deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8211
Published: 2017-11-22
Description: The driver of honor 5C,honor 6x Huawei smart phones with software of versions earlier than NEM-AL10C00B356, versions earlier than Berlin-L21HNC432B360 have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system, the APP can send a specific parameter to the driver of the smart phone, causing a system reboot or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170801-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170801-01-smartphone-en
CVE: CVE-2017-8212
Published: 2017-11-22
Description: The driver of honor 5C,honor 6x Huawei smart phones with software of versions earlier than NEM-AL10C00B356, versions earlier than Berlin-L21HNC432B360 have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system, the APP can send a specific parameter to the driver of the smart phone, causing a system reboot or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170801-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170801-01-smartphone-en
CVE: CVE-2017-8213
Published: 2017-11-22
Description: Huawei SMC2.0 with software of V100R003C10, V100R005C00SPC100, V100R005C00SPC101B001T, V100R005C00SPC102, V100R005C00SPC103, V100R005C00SPC200, V100R005C00SPC201T, V500R002C00, V600R006C00 has an input validation vulnerability when handle TLS and DTLS handshake with certificate. Due to the insufficient validation of received PKI certificates, remote attackers could exploit this vulnerability to crash the TLS module.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170705-01-tls-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170705-01-tls-en
CVE: CVE-2017-8214
Published: 2017-11-22
Description: Honor 8,Honor V8,Honor 9,Honor V9,Nova 2,Nova 2 Plus,P9,P10 Plus,Toronto Huawei smart phones with software of versions earlier than FRD-AL00C00B391, versions earlier than FRD-DL00C00B391, versions earlier than KNT-AL10C00B391, versions earlier than KNT-AL20C00B391, versions earlier than KNT-UL10C00B391, versions earlier than KNT-TL10C00B391, versions earlier than Stanford-AL00C00B175, versions earlier than Stanford-AL10C00B175, versions earlier than Stanford-TL00C01B175, versions earlier than Duke-AL20C00B191, versions earlier than Duke-TL30C01B191, versions earlier than Picasso-AL00C00B162, versions earlier than Picasso-TL00C01B162 , versions earlier than Barca-AL00C00B162, versions earlier than Barca-TL00C00B162, versions earlier than EVA-AL10C00B396SP03, versions earlier than EVA-CL00C92B396, versions earlier than EVA-DL00C17B396, versions earlier than EVA-TL00C01B396 , versions earlier than Vicky-AL00AC00B172, versions earlier than Toronto-AL00AC00B191, versions earlier than Toronto-TL10C01B191 have an unlock code verification bypassing vulnerability. An attacker with the root privilege of a mobile can exploit this vulnerability to bypass the unlock code verification and unlock the mobile phone bootloader.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170807-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170807-01-smartphone-en
CVE: CVE-2017-8215
Published: 2017-11-22
Description: Honor 8,Honor V8,Honor 9,Honor V9,Nova 2,Nova 2 Plus,P9,P10 Plus,Toronto Huawei smart phones with software of versions earlier than FRD-AL00C00B391, versions earlier than FRD-DL00C00B391, versions earlier than KNT-AL10C00B391, versions earlier than KNT-AL20C00B391, versions earlier than KNT-UL10C00B391, versions earlier than KNT-TL10C00B391, versions earlier than Stanford-AL00C00B175, versions earlier than Stanford-AL10C00B175, versions earlier than Stanford-TL00C01B175, versions earlier than Duke-AL20C00B191, versions earlier than Duke-TL30C01B191, versions earlier than Picasso-AL00C00B162, versions earlier than Picasso-TL00C01B162 , versions earlier than Barca-AL00C00B162, versions earlier than Barca-TL00C00B162, versions earlier than EVA-AL10C00B396SP03, versions earlier than EVA-CL00C92B396, versions earlier than EVA-DL00C17B396, versions earlier than EVA-TL00C01B396 , versions earlier than Vicky-AL00AC00B172, versions earlier than Toronto-AL00AC00B191, versions earlier than Toronto-TL10C01B191 have a permission control vulnerability. An attacker with the system privilege of a mobile can exploit this vulnerability to bypass the unlock code verification and unlock the mobile phone bootloader.
