deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-10922
Published: 2017-07-05
Description: The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service (loss of grant trackability), aka XSA-224 bug 3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.debian.org/security/2017/dsa-3969; http://www.securitytracker.com/id/1038734; https://security.gentoo.org/glsa/201708-03
CVE: CVE-2017-10923
Published: 2017-07-05
Description: Xen through 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99160; http://www.securitytracker.com/id/1038735; https://security.gentoo.org/glsa/201708-03
CVE: CVE-2017-10928
Published: 2017-07-05
Description: In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken function in token.c allows remote attackers to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted SVG document that is mishandled in the GetUserSpaceCoordinateValue function in coders/svg.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/99480; https://github.com/ImageMagick/ImageMagick/issues/539; http://www.securityfocus.com/bid/99480
CVE: CVE-2017-10929
Published: 2017-07-05
Description: The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a read overflow in the grub_disk_read_small_real function in kern/disk.c in GNU GRUB 2.02.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99608; https://github.com/radare/radare2/commit/c57997e76ec70862174a1b3b3aeb62a6f8570e85; https://github.com/radare/radare2/issues/7855
CVE: CVE-2016-0238
Published: 2017-07-05
Description: IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21989124; http://www.securityfocus.com/bid/99379; https://exchange.xforce.ibmcloud.com/vulnerabilities/110409
CVE: CVE-2017-1217
Published: 2017-07-05
Description: IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123857
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004348; http://www.securityfocus.com/bid/99350; http://www.securitytracker.com/id/1038797
CVE: CVE-2017-1256
Published: 2017-07-05
Description: IBM Security Guardium 10.0, 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124678
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004461; http://www.securityfocus.com/bid/99376; https://exchange.xforce.ibmcloud.com/vulnerabilities/124678
CVE: CVE-2017-1258
Published: 2017-07-05
Description: IBM Security Guardium 10.0 and 10.1 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 124685
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=swg22004309; http://www.securityfocus.com/bid/99377; https://exchange.xforce.ibmcloud.com/vulnerabilities/124685
CVE: CVE-2017-1269
Published: 2017-07-05
Description: IBM Security Guardium 10.0 and 10.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-force ID: 124744
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg22004462; http://www.securityfocus.com/bid/99361; https://exchange.xforce.ibmcloud.com/vulnerabilities/124744
CVE: CVE-2017-2294
Published: 2017-07-05
Description: Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://puppet.com/security/cve/cve-2017-2294; https://puppet.com/security/cve/cve-2017-2294
CVE: CVE-2017-2295
Published: 2017-07-05
Description: Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.
CVSS Score: 8.2 (HIGH)
CWE: CWE-502
References: http://www.debian.org/security/2017/dsa-3862; http://www.securityfocus.com/bid/98582; https://puppet.com/security/cve/cve-2017-2295
CVE: CVE-2016-9701
Published: 2017-07-05
Description: IBM Team Concert 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119529.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004611; http://www.securityfocus.com/bid/99352; http://www.securitytracker.com/id/1038912
CVE: CVE-2016-9733
Published: 2017-07-05
Description: IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119762.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004611; http://www.securityfocus.com/bid/99352; http://www.securitytracker.com/id/1038912
CVE: CVE-2016-9746
Published: 2017-07-05
Description: IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119821.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004611; http://www.securityfocus.com/bid/99352; http://www.securitytracker.com/id/1038912
CVE: CVE-2017-1113
Published: 2017-07-05
Description: IBM Rational Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121151.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22004611; http://www.securityfocus.com/bid/99352; http://www.securitytracker.com/id/1038912
CVE: CVE-2017-1175
Published: 2017-07-05
Description: IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 123297.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg22005212; http://www.securityfocus.com/bid/99363; https://exchange.xforce.ibmcloud.com/vulnerabilities/123297
CVE: CVE-2017-1176
Published: 2017-07-05
Description: IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local user to obtain sensitive information due to inappropriate data retention of attachments. IBM X-Force ID: 123299.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22005210; http://www.securityfocus.com/bid/99371; https://exchange.xforce.ibmcloud.com/vulnerabilities/123299
CVE: CVE-2017-1207
Published: 2017-07-05
Description: IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: http://www.ibm.com/support/docview.wss?uid=swg22005382; http://www.securityfocus.com/bid/99368; https://exchange.xforce.ibmcloud.com/vulnerabilities/123777
CVE: CVE-2017-1208
Published: 2017-07-05
Description: IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123778.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005243; http://www.securityfocus.com/bid/99367; https://exchange.xforce.ibmcloud.com/vulnerabilities/123778
CVE: CVE-2016-9700
Published: 2017-07-05
Description: IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22005435; https://exchange.xforce.ibmcloud.com/vulnerabilities/119528; http://www.ibm.com/support/docview.wss?uid=swg22005435
CVE: CVE-2016-9986
Published: 2017-07-05
Description: IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120552.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001007; http://www.securityfocus.com/bid/99353; https://exchange.xforce.ibmcloud.com/vulnerabilities/120552
CVE: CVE-2016-9987
Published: 2017-07-05
Description: IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120553.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001007; http://www.securityfocus.com/bid/99353; https://exchange.xforce.ibmcloud.com/vulnerabilities/120553
CVE: CVE-2016-9988
Published: 2017-07-05
Description: IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120554.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001007; http://www.securityfocus.com/bid/99353; https://exchange.xforce.ibmcloud.com/vulnerabilities/120554
CVE: CVE-2016-9989
Published: 2017-07-05
Description: IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120555.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001007; http://www.securityfocus.com/bid/99353; https://exchange.xforce.ibmcloud.com/vulnerabilities/120555
CVE: CVE-2017-1096
Published: 2017-07-05
Description: IBM Jazz Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120656.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22001007; http://www.securityfocus.com/bid/99353; https://exchange.xforce.ibmcloud.com/vulnerabilities/120656
CVE: CVE-2017-1144
Published: 2017-07-05
Description: IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting. IBM X-Force ID: 122033.
