deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14301
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address controls subsequent Write Address starting at STDUJBIG2File!DllUnregisterServer+0x[PII_REDACTED]0076d3."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14301; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14301
CVE: CVE-2017-14302
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to "Data from Faulting Address controls Branch Selection starting at STDUJBIG2File!DllGetClassObject+0x[PII_REDACTED]0064d7."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14302; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14302
CVE: CVE-2017-14303
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access Violation starting at STDUJBIG2File!DllGetClassObject+0x[PII_REDACTED]003047."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14303; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14303
CVE: CVE-2017-14304
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access Violation starting at STDUJBIG2File!DllGetClassObject+0x[PII_REDACTED]0043e0."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14304; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14304
CVE: CVE-2017-14305
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to "Data from Faulting Address controls Branch Selection starting at STDUJBIG2File!DllUnregisterServer+0x[PII_REDACTED]005578."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14305; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14305
CVE: CVE-2017-14306
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access Violation starting at STDUJBIG2File!DllUnregisterServer+0x[PII_REDACTED]006e10."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14306; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14306
CVE: CVE-2017-14307
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77400000!TpAllocCleanupGroup+0x[PII_REDACTED]000402."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14307; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14307
CVE: CVE-2017-14308
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access Violation starting at STDUJBIG2File!DllUnregisterServer+0x[PII_REDACTED]006ddd."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14308; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14308
CVE: CVE-2017-14309
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access Violation starting at STDUJBIG2File!DllUnregisterServer+0x[PII_REDACTED]006ec8."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14309; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14309
CVE: CVE-2017-14310
Published: 2017-09-11
Description: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access Violation starting at STDUJBIG2File!DllUnregisterServer+0x[PII_REDACTED]001869."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14310; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14310
CVE: CVE-2[PII_REDACTED]
Published: 2017-09-11
Description: An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e[PII_REDACTED] (Aug 2017).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3965; https://github.com/file/file/commit/35c94dc6acc418f1ad7f6241a6680e[PII_REDACTED]; https://github.com/file/file/commit/9611f31313a93aa036389c5f3b15eea53510d4d
CVE: CVE-2015-4687
Published: 2017-09-11
Description: Cross-site scripting (XSS) vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html; http://www.securityfocus.com/archive/1/537029/100/0/threaded; http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html
CVE: CVE-2015-4688
Published: 2017-09-11
Description: Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html; http://www.securityfocus.com/archive/1/537029/100/0/threaded; http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html
CVE: CVE-2015-4689
Published: 2017-09-11
Description: Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html; http://www.securityfocus.com/archive/1/537029/100/0/threaded; http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html
CVE: CVE-2015-5054
Published: 2017-09-11
Description: Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html; http://www.securityfocus.com/archive/1/537029/100/0/threaded; http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html
CVE: CVE-2015-8349
Published: 2017-09-11
Description: Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/537018/100/0/threaded; https://www.htbridge.com/advisory/HTB23273; http://www.securityfocus.com/archive/1/537018/100/0/threaded
CVE: CVE-2015-8350
Published: 2017-09-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134598/WordPress-Calls-To-Action-2.4.3-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/537022/100/0/threaded; https://wordpress.org/plugins/cta/#developers
CVE: CVE-2015-8351
Published: 2017-09-11
Description: PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php.  NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-94
References: http://packetstormsecurity.com/files/134599/WordPress-Gwolle-Guestbook-1.5.3-Remote-File-Inclusion.html; http://www.securityfocus.com/archive/1/537020/100/0/threaded; https://wordpress.org/plugins/gwolle-gb/changelog/
CVE: CVE-2015-8353
Published: 2017-09-11
Description: Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134600/WordPress-Role-Scoper-1.3.66-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/537019/100/0/threaded; https://wordpress.org/plugins/role-scoper/#developers
CVE: CVE-2015-8354
Published: 2017-09-11
Description: Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/134601/WordPress-Ultimate-Member-1.3.28-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/537021/100/0/threaded; https://wpvulndb.com/vulnerabilities/8346
CVE: CVE-2015-9226
Published: 2017-09-11
Description: Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the (1) check_download and possibly (2) check_filename function in upload/admin2/model/products/model_admin_download.php or remote authenticated users with a valid Paypal transaction token to execute arbitrary SQL commands via the ref parameter in the (3) orderUpdate function in upload/catalog/extension/payment/paypal.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/134362/AlegroCart-1.2.8-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Nov/68; https://blog.curesec.com/article/blog/AlegroCart-128-SQL-Injection-104.html
CVE: CVE-2015-9227
Published: 2017-09-11
Description: PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/134361/AlegroCart-1.2.8-Local-Remote-File-Inclusion.html; http://seclists.org/fulldisclosure/2015/Nov/67; https://blog.curesec.com/article/blog/AlegroCart-128-LFIRFI-102.html
CVE: CVE-2017-14312
Published: 2017-09-11
Description: Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by a non-root account), which allows local users to gain privileges by leveraging access to this non-root account.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/100881; https://github.com/NagiosEnterprises/nagioscore/issues/424; https://security.gentoo.org/glsa/201812-03
CVE: CVE-2017-14313
Published: 2017-09-12
Description: The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2017/dsa-3973; https://bugs.debian.org/874416; https://github.com/michaelryanmcneill/shibboleth/commit/1d65ad6786282d23ba1865f56e2fd19188e7c26a