CVSS Score: 6.2 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170807-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170807-01-smartphone-en
CVE: CVE-2017-8216
Published: 2017-11-22
Description: Warsaw Huawei Smart phones with software of versions earlier than Warsaw-AL00C00B180, versions earlier than Warsaw-TL10C01B180 have a permission control vulnerability. Due to improper authorization on specific processes, an attacker with the root privilege of a mobile Android system can exploit this vulnerability to obtain some information of the user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170614-01-smartphone-en; http://www.securityfocus.com/bid/102190; http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170614-01-smartphone-en
CVE: CVE-2017-16879
Published: 2017-11-22
Description: Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://invisible-island.net/ncurses/NEWS.html#t20171125; http://packetstormsecurity.com/files/145045/GNU-ncurses-6.0-tic-Denial-Of-Service.html; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-7501
Published: 2017-11-22
Description: It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e[PII_REDACTED]64aae04bdc; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-16927
Published: 2017-11-23
Description: The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: https://github.com/neutrinolabs/xrdp/pull/958; https://groups.google.com/forum/#%21topic/xrdp-devel/PmVfMuy_xBA; https://lists.debian.org/debian-lts-announce/2017/12/msg00005.html
CVE: CVE-2017-15088
Published: 2017-11-23
Description: plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/101594; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871698; https://bugzilla.redhat.com/show_bug.cgi?id=1504045
CVE: CVE-2017-13698
Published: 2017-11-23
Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. An attacker could extract public and private keys from the firmware image available on the MOXA website and could use them against a production switch that has the default keys embedded.
CVSS Score: 7.5 (HIGH)
References: https://www.sentryo.net/wp-content/uploads/2017/11/Switch-Moxa-Analysis.pdf; https://www.sentryo.net/wp-content/uploads/2017/11/Switch-Moxa-Analysis.pdf
CVE: CVE-2017-13699
Published: 2017-11-23
Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to retrieve it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.securityfocus.com/bid/106047; https://www.sentryo.net/wp-content/uploads/2017/11/Switch-Moxa-Analysis.pdf; http://www.securityfocus.com/bid/106047
CVE: CVE-2017-13701
Published: 2017-11-23
Description: An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for password hashing. Indeed passwords are stored without being ciphered with a timestamped ciphering method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101966; https://www.sentryo.net/wp-content/uploads/2017/11/Switch-Moxa-Analysis.pdf; http://www.securityfocus.com/bid/101966
CVE: CVE-2017-16931
Published: 2017-11-23
Description: parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://xmlsoft.org/news.html; https://bugzilla.gnome.org/show_bug.cgi?id=766956; https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3
CVE: CVE-2017-16932
Published: 2017-11-23
Description: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: http://xmlsoft.org/news.html; https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html; https://bugzilla.gnome.org/show_bug.cgi?id=759579
CVE: CVE-2016-10700
Published: 2017-11-24
Description: auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://bugs.cacti.net/view.php?id=2697; http://www.cacti.net/release_notes_1_0_0.php; https://github.com/Cacti/cacti/commit/69983495cd41bf0903fe02baeef84b1fa85f2846
CVE: CVE-2017-16933
Published: 2017-11-24
Description: etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local users to gain privileges by leveraging access to the $ICINGA2_USER account for creation of a link.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732
References: https://github.com/Icinga/icinga2/issues/5793; https://github.com/Icinga/icinga2/issues/5793
CVE: CVE-2017-16934
Published: 2017-11-24
Description: The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a change_password.csp request, which supports a "<%%25call system.exec:" string in the passwd parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blogs.securiteam.com/index.php/archives/3437; https://blogs.securiteam.com/index.php/archives/3437
CVE: CVE-2017-16935
Published: 2017-11-24
Description: Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://blogs.securiteam.com/index.php/archives/3517; https://issues.ametys.org/browse/RUNTIME-2582; https://blogs.securiteam.com/index.php/archives/3517
CVE: CVE-2017-16936
Published: 2017-11-24
Description: Directory Traversal vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(6318_)_cn, Ac15 US_AC15V1.0BR_V15.03.05.18_multi_TD01, Ac15 US_AC15V1.0BR_V15.03.05.19_multi_TD01, Ac18 US_AC18V1.0BR_V15.03.05.05_multi_TD01, and Ac18 ac18_kf_V15.03.05.19(6318_)_cn devices allows remote unauthenticated attackers to read arbitrary files via a cgi-bin/luci/request?op=1&path= URI that uses directory traversal sequences after a /usb/ substring.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Iolop/Poc/tree/master/Router/Tenda; https://github.com/Iolop/Poc/tree/master/Router/Tenda
CVE: CVE-2017-16938
Published: 2017-11-24
