deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-11195
Published: 2017-07-12
Description: Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99615; http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf; https://twitter.com/sxcurity/status/[PII_REDACTED]45937921
CVE: CVE-2017-11196
Published: 2017-07-12
Description: Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/99613; http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf; https://twitter.com/sxcurity/status/[PII_REDACTED]45937921
CVE: CVE-2017-11174
Published: 2017-07-12
Description: In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://tsublogs.wordpress.com/2017/07/12/xoops-core-2-5-8-1-install-db-sql-injection/; https://tsublogs.wordpress.com/2017/07/12/xoops-core-2-5-8-1-install-db-sql-injection/
CVE: CVE-2017-11198
Published: 2017-07-13
Description: Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get_image.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web script or HTML via the folder, id, or name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Reflected-XSS-in-get-image-php; http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Reflected-XSS-in-get-image-php
CVE: CVE-2017-11200
Published: 2017-07-13
Description: SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Authenticated-SQL-injection; http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Authenticated-SQL-injection
CVE: CVE-2017-11201
Published: 2017-07-13
Description: application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Stored-XSS-in-images-php; http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Stored-XSS-in-images-php
CVE: CVE-2017-11202
Published: 2017-07-13
Description: FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs, a different vulnerability than CVE-2017-11180.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Stored-XSS-in-visitors-php; http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Stored-XSS-in-visitors-php
CVE: CVE-2017-11173
Published: 2017-07-13
Description: Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
CVSS Score: 8.8 (HIGH)
References: http://seclists.org/fulldisclosure/2017/Jul/22; http://www.debian.org/security/2017/dsa-3931; https://github.com/cyu/rack-cors/commit/42ebe6caa8e85ffa9c8a171bda668ba1acc7a5e6
CVE: CVE-2017-11103
Published: 2017-07-13
Description: Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345
References: http://www.debian.org/security/2017/dsa-3912; http://www.h5l.org/advisories.html?show=2017-07-11; http://www.securityfocus.com/bid/99551
CVE: CVE-2017-7529
Published: 2017-07-13
Description: Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html; http://seclists.org/fulldisclosure/2021/Sep/36; http://www.securityfocus.com/bid/99534
CVE: CVE-2016-6019
Published: 2017-07-13
Description: IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 116739.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005839; http://www.securityfocus.com/bid/99589; https://exchange.xforce.ibmcloud.com/vulnerabilities/116739
CVE: CVE-2016-8951
Published: 2017-07-13
Description: IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack. An attacker can exploit a vulnerability in the authentication features that could log out users and flood user accounts with emails. IBM X-Force ID: 118838.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.ibm.com/support/docview.wss?uid=swg22005839; http://www.securityfocus.com/bid/99589; https://exchange.xforce.ibmcloud.com/vulnerabilities/118838
CVE: CVE-2016-8952
Published: 2017-07-13
Description: IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118839.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22005839; http://www.securityfocus.com/bid/99589; https://exchange.xforce.ibmcloud.com/vulnerabilities/118839
CVE: CVE-2016-8964
Published: 2017-07-13
Description: IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-254
References: http://www.ibm.com/support/docview.wss?uid=swg21995024; http://www.securityfocus.com/bid/99548; http://www.securitytracker.com/id/1038919
CVE: CVE-2017-1308
Published: 2017-07-13
Description: IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due to improper access controls. IBM X-Force ID: 125462.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: http://www.ibm.com/support/docview.wss?uid=swg22003806; http://www.securityfocus.com/bid/99549; https://exchange.xforce.ibmcloud.com/vulnerabilities/125462
CVE: CVE-2017-7672
Published: 2017-07-13
Description: If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://struts.apache.org/docs/s2-047.html; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9[PII_REDACTED].html; http://www.securityfocus.com/bid/99563
CVE: CVE-2017-9787
Published: 2017-07-13
Description: When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
CVSS Score: 7.5 (HIGH)
References: http://struts.apache.org/docs/s2-049.html; http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9[PII_REDACTED].html; http://www.securityfocus.com/bid/99562
CVE: CVE-2017-6249
Published: 2017-07-13
Description: An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-34373711. References: N-CVE-2017-6249.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/99616; http://www.securitytracker.com/id/1038623; https://source.android.com/security/bulletin/2017-06-01
CVE: CVE-2017-9788
Published: 2017-07-13
Description: In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-200
References: http://www.debian.org/security/2017/dsa-3913; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/99569
CVE: CVE-2017-9789
Published: 2017-07-13
Description: When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/99568; http://www.securitytracker.com/id/1038907; https://httpd.apache.org/security/vulnerabilities_24.html
CVE: CVE-2017-11310
Published: 2017-07-13
Description: The read_user_chunk_callback function in coders\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vulnerabilities via crafted PNG files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/99585; https://github.com/ImageMagick/ImageMagick/commit/8ca35831e91c3db8c6d281d09b605001003bec08; https://github.com/ImageMagick/ImageMagick/issues/517
CVE: CVE-2015-0249
Published: 2017-07-17
Description: The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://cve.killedkenny.io/cve/CVE-2015-0249; http://www.openwall.com/lists/oss-security/2015/03/30/13; https://mail-archives.apache.org/mod_mbox/roller-user/201503.mbox/%3CCAF1aazAPWTduVhrPr7WiFaspFdsh21yf0YiSB3UmLjtDVGnfXw%40mail.gmail.com%3E
CVE: CVE-2015-5152
Published: 2017-07-17
Description: Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://projects.theforeman.org/issues/11119; https://bugzilla.redhat.com/show_bug.cgi?id=1243571; http://projects.theforeman.org/issues/11119
CVE: CVE-2016-0764
Published: 2017-07-17
Description: Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2016-2581.html; https://bugzilla.redhat.com/show_bug.cgi?id=1324025; http://rhn.redhat.com/errata/RHSA-2016-2581.html
CVE: CVE-2016-10398
Published: 2017-07-17
Description: Android 6.0 has an authentication bypass for attackers with root and physical access. Cryptographic authentication tokens (AuthTokens) used by the Trusted Execution Environment (TEE) are protected by a weak challenge. This allows adversaries to replay previously captured responses and use the TEE without authenticating. All apps using authentication-gated cryptography are vulnerable to this attack, which was confirmed on the LG Nexus 5X.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: https://homepages.staff.os3.nl/~delaat/rp/2015-2016/p30/report.pdf; https://homepages.staff.os3.nl/~delaat/rp/2015-2016/p30/report.pdf
CVE: CVE-2016-4982
Published: 2017-07-17
Description: authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creation of the key, and the chmod to protect it.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1346051; https://bugzilla.redhat.com/show_bug.cgi?id=1346051
CVE: CVE-2016-4984
Published: 2017-07-17
Description: /usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1346120; https://bugzilla.redhat.com/show_bug.cgi?id=1346120
CVE: CVE-2016-4996
Published: 2017-07-17
Description: discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on the console.
