deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7049
Published: 2018-03-01
Description: An issue was discovered in Wowza Streaming Engine before 4.7.1. There is an XSS vulnerability in the HTTP providers (com.wowza.wms.http.HTTPProviderMediaList and com.wowza.wms.http.streammanager.HTTPStreamManager) causing script injection and/or reflection via a crafted HTTP request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-7049.txt; https://www.wowza.com/docs/wowza-streaming-engine-4-7-1-release-notes; https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-7049.txt
CVE: CVE-2017-15134
Published: 2018-03-01
Description: A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html; http://www.securityfocus.com/bid/102790; https://access.redhat.com/errata/RHSA-2018:0163
CVE: CVE-2017-18212
Published: 2018-03-01
Description: An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex function in lit/lit-char-helpers.c via a RegExp("[\x0"); payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/jerryscript-project/jerryscript/issues/2140; https://github.com/jerryscript-project/jerryscript/issues/2140
CVE: CVE-2018-7586
Published: 2018-03-01
Description: In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://wordpress.org/plugins/nextgen-gallery/#developers; https://wpvulndb.com/vulnerabilities/9033; https://wordpress.org/plugins/nextgen-gallery/#developers
CVE: CVE-2018-7587
Published: 2018-03-01
Description: An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/xiaoqx/pocs/tree/master/cimg; https://usn.ubuntu.com/4039-1/; https://github.com/xiaoqx/pocs/tree/master/cimg
CVE: CVE-2018-7588
Published: 2018-03-01
Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/dtschump/CImg/issues/183; https://github.com/xiaoqx/pocs/tree/master/cimg; https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html
CVE: CVE-2018-7589
Published: 2018-03-01
Description: An issue was discovered in CImg v.220. A double free in load_bmp in CImg.h occurs when loading a crafted bmp image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://github.com/dtschump/CImg/issues/184; https://github.com/xiaoqx/pocs/tree/master/cimg; https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html
CVE: CVE-2018-7590
Published: 2018-03-01
Description: CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/havok89/Hoosk/issues/45; https://github.com/havok89/Hoosk/issues/45
CVE: CVE-2017-6926
Published: 2018-03-01
Description: In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://www.drupal.org/sa-core-2018-001; https://www.drupal.org/sa-core-2018-001
CVE: CVE-2017-6927
Published: 2018-03-01
Description: Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103138; https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html; https://www.debian.org/security/2018/dsa-4123
CVE: CVE-2017-6928
Published: 2018-03-01
Description: Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html; https://www.debian.org/security/2018/dsa-4123; https://www.drupal.org/sa-core-2018-001
CVE: CVE-2017-6929
Published: 2018-03-01
Description: A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html; https://www.debian.org/security/2018/dsa-4123; https://www.drupal.org/sa-core-2018-001
CVE: CVE-2017-6930
Published: 2018-03-01
Description: In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().
CVSS Score: 8.1 (HIGH)
References: https://www.drupal.org/sa-core-2018-001; https://www.drupal.org/sa-core-2018-001
CVE: CVE-2017-6931
Published: 2018-03-01
Description: In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://www.drupal.org/sa-core-2018-001; https://www.drupal.org/sa-core-2018-001
CVE: CVE-2017-6932
Published: 2018-03-01
Description: Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html; https://www.debian.org/security/2018/dsa-4123; https://www.drupal.org/sa-core-2018-001
CVE: CVE-2018-7634
Published: 2018-03-01
Description: An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to account takeover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Enalean/tuleap/commit/0843c046eee54b16ec6a7753c[PII_REDACTED]70189; https://mustafairan.wordpress.com/2018/03/05/tuleap-mail-change-csrf-vulnerability-leads-to-account-takeover/; https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=commit&h=d6701289ae55de900929ff0f66313fa9771a198d
CVE: CVE-2018-1169
Published: 2018-03-02
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5521.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-20
References: http://www.securityfocus.com/bid/103215; https://zerodayinitiative.com/advisories/ZDI-18-215; http://www.securityfocus.com/bid/103215
CVE: CVE-2018-1170
Published: 2018-03-02
Description: This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Customer-Link App and Customer-Link Bridge. The issue results from the lack of a proper protection mechanism against unauthorized firmware updates. An attacker can leverage this vulnerability to inject CAN messages. Was ZDI-CAN-5264.