Description: A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://lists.debian.org/debian-lts-announce/2017/11/msg00042.html; https://security.gentoo.org/glsa/201801-02; https://sourceforge.net/p/optipng/bugs/69/
CVE: CVE-2017-16939
Published: 2017-11-24
Description: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1137b5e2529a8f5ca8ee709288ecba3e68044df2; http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html; http://seclists.org/fulldisclosure/2017/Nov/40
CVE: CVE-2017-16941
Published: 2017-11-25
Description: October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/octobercms/october/issues/3257; https://github.com/octobercms/october/issues/3257
CVE: CVE-2017-16942
Published: 2017-11-25
Description: In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead to DoS when playing a crafted audio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/erikd/libsndfile/issues/341; https://usn.ubuntu.com/4013-1/; https://github.com/erikd/libsndfile/issues/341
CVE: CVE-2017-16943
Published: 2017-11-25
Description: The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://openwall.com/lists/oss-security/2017/11/25/1; http://openwall.com/lists/oss-security/2017/11/25/2; http://openwall.com/lists/oss-security/2017/11/25/3
CVE: CVE-2017-16944
Published: 2017-11-25
Description: The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://openwall.com/lists/oss-security/2017/11/25/1; http://openwall.com/lists/oss-security/2017/11/25/2; http://openwall.com/lists/oss-security/2017/11/25/3
CVE: CVE-2017-16946
Published: 2017-11-25
Description: The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://github.com/MISP/MISP/commit/7d5890b2fc63285f010d[PII_REDACTED]dd71cf232c; https://github.com/MISP/MISP/commit/7d5890b2fc63285f010d[PII_REDACTED]dd71cf232c
CVE: CVE-2017-16948
Published: 2017-11-26
Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730008 DeviceIoControl request to \\.\Viragtlt.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://github.com/k0keoyo/Vir.IT-explorer-Anti-Virus-Null-Pointer-Reference-PoC/tree/master/VirIT_NullPointerReference1; https://github.com/k0keoyo/Vir.IT-explorer-Anti-Virus-Null-Pointer-Reference-PoC/tree/master/VirIT_NullPointerReference1
CVE: CVE-2017-14176
Published: 2017-11-27
Description: Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2[PII_REDACTED], and CVE-2[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
References: http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.html; http://www.ubuntu.com/usn/usn-3411-1; https://bugs.debian.org/874429
CVE: CVE-2017-14390
Published: 2017-11-27
Description: In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration with Loggregator and syslog-drain causes logs to be drained to unintended locations.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/101972; https://www.cloudfoundry.org/cve-2017-14390/; http://www.securityfocus.com/bid/101972
CVE: CVE-2017-16955
Published: 2017-11-27
Description: SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbitrary SQL commands via the "keyword" parameter to /wp-admin/options-general.php?page=inlinks/inlinks.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://packetstormsecurity.com/files/145059/WordPress-In-Link-1.0-SQL-Injection.html; https://wpvulndb.com/vulnerabilities/8962; https://packetstormsecurity.com/files/145059/WordPress-In-Link-1.0-SQL-Injection.html
CVE: CVE-2017-16956
Published: 2017-11-27
Description: b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/b3log/symphony/issues/509; https://github.com/b3log/symphony/issues/509
CVE: CVE-2017-16957
Published: 2017-11-27
Description: TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zone_get_effect_devices function in /usr/lib/lua/luci/controller/admin/diagnostic.lua in uhttpd.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/101968; https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkDiagnosticAuthenticatedRCE.txt; http://www.securityfocus.com/bid/101968
CVE: CVE-2017-16958
Published: 2017-11-27
Description: TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/bridge command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/bridge.lua in uhttpd.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkBridgeAuthenticatedRCE.txt; https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkBridgeAuthenticatedRCE.txt
CVE: CVE-2017-16959
Published: 2017-11-27
Description: The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt; https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt
CVE: CVE-2017-16960
Published: 2017-11-27
Description: TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/interface.lua in uhttpd.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkInterfaceAuthenticatedRCE.txt; https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkInterfaceAuthenticatedRCE.txt
CVE: CVE-2017-16961
Published: 2017-11-27
Description: A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack uses an admin/trees/add/process request with a crafted _tags[] parameter that is mishandled in a later admin/ajax/dashboard/approve-change request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/bigtreecms/BigTree-CMS/issues/323; https://github.com/bigtreecms/BigTree-CMS/issues/323
CVE: CVE-2017-16962
Published: 2017-11-27
Description: The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/145095/communigatepro-xss.txt; https://www.exploit-db.com/exploits/43177/; https://packetstormsecurity.com/files/145095/communigatepro-xss.txt