CVSS Score: 7.0 (HIGH)
CWE: CWE-255
References: https://access.redhat.com/errata/RHSA-2018:0336; https://bugzilla.redhat.com/show_bug.cgi?id=1349136; https://access.redhat.com/errata/RHSA-2018:0336
CVE: CVE-2016-6312
Published: 2017-07-17
Description: The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly detect recursion during entity expansion, which allows remote authenticated users with access to the webdav repository to cause a denial of service (memory consumption and httpd crash).  NOTE: Exists as a regression to CVE-2009-1955.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/92320; https://bugzilla.redhat.com/show_bug.cgi?id=1364122; http://www.securityfocus.com/bid/92320
CVE: CVE-2016-6793
Published: 2017-07-17
Description: The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2016/12/31/1; http://www.securityfocus.com/archive/1/539975/100/0/threaded; http://www.securityfocus.com/bid/95168
CVE: CVE-2017-0028
Published: 2017-07-17
Description: A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/Microsoft/ChakraCore/commit/402f3d967c0a905ec5b9ca9c240783d3f2c15724; https://github.com/Microsoft/ChakraCore/commit/402f3d967c0a905ec5b9ca9c240783d3f2c15724
CVE: CVE-2017-0152
Published: 2017-07-17
Description: A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: https://github.com/Microsoft/ChakraCore/commit/9da[PII_REDACTED]25a6e95e6be0fa03d7d21d0b517; https://github.com/Microsoft/ChakraCore/commit/9da[PII_REDACTED]25a6e95e6be0fa03d7d21d0b517
CVE: CVE-2017-0196
Published: 2017-07-17
Description: An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/Microsoft/ChakraCore/commit/065b7978c40ded35c356ced6cd922a40156c9c46; https://github.com/Microsoft/ChakraCore/commit/065b7978c40ded35c356ced6cd922a40156c9c46
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/fedora-infra/fedmsg/blob/0.18.2/CHANGELOG.rst; https://github.com/fedora-infra/fedmsg/blob/0.18.2/CHANGELOG.rst
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55; http://www.atutor.ca/atutor/mantis/view.php?id=5681; http://www.securityfocus.com/bid/99599
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Module component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to a incorrect access control check vulnerability in the Alternative Content component resulting in privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55; http://www.atutor.ca/atutor/mantis/view.php?id=5681; http://www.securityfocus.com/bid/99599
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55; http://www.atutor.ca/atutor/mantis/view.php?id=5681; http://www.securityfocus.com/bid/99599
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping of data (stealing data).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/osalabs/phpminiadmin; https://github.com/osalabs/phpminiadmin
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://help.plot.ly/security-advisories/2016-08-08-plotlyjs-xss-advisory/; http://help.plot.ly/security-advisories/2016-08-08-plotlyjs-xss-advisory/
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-295
References: https://github.com/twisted/txaws/issues/24; https://github.com/twisted/txaws/issues/24
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/xenocrat/chyrp-lite/commit/79bb2de7f57d163d256b6bdb127dc09cfdb6235a; https://github.com/xenocrat/chyrp-lite/commit/79bb2de7f57d163d256b6bdb127dc09cfdb6235a
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/akeneo/pim-community-dev/blob/1.5/CHANGELOG-1.5.md#bug-fixes-2; https://github.com/akeneo/pim-community-dev/blob/master/CHANGELOG-1.4.md#bug-fixes; https://github.com/akeneo/pim-community-dev/blob/master/CHANGELOG-1.6.md#bug-fixes-2
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/GitHubAssessments/CVE_Assessments_10_2019; https://packetstormsecurity.com/files/140365/Audacity-2.1.2-DLL-Hijacking.html; https://github.com/GitHubAssessments/CVE_Assessments_10_2019
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of information
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Samnan/MyWebSQL; https://github.com/Samnan/MyWebSQL
CVE: CVE-2[PII_REDACTED]
Published: 2017-07-17
Description: MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/DSB/MySQLDumper; https://github.com/DSB/MySQLDumper