deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-15633
Published: 2018-01-11
Description: TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipgroup variable in the session_limits.lua file.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/541655/100/0/threaded; https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt; http://www.securityfocus.com/archive/1/541655/100/0/threaded
CVE: CVE-2017-15634
Published: 2018-01-11
Description: TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name variable in the wportal.lua file.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/541655/100/0/threaded; https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt; http://www.securityfocus.com/archive/1/541655/100/0/threaded
CVE: CVE-2017-15635
Published: 2018-01-11
Description: TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max_conn variable in the session_limits.lua file.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/541655/100/0/threaded; https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt; http://www.securityfocus.com/archive/1/541655/100/0/threaded
CVE: CVE-2017-15636
Published: 2018-01-11
Description: TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the webfilter.lua file.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/541655/100/0/threaded; https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt; http://www.securityfocus.com/archive/1/541655/100/0/threaded
CVE: CVE-2017-15637
Published: 2018-01-11
Description: TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_server.lua file.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/541655/100/0/threaded; https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt; http://www.securityfocus.com/archive/1/541655/100/0/threaded
CVE: CVE-2017-18016
Published: 2018-01-11
Description: Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: http://www.openwall.com/lists/oss-security/2018/01/10/1; https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215; https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016
CVE: CVE-2018-5189
Published: 2018-01-11
Description: Race condition in Jungo Windriver 12.5.1 allows local users to cause a denial of service (buffer overflow) or gain system privileges by flipping pool buffer size, aka a "double fetch" vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/43494/; https://www.fidusinfosec.com/jungo-windriver-code-execution-cve-2018-5189/; https://www.exploit-db.com/exploits/43494/
CVE: CVE-2017-1478
Published: 2018-01-11
Description: IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 128613.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22012323; http://www.securityfocus.com/bid/102502; http://www.securitytracker.com/id/1040172
CVE: CVE-2017-1681
Published: 2018-01-11
Description: IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.15) could allow a local attacker to obtain sensitive information, caused by improper handling of application requests, which could allow unauthorized access to read a file. IBM X-Force ID: 134003.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22011863; http://www.securitytracker.com/id/1040357; https://exchange.xforce.ibmcloud.com/vulnerabilities/134003
CVE: CVE-2017-1739
Published: 2018-01-11
Description: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134921.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012366; http://www.securityfocus.com/bid/102492; https://exchange.xforce.ibmcloud.com/vulnerabilities/134921
CVE: CVE-2017-1740
Published: 2018-01-11
Description: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134922.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22012372; http://www.securityfocus.com/bid/102498; https://exchange.xforce.ibmcloud.com/vulnerabilities/134922
CVE: CVE-2018-1361
Published: 2018-01-11
Description: IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137158.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102501; http://www.securitytracker.com/id/1040132; https://exchange.xforce.ibmcloud.com/vulnerabilities/137158
CVE: CVE-2012-0699
Published: 2018-01-11
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.exploit-db.com/exploits/18667; http://www.exploit-db.com/exploits/18667
CVE: CVE-2012-6668
Published: 2018-01-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the (1) reportreason parameter in actions/doreport.php or (2) modnotes parameter in actions/updatereport.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48519; http://www.dragonbyte-tech.com/f4/vbactivity-vbshout-forumon-rpg-vbdownloads-vbquiz-updates-security-releases-6876/; http://www.securityfocus.com/bid/52715
CVE: CVE-2012-6670
Published: 2018-01-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the reason parameter in (1) actions/nominatemedal.php or (2) actions/requestmedal.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48490; http://www.dragonbyte-tech.com/f4/vbactivity-vbshout-forumon-rpg-vbdownloads-vbquiz-updates-security-releases-6876/; http://www.securityfocus.com/bid/52711
CVE: CVE-2012-6671