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://zerodayinitiative.com/advisories/ZDI-18-214; https://zerodayinitiative.com/advisories/ZDI-18-214
CVE: CVE-2018-6490
Published: 2018-03-02
Description: Denial of Service vulnerability in Micro Focus Operations Orchestration Software, version 10.x. This vulnerability could be remotely exploited to allow Denial of Service.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03103896; https://www.tenable.com/security/research/tra-2018-05; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03103896
CVE: CVE-2018-1065
Published: 2018-03-02
Description: The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8; http://lists.openwall.net/netdev/2018/01/27/46; http://patchwork.ozlabs.org/patch/870355/
CVE: CVE-2018-1066
Published: 2018-03-02
Description: The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cabfb3680f78981d26c078a26e5c748531257ebb; http://www.securityfocus.com/bid/103378; https://bugzilla.redhat.com/show_bug.cgi?id=1539599
CVE: CVE-2018-7637
Published: 2018-03-02
Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "16 colors" case, aka case 4.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/dtschump/CImg/issues/185; https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE: CVE-2018-7638
Published: 2018-03-02
Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "256 colors" case, aka case 8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/dtschump/CImg/issues/185; https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE: CVE-2018-7639
Published: 2018-03-02
Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "16 bits colors" case, aka case 16.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/dtschump/CImg/issues/185; https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE: CVE-2018-7640
Published: 2018-03-02
Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a Monochrome case, aka case 1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/dtschump/CImg/issues/185; https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE: CVE-2018-7641
Published: 2018-03-02
Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "32 bits colors" case, aka case 32.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/dtschump/CImg/issues/185; https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE: CVE-2017-14461
Published: 2018-03-02
Description: A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure and denial of service. In order to trigger this vulnerability, an attacker needs to send a specially crafted email message to the server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-200
References: http://www.securityfocus.com/bid/103201; https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510
CVE: CVE-2017-15130
Published: 2018-03-02
Description: A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: http://seclists.org/oss-sec/2018/q1/205; https://bugzilla.redhat.com/show_bug.cgi?id=1532356; https://lists.debian.org/debian-lts-announce/2018/03/msg00036.html
CVE: CVE-2018-1058
Published: 2018-03-02
Description: A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103221; https://access.redhat.com/errata/RHSA-2018:2511; https://access.redhat.com/errata/RHSA-2018:2566
CVE: CVE-2018-1063
Published: 2018-03-02
Description: Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://access.redhat.com/errata/RHSA-2018:0913; https://bugzilla.redhat.com/show_bug.cgi?id=1550122; https://access.redhat.com/errata/RHSA-2018:0913
CVE: CVE-2018-7642
Published: 2018-03-02
Description: The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; https://access.redhat.com/errata/RHBA-2019:0327
CVE: CVE-2018-7643
Published: 2018-03-02
Description: The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; http://www.securityfocus.com/bid/103264
CVE: CVE-2018-7648
Published: 2018-03-02
Description: An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/uclouvain/openjpeg/commit/cc3824767bde397fedb8a1ae4786a222ba860c8d; https://github.com/uclouvain/openjpeg/issues/1088; https://github.com/uclouvain/openjpeg/commit/cc3824767bde397fedb8a1ae4786a222ba860c8d
CVE: CVE-2017-1654
Published: 2018-03-02
Description: IBM Spectrum Scale 4.1.1 and 4.2.0 - 4.2.3 could allow a local unprivileged user access to information located in dump files. User data could be sent to IBM during service engagements. IBM X-Force ID: 133378.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1010869; http://www.securitytracker.com/id/1040747; https://exchange.xforce.ibmcloud.com/vulnerabilities/133378
CVE: CVE-2017-1787
Published: 2018-03-02
Description: IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded user credentials. IBM X-Force ID: 137022.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-798
References: http://www.ibm.com/support/docview.wss?uid=swg22013961; http://www.securityfocus.com/bid/103252; https://exchange.xforce.ibmcloud.com/vulnerabilities/137022
CVE: CVE-2018-1373
Published: 2018-03-02
Description: IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 137773.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: http://www.ibm.com/support/docview.wss?uid=swg22013750; http://www.securityfocus.com/bid/103199; http://www.securitytracker.com/id/1040453
CVE: CVE-2015-0796
Published: 2018-03-02
Description: In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=941099; https://github.com/openSUSE/open-build-service/commit/474a3db19498765f0118ba3dbc0b1cc90b0097fc; https://bugzilla.suse.com/show_bug.cgi?id=941099
CVE: CVE-2017-14801
Published: 2018-03-02
Description: Reflected XSS in the NetIQ Access Manager before 4.3.3 allowed attackers to reflect back xss into the called page using the url parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.novell.com/support/kb/doc.php?id=7022357; https://www.novell.com/support/kb/doc.php?id=7022357
CVE: CVE-2017-14802
Published: 2018-03-02
Description: Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third party sites.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.novell.com/support/kb/doc.php?id=7022360; https://www.novell.com/support/kb/doc.php?id=7022360
CVE: CVE-2017-5189
Published: 2018-03-02
Description: NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522, CWE-287
References: https://bugzilla.suse.com/show_bug.cgi?id=1021637; https://www.netiq.com/support/kb/doc.php?id=7016795; https://bugzilla.suse.com/show_bug.cgi?id=1021637
CVE: CVE-2017-7419
Published: 2018-03-02
Description: A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.suse.com/show_bug.cgi?id=1031853; https://www.novell.com/support/kb/doc.php?id=7019893; https://bugzilla.suse.com/show_bug.cgi?id=1031853
CVE: CVE-2017-7429
Published: 2018-03-02
Description: The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-295
References: https://bugzilla.suse.com/show_bug.cgi?id=1024957; https://www.netiq.com/documentation/edir88/edir88810hf1_releasenotes/data/edir88810hf1_releasenotes.html; https://www.novell.com/support/kb/doc.php?id=3426981
CVE: CVE-2017-7434
Published: 2018-03-02
Description: In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles.
CVSS Score: 3.3 (LOW)
CWE: CWE-532, CWE-532
References: https://bugzilla.suse.com/show_bug.cgi?id=1005907; https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html; https://bugzilla.suse.com/show_bug.cgi?id=1005907
CVE: CVE-2017-7438
Published: 2018-03-02
Description: NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.suse.com/show_bug.cgi?id=1001355; https://www.netiq.com/documentation/privileged-account-manager-3/npam3103-release-notes/data/npam3103-release-notes.html; https://bugzilla.suse.com/show_bug.cgi?id=1001355