CVSS Score: 2.5 (LOW)
CWE: CWE-426
References: http://www.ibm.com/support/docview.wss?uid=swg22005383; http://www.securityfocus.com/bid/99365; https://exchange.xforce.ibmcloud.com/vulnerabilities/122033
CVE: CVE-2017-1157
Published: 2017-07-05
Description: IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could allow an authenticated attacker to access report data that should be restricted to authorized users. IBM X-Force ID: 122788.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22001007; http://www.securityfocus.com/bid/99353; https://exchange.xforce.ibmcloud.com/vulnerabilities/122778
CVE: CVE-2017-1253
Published: 2017-07-05
Description: IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 124633.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: http://www.ibm.com/support/docview.wss?uid=swg22004426; http://www.securityfocus.com/bid/99372; https://exchange.xforce.ibmcloud.com/vulnerabilities/124633
CVE: CVE-2017-1254
Published: 2017-07-05
Description: IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg22004463; http://www.securityfocus.com/bid/99366; https://exchange.xforce.ibmcloud.com/vulnerabilities/124634
CVE: CVE-2017-1264
Published: 2017-07-05
Description: IBM Security Guardium 10.0 does not prove or insufficiently proves that the actors identity is correct which can lead to exposure of resources or functionality to unintended actors. IBM X-Force ID: 124739.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=swg22004425; http://www.securityfocus.com/bid/99369; https://exchange.xforce.ibmcloud.com/vulnerabilities/124739
CVE: CVE-2017-10725
Published: 2017-07-05
Description: Winamp 5.666 Build 3516(x86) allows attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Data from Faulting Address controls Code Flow starting at in_flv!winampGetInModule2+0x[PII_REDACTED]0009a8."
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10725; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10725
CVE: CVE-2017-10726
Published: 2017-07-05
Description: Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Data from Faulting Address may be used as a return value starting at f263!GetWinamp5SystemComponent+0x[PII_REDACTED]001951."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10726; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10726
CVE: CVE-2017-10727
Published: 2017-07-05
Description: Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Data from Faulting Address controls Branch Selection starting at in_mp3!DeleteAudioDecoder+0x[PII_REDACTED]00762f."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10727; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10727
CVE: CVE-2017-10728
Published: 2017-07-05
Description: Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Error Code (0xe06d7363) starting at wow64!Wow64NotifyDebugger+0x[PII_REDACTED]00001d."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10728; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10728
CVE: CVE-2017-10729
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll_77df0000!RtlpWaitOnCriticalSection+0x[PII_REDACTED]000121."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.irfanview.com/plugins.htm; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10729; http://www.irfanview.com/plugins.htm
CVE: CVE-2017-10730
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007d96."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.irfanview.com/plugins.htm; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10730; http://www.irfanview.com/plugins.htm
CVE: CVE-2017-10731
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007d80."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.irfanview.com/plugins.htm; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10731; http://www.irfanview.com/plugins.htm
CVE: CVE-2017-10732
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlpAllocateHeap+0x[PII_REDACTED]000429."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.irfanview.com/plugins.htm; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10732; http://www.irfanview.com/plugins.htm
CVE: CVE-2017-10733
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlpEnterCriticalSectionContended+0x[PII_REDACTED]000031."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.irfanview.com/plugins.htm; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10733; http://www.irfanview.com/plugins.htm
CVE: CVE-2017-10734
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to an "Invalid Handle starting at wow64!Wow64NotifyDebugger+0x[PII_REDACTED]00001d."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.irfanview.com/plugins.htm; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10734; http://www.irfanview.com/plugins.htm
CVE: CVE-2017-10735
Published: 2017-07-05
Description: IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlpFreeHeap+0x[PII_REDACTED]0003ca."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.irfanview.com/plugins.htm; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10735; http://www.irfanview.com/plugins.htm
CVE: CVE-2017-10736
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at msvcrt!_VEC_memzero+0x[PII_REDACTED]00006a."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10736; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10736
CVE: CVE-2017-10737
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll_77df0000!RtlpCoalesceFreeBlocks+0x[PII_REDACTED]0002e6."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10737; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10737
CVE: CVE-2017-10738
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x000000002f32332f called from KERNELBASE!CompareStringW+0x[PII_REDACTED]000082."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10738; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10738
CVE: CVE-2017-10739
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x000000000c1b541c called from xnview+0x[PII_REDACTED]3826ec."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10739; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10739
CVE: CVE-2017-10740
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll_77df0000!RtlRbInsertNodeEx+0x[PII_REDACTED]00002d."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10740; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10740
CVE: CVE-2017-10741
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll_77df0000!RtlpWaitOnCriticalSection+0x[PII_REDACTED]000121."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10741; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10741
CVE: CVE-2017-10742
Published: 2017-07-05
Description: XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x[PII_REDACTED]0a0500 called from ntdll_77df0000!LdrxCallInitRoutine+0x[PII_REDACTED]000016."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10742; https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10742