Published: 2018-01-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creating a new monster, allow remote attackers to inject arbitrary web script or HTML via the (1) monster[title] or (2) monster[description] parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48490; http://secunia.com/advisories/48514; http://www.dragonbyte-tech.com/f4/vbactivity-vbshout-forumon-rpg-vbdownloads-vbquiz-updates-security-releases-6876/
CVE: CVE-2012-6682
Published: 2018-01-11
Description: Cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and earlier for vBulletin allows remote attackers to inject arbitrary web script or HTML via the mirrors[] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48522; http://www.dragonbyte-tech.com/f4/vbactivity-vbshout-forumon-rpg-vbdownloads-vbquiz-updates-security-releases-6876/; http://www.securityfocus.com/bid/52713
CVE: CVE-2018-5334
Published: 2018-01-11
Description: In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timestamp bounds checks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102499; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14297; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=dc308c05ba0673460fe80873b22d296880ee996d
CVE: CVE-2018-5335
Published: 2018-01-11
Description: In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102500; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14251; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=086b87376b988c555484349aa115d6e08ac6db07
CVE: CVE-2018-5336
Published: 2018-01-11
Description: In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102504; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14253; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=4f4c95cf46ba6adbd10b09747e10742801bc706b
CVE: CVE-2018-5345
Published: 2018-01-12
Description: A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2018:0350; https://bugzilla.redhat.com/show_bug.cgi?id=1527296; https://usn.ubuntu.com/3546-1/
CVE: CVE-2018-5347
Published: 2018-01-12
Description: Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blogs.securiteam.com/index.php/archives/3548; https://www.exploit-db.com/exploits/43659/; https://blogs.securiteam.com/index.php/archives/3548
CVE: CVE-2017-16732
Published: 2018-01-12
Description: A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows an unauthenticated attacker to specify an arbitrary address.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A; https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A
CVE: CVE-2017-16736
Published: 2018-01-12
Description: An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows a remote attacker to upload arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434, CWE-434
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A; https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02A
CVE: CVE-2018-5326
Published: 2018-01-12
Description: Cheetah Mobile CM Browser 5.22.06.0012, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass.
CVSS Score: 7.5 (HIGH)
References: https://twitter.com/mishradhiraj_/status/[PII_REDACTED]92150785; https://twitter.com/mishradhiraj_/status/[PII_REDACTED]92150785
CVE: CVE-2018-5327
Published: 2018-01-12
Description: Cheetah Mobile Armorfly Browser & Downloader 1.1.05.0010, when installed on unspecified "older" Android platforms, allows Same Origin Policy Bypass.
CVSS Score: 7.5 (HIGH)
References: https://twitter.com/mishradhiraj_/status/[PII_REDACTED]92150785; https://twitter.com/mishradhiraj_/status/[PII_REDACTED]92150785
CVE: CVE-2018-5344
Published: 2018-01-12
Description: In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5; http://www.securityfocus.com/bid/102503; https://access.redhat.com/errata/RHSA-2018:2948
CVE: CVE-2018-5357
Published: 2018-01-12
Description: ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/102497; https://github.com/ImageMagick/ImageMagick/issues/941; https://usn.ubuntu.com/3681-1/
CVE: CVE-2018-5358
Published: 2018-01-12
Description: ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/939; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/939
CVE: CVE-2018-5361
Published: 2018-01-12
Description: The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md; https://wpvulndb.com/vulnerabilities/9003; https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md
CVE: CVE-2018-5362
Published: 2018-01-12
Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md; https://wpvulndb.com/vulnerabilities/9003; https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md
CVE: CVE-2018-5363
Published: 2018-01-12
Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md; https://wpvulndb.com/vulnerabilities/9003; https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md
CVE: CVE-2018-5364
Published: 2018-01-12
Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md; https://wpvulndb.com/vulnerabilities/9003; https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md
CVE: CVE-2018-5365
Published: 2018-01-12
Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md; https://wpvulndb.com/vulnerabilities/9003; https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md