CVE: CVE-2017-14314
Published: 2017-09-12
Description: Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/2835184bfb78; https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html; https://sourceforge.net/p/graphicsmagick/bugs/448/
CVE: CVE-2017-3131
Published: 2017-09-12
Description: A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100009; http://www.securitytracker.com/id/1039020; https://fortiguard.com/advisory/FG-IR-17-104
CVE: CVE-2017-3132
Published: 2017-09-12
Description: A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100009; http://www.securitytracker.com/id/1039020; https://fortiguard.com/advisory/FG-IR-17-104
CVE: CVE-2017-3133
Published: 2017-09-12
Description: A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100009; http://www.securitytracker.com/id/1039020; https://fortiguard.com/advisory/FG-IR-17-104
CVE: CVE-2017-7734
Published: 2017-09-12
Description: A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99098; http://www.securitytracker.com/id/1038705; https://fortiguard.com/advisory/FG-IR-17-127
CVE: CVE-2017-7735
Published: 2017-09-12
Description: A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the "Groups" input while creating or editing User Groups.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99098; http://www.securitytracker.com/id/1038705; https://fortiguard.com/advisory/FG-IR-17-127
CVE: CVE-2015-9228
Published: 2017-09-12
Description: In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://www.openwall.com/lists/oss-security/2015/10/27/6; https://cybersecurityworks.com/zerodays/cve-2015-9228-crony.html; https://github.com/cybersecurityworks/Disclosed/issues/6
CVE: CVE-2017-14266
Published: 2017-09-12
Description: tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a related issue to CVE-2016-6160.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42652/; https://www.exploit-db.com/exploits/42652/
CVE: CVE-2017-14324
Published: 2017-09-12
Description: In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100863; https://github.com/ImageMagick/ImageMagick/issues/739; http://www.securityfocus.com/bid/100863
CVE: CVE-2017-14325
Published: 2017-09-12
Description: In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function PersistPixelCache in magick/cache.c, which allows attackers to cause a denial of service (memory consumption in ReadMPCImage in coders/mpc.c) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/100874; https://github.com/ImageMagick/ImageMagick/issues/741; https://usn.ubuntu.com/3681-1/
CVE: CVE-2017-14326
Published: 2017-09-12
Description: In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/740; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/740
CVE: CVE-2017-14333
Published: 2017-09-12
Description: The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during "readelf -a" execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://security.gentoo.org/glsa/201801-01; https://sourceware.org/bugzilla/show_bug.cgi?id=21990; https://security.gentoo.org/glsa/201801-01
CVE: CVE-2017-14335
Published: 2017-09-12
Description: On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://blogs.securiteam.com/index.php/archives/3420; https://blogs.securiteam.com/index.php/archives/3420
CVE: CVE-2014-9624
Published: 2017-09-12
Description: CAPTCHA bypass vulnerability in MantisBT before 1.2.19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2015/01/18/11; http://www.securitytracker.com/id/1031633; https://bugzilla.redhat.com/show_bug.cgi?id=1183593
CVE: CVE-2014-9634
Published: 2017-09-12
Description: Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2015/01/22/3; http://www.securityfocus.com/bid/72054; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682
CVE: CVE-2014-9635
Published: 2017-09-12
Description: Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2015/01/22/3; http://www.securityfocus.com/bid/72054; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682
CVE: CVE-2017-14315
Published: 2017-09-12
Description: In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP (Low Energy Audio Protocol), a large audio command can be sent to a targeted device and lead to a heap overflow with attacker-controlled data. Since the audio commands sent via LEAP are not properly validated, an attacker can use this overflow to gain full control of the device through the relatively high privileges of the Bluetooth stack in iOS. The attack bypasses Bluetooth access control; however, the default "Bluetooth On" value must be present in Settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2019/May/24; http://www.securityfocus.com/bid/100816; https://seclists.org/bugtraq/2019/May/30
CVE: CVE-2017-14316
Published: 2017-09-12
Description: A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first NUMA node that should be used for allocations through the `memflags` parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node >= MAX_NUMNODES`. This allows an out-of-bounds access to an internal array.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/100818; http://www.securitytracker.com/id/1039348; http://xenbits.xen.org/xsa/advisory-231.html
CVE: CVE-2017-14317
Published: 2017-09-12
Description: A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free. The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc.).
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-362
References: http://www.securityfocus.com/bid/100826; http://www.securitytracker.com/id/1039350; http://xenbits.xen.org/xsa/advisory-233.html
CVE: CVE-2017-14318
Published: 2017-09-12
Description: An issue was discovered in Xen 4.5.x through 4.9.x. The function `__gnttab_cache_flush` handles GNTTABOP_cache_flush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mapping to the calling domain exists for the page in question. However, the function does not check to see if the owning domain actually has a grant table or not. Some special domains, such as `DOMID_XEN`, `DOMID_IO` and `DOMID_COW` are created without grant tables. Hence, if __gnttab_cache_flush operates on a page owned by these special domains, it will attempt to dereference a NULL pointer in the domain struct.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/100817; http://www.securitytracker.com/id/1039349; http://xenbits.xen.org/xsa/advisory-232.html
CVE: CVE-2017-14319
Published: 2017-09-12
Description: A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to make sure page table entries remain in sync with other accounting done. Although the identity of the page frame was validated correctly, neither the presence of the mapping nor page writability were taken into account.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/100819; http://www.securitytracker.com/id/1039351; http://xenbits.xen.org/xsa/advisory-234.html
CVE: CVE-2017-14337
Published: 2017-09-12
Description: When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://github.com/MISP/MISP/commit/be111a470204a974c50682054c9c7d4b94396ed9; https://www.circl.lu/advisory/CVE-2017-14337/; https://github.com/MISP/MISP/commit/be111a470204a974c50682054c9c7d4b94396ed9