hackerone.com/reports/59661; http://hackerone.com/reports/59661
CVE: CVE-2015-4724
Published: 2017-09-07
Description: SQL injection vulnerability in Concrete5 5.7.3.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://hackerone.com/reports/59664; http://hackerone.com/reports/59664
CVE: CVE-2015-5052
Published: 2017-09-07
Description: SQL injection vulnerability in Sefrengo before 1.6.5 beta2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://forum.sefrengo.org/index.php?showtopic=3399; http://forum.sefrengo.org/index.php?showtopic=3399
CVE: CVE-2015-5060
Published: 2017-09-07
Description: Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://github.com/anchorcms/anchor-cms/issues/875; http://github.com/anchorcms/anchor-cms/issues/875
CVE: CVE-2015-7672
Published: 2017-09-07
Description: Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.0.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.27.html; https://github.com/centreon/centreon/pull/6637
CVE: CVE-2015-8079
Published: 2017-09-07
Description: qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/11/05/4; https://bugzilla.redhat.com/show_bug.cgi?id=1204795; https://codereview.qt-project.org/#/c/108936/
CVE: CVE-2017-12211
Published: 2017-09-07
Description: A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause high CPU usage or a reload of the device. The vulnerability is due to IPv6 sub block corruption. An attacker could exploit this vulnerability by polling the affected device IPv6 information. An exploit could allow the attacker to trigger high CPU usage or a reload of the device. Known Affected Releases: Denali-16.3.1. Cisco Bug IDs: CSCvb14640.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/100648; http://www.securitytracker.com/id/1039290; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb14640
CVE: CVE-2017-12212
Published: 2017-09-07
Description: A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Known Affected Releases 10.5(2). Cisco Bug IDs: CSCvf25345.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100645; http://www.securitytracker.com/id/1039277; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf25345
CVE: CVE-2017-12213
Published: 2017-09-07
Description: A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This could allow the attacker to pass traffic to the default VLAN of the affected port. The vulnerability is due to an uncaught error condition that may occur during the reassignment of the auth-default-ACL dynamic ACL to a switch port after 802.1x authentication fails. A successful exploit of this issue could allow a physically adjacent attacker to bypass 802.1x authentication and cause the affected port to fail open, allowing the attacker to pass traffic to the default VLAN of the affected switch port. Cisco Bug IDs: CSCvc72751.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/100663; http://www.securitytracker.com/id/1039284; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cat
CVE: CVE-2017-12216
Published: 2017-09-07
Description: A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files and execute remote code within the application. Cisco Bug IDs: CSCvf47946.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-611
References: http://www.securityfocus.com/bid/100664; http://www.securitytracker.com/id/1039274; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-socmin
CVE: CVE-2017-12217
Published: 2017-09-07
Description: A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture Evolution (SAE) Gateways could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation of GPRS Tunneling Protocol packet headers. An attacker could exploit this vulnerability by sending a malformed GPRS Tunneling Protocol packet to an affected device. A successful exploit could allow the attacker to cause the GTPUMGR process on an affected device to restart unexpectedly, resulting in a partial DoS condition. If the GTPUMGR process restarts, there could be a brief impact on traffic passing through the device. Cisco Bug IDs: CSCve07119.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100642; http://www.securitytracker.com/id/1039276; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-asr
CVE: CVE-2017-12218
Published: 2017-09-07
Description: A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated, remote attacker to cause an email attachment containing malware to be delivered to the end user. The vulnerability is due to the failure of AMP to scan certain EML attachments that could contain malware. An attacker could exploit this vulnerability by sending an email with a crafted EML attachment through the targeted device. A successful exploit could allow the attacker to bypass the configured ESA email message and content filtering and allow the malware to be delivered to the end user. Vulnerable Products: This vulnerability affects Cisco AsyncOS Software for Cisco ESA, both virtual and hardware appliances, that are configured with message or content filters to scan incoming email attachments on the ESA. Cisco Bug IDs: CSCuz81533.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100681; http://www.securitytracker.com/id/1039288; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-esa
CVE: CVE-2017-12220
Published: 2017-09-07
Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvc50771.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100639; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-firepower-1; http://www.securityfocus.com/bid/100639
CVE: CVE-2017-12221
Published: 2017-09-07
Description: A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the affected software. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code in the context of the affected system. Cisco Bug IDs: CSCvc38983.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/100640; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-firepower-2; http://www.securityfocus.com/bid/100640
CVE: CVE-2017-12223
Published: 2017-09-07
Description: A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an unsigned Hypervisor on an affected device and compromise the integrity of the system. The vulnerability is due to insufficient sanitization of user input. An attacker who can access an affected router via the console could exploit this vulnerability by entering ROMMON mode and modifying ROMMON variables. A successful exploit could allow the attacker to execute arbitrary code and install a malicious version of Hypervisor firmware on an affected device. Cisco Bug IDs: CSCvb44027.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/100689; http://www.securitytracker.com/id/1039275; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-isr
CVE: CVE-2017-12224
Published: 2017-09-07
Description: A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect implementation of the configuration setting Guest access via hyperlinks, which should allow the administrative user to prevent guest users from using hyperlinks to connect to meetings. An attacker could exploit this vulnerability by using a crafted hyperlink to connect to a meeting. An exploit could allow the attacker to connect directly to the meeting with a hyperlink, even though access should be denied. The attacker would still require a valid hyperlink and encoded secret identifier to be connected. Cisco Bug IDs: CSCve20873.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/100657; http://www.securitytracker.com/id/1039283; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cms
CVE: CVE-2017-12225
Published: 2017-09-07
Description: A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as part of the postauthentication session. An attacker could exploit this vulnerability by obtaining the presession token ID. An exploit could allow an attacker to hijack an existing user's session. Known Affected Releases 4.2(5). Cisco Bug IDs: CSCvf58392.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-384
References: http://www.securitytracker.com/id/1039285; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf58392; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-prime-lms
CVE: CVE-2017-12227
Published: 2017-09-07
Description: A vulnerability in the SQL database interface for Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this vulnerability by sending crafted URLs that include SQL statements. An exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data. Cisco Bug IDs: CSCvb58973.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/100653; http://www.securitytracker.com/id/1039287; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cer