CVE: CVE-2018-5366
Published: 2018-01-12
Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md; https://wpvulndb.com/vulnerabilities/9003; https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md
CVE: CVE-2018-5367
Published: 2018-01-12
Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md; https://wpvulndb.com/vulnerabilities/9003; https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md
CVE: CVE-2018-5368
Published: 2018-01-12
Description: The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/SrbTransLatin.md; https://wpvulndb.com/vulnerabilities/9004; https://github.com/d4wner/Vulnerabilities-Report/blob/master/SrbTransLatin.md
CVE: CVE-2018-5369
Published: 2018-01-12
Description: The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/d4wner/Vulnerabilities-Report/blob/master/SrbTransLatin.md; https://wpvulndb.com/vulnerabilities/9004; https://github.com/d4wner/Vulnerabilities-Report/blob/master/SrbTransLatin.md
CVE: CVE-2018-5371
Published: 2018-01-12
Description: diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.iplantom.com/2018/01/10/dsl2640U/; https://www.iplantom.com/2018/01/10/dsl2640U/
CVE: CVE-2018-5372
Published: 2018-01-12
Description: The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.defensecode.com/advisories/DC-2018-01-005_WordPress_Testimonial_Slider_Plugin_Advisory.pdf; http://www.defensecode.com/advisories/DC-2018-01-005_WordPress_Testimonial_Slider_Plugin_Advisory.pdf
CVE: CVE-2018-5373
Published: 2018-01-12
Description: The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.defensecode.com/advisories/DC-2018-01-004_WordPress_Smooth_Slider_Plugin_Advisory.pdf; http://www.defensecode.com/advisories/DC-2018-01-004_WordPress_Smooth_Slider_Plugin_Advisory.pdf
CVE: CVE-2018-5374
Published: 2018-01-12
Description: The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.defensecode.com/advisories/DC-2017-01-003_WordPress_Dbox_3D_Slider_Lite_Plugin_Advisory.pdf; http://www.defensecode.com/advisories/DC-2017-01-003_WordPress_Dbox_3D_Slider_Lite_Plugin_Advisory.pdf
CVE: CVE-2018-5375
Published: 2018-01-12
Description: Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_space.php appid parameter in a delete action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.whsgwl.net/text.php?textid=34; http://www.whsgwl.net/text.php?textid=34
CVE: CVE-2018-5376
Published: 2018-01-12
Description: Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_upload.php op parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.whsgwl.net/text.php?textid=35; http://www.whsgwl.net/text.php?textid=35
CVE: CVE-2018-5377
Published: 2018-01-12
Description: Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: http://www.whsgwl.net/text.php?textid=36; http://www.whsgwl.net/text.php?textid=36
CVE: CVE-2017-14594
Published: 2018-01-12
Description: The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-66495; https://jira.atlassian.com/browse/JRASERVER-66495
CVE: CVE-2017-16862
Published: 2018-01-12
Description: The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery (CSRF) vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/102506; https://jira.atlassian.com/browse/JRASERVER-66622; http://www.securityfocus.com/bid/102506
CVE: CVE-2017-16864
Published: 2018-01-12
Description: The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102505; https://jira.atlassian.com/browse/JRASERVER-66624; http://www.securityfocus.com/bid/102505
CVE: CVE-2017-2158
Published: 2018-01-12
Description: Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents to be extracted from a specially crafted ZIP64 archive.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://www7a.biglobe.ne.jp/~schezo/JVN57842148.html; https://jvn.jp/en/jp/JVN57842148/index.html; http://www7a.biglobe.ne.jp/~schezo/JVN57842148.html
CVE: CVE-2017-0869
Published: 2018-01-12
Description: NVIDIA driver contains an integer overflow vulnerability which could cause a use after free and possibly lead to an elevation of privilege enabling code execution as a privileged process. This issue is rated as high. Version: N/A. Android ID: A-37776156. References: N-CVE-2017-0869.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-416
References: http://www.securityfocus.com/bid/102374; http://www.securitytracker.com/id/1040106; https://source.android.com/security/bulletin/2018-01-01
CVE: CVE-2014-3471
Published: 2018-01-12
Description: Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://security.gentoo.org/glsa/glsa-201412-01.xml; http://www.openwall.com/lists/oss-security/2014/06/23/4; http://www.securityfocus.com/bid/68145
CVE: CVE-2014-6435
Published: 2018-01-12
Description: cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication, which allows remote attackers to cause a denial of service (WAN connectivity reset) via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/128254/Aztech-DSL5018EN-DSL705E-DSL705EU-DoS-Broken-Session-Management.html; http://www.securityfocus.com/bid/69809; http://packetstormsecurity.com/files/128254/Aztech-DSL5018EN-DSL705E-DSL705EU-DoS-Broken-Session-Management.html