deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0397
Published: 2018-08-01
Description: A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote attacker to cause a kernel panic on an affected system, resulting in a denial of service (DoS) condition. The vulnerability exists if the affected software is running in Block network conviction mode. Exploitation could occur if the system that is running the affected software starts a server process and an address in the IP blacklist cache of the affected software attempts to connect to the affected system. A successful exploit could allow the attacker to cause a kernel panic on the system that is running the affected software, resulting in a DoS condition. Cisco Bug IDs: CSCvk08192.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/104946; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-fampmac; http://www.securityfocus.com/bid/104946
CVE: CVE-2018-0406
Published: 2018-08-01
Description: A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected or Document Object Model based (DOM-based) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve84006.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104945; http://www.securitytracker.com/id/1041406; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-wsa-xss
CVE: CVE-2018-0407
Published: 2018-08-01
Description: A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87326.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104947; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-sb-pxss; http://www.securityfocus.com/bid/104947
CVE: CVE-2018-0408
Published: 2018-08-01
Description: A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87330.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104948; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-sb-rxss; http://www.securityfocus.com/bid/104948
CVE: CVE-2018-0411
Published: 2018-08-01
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvk15343.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104949; http://www.securitytracker.com/id/1041407; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-ucm-xss
CVE: CVE-2018-0413
Published: 2018-08-01
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi85159.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/104950; http://www.securitytracker.com/id/1041408; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-ise-csrf
CVE: CVE-2018-12468
Published: 2018-08-01
Description: A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://www.novell.com/support/kb/doc.php?id=7023223; https://www.novell.com/support/kb/doc.php?id=7023223
CVE: CVE-2018-3881
Published: 2018-08-01
Description: An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially crafted web request to FocalScope's server that could cause an XXE, and potentially result in data compromise.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-611
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0559; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0559
CVE: CVE-2018-3924
Published: 2018-08-01
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securitytracker.com/id/1041353; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0588; http://www.securitytracker.com/id/1041353
CVE: CVE-2018-3939
Published: 2018-08-01
Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0606; https://www.foxitsoftware.com/support/security-bulletins.php; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0606
CVE: CVE-2018-10624
Published: 2018-08-01
Description: In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209, CWE-388
References: http://www.securityfocus.com/bid/104937; https://ics-cert.us-cert.gov/advisories/ICSA-18-212-02; http://www.securityfocus.com/bid/104937
CVE: CVE-2015-9262
Published: 2018-08-01
Description: _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2018:3059; https://access.redhat.com/errata/RHSA-2018:3505; https://bugs.freedesktop.org/show_bug.cgi?id=90857
CVE: CVE-2018-14835
Published: 2018-08-02
Description: Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/intelliants/subrion/issues/760; https://github.com/intelliants/subrion/pull/763/commits; https://github.com/intelliants/subrion/issues/760
CVE: CVE-2018-14836
Published: 2018-08-02
Description: Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions) if the Guests user group has access to the Admin panel.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://github.com/intelliants/subrion/issues/762; https://github.com/intelliants/subrion/issues/762
CVE: CVE-2018-14838
Published: 2018-08-02
Description: rejucms 2.1 has stored XSS via the admin/book.php content parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZBWACD/CodeAudit/blob/master/rejucms_v2.1; https://github.com/ZBWACD/CodeAudit/blob/master/rejucms_v2.1
CVE: CVE-2018-14840
Published: 2018-08-02
Description: uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47; https://github.com/intelliants/subrion/issues/773; https://www.exploit-db.com/exploits/45150/
CVE: CVE-2018-14847
Published: 2018-08-02
Description: MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/BasuCert/WinboxPoC; https://github.com/BigNerd95/WinboxExploit; https://github.com/tenable/routeros/blob/master/bug_hunting_in_routeros_derbycon_2018.pdf
CVE: CVE-2018-2933
Published: 2018-08-02
Description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. Note: Please refer to MOS document
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104763; http://www.securitytracker.com/id/1041301
CVE: CVE-2018-3108
Published: 2018-08-02
Description: Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Notification Service). Supported versions that are affected are 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Fusion Middleware. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Fusion Middleware accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104819; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-3109
Published: 2018-08-02
Description: Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported versions that are affected are 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Fusion Middleware MapViewer accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/104771; http://www.securitytracker.com/id/1041310
CVE: CVE-2018-10920
Published: 2018-08-02
Description: Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10920; https://www.knot-resolver.cz/2018-08-02-knot-resolver-2.4.1.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10920
CVE: CVE-2018-12448
Published: 2018-08-02
Description: Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://cve.naver.com/detail/cve-2018-12448.html; https://cve.naver.com/detail/cve-2018-12448.html
CVE: CVE-2018-1329
Published: 2018-08-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-8032
Published: 2018-08-02
Description: Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13[PII_REDACTED]060[PII_REDACTED]6[PII_REDACTED]060%40Atlassian.JIRA%3E; https://issues.apache.org/jira/browse/AXIS-2924; https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E
CVE: CVE-2018-1336
Published: 2018-08-02
Description: An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C[PII_REDACTED]0435.GA60759%40minotaur.apache.org%3E; http://www.securityfocus.com/bid/104898; http://www.securitytracker.com/id/1041375
CVE: CVE-2018-1554
Published: 2018-08-02
Description: IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142891.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104959; https://exchange.xforce.ibmcloud.com/vulnerabilities/142891; https://www.ibm.com/support/docview.wss?uid=ibm10713695
CVE: CVE-2018-8037
Published: 2018-08-02
Description: If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C[PII_REDACTED]0623.GA92700%40minotaur.apache.org%3E; http://mail-archives.us.apache.org/mod_mbox/www-announce/201808.mbox/%3C0c616b4d-4e81-e7f8-b81d-1bb4c575aa33%40apache.org%3E; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2017-9118
Published: 2018-08-02
Description: PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:2519; https://bugs.php.net/bug.php?id=74604; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-9120
Published: 2018-08-02
Description: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2019:2519; https://bugs.php.net/bug.php?id=74544; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-7649
Published: 2018-08-02
Description: Monitorix before 3.10.1 allows XSS via CGI variables.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.monitorix.org/changelog.html; http://www.monitorix.org/changelog.html
CVE: CVE-2018-10921
Published: 2018-08-02
Description: Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially lead to corruption of the input file due to a lack of checking return codes of fgetc/fputc function calls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10921; https://github.com/hisdeedsaredust/ttembed/issues/3; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10921
CVE: CVE-2018-10922
Published: 2018-08-02
Description: An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of service condition due to ttembed trusting attacker controlled values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10922; https://github.com/hisdeedsaredust/ttembed/issues/2; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10922
CVE: CVE-2017-14444
Published: 2018-08-02
Description: An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the URL parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-119
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0493; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0493
CVE: CVE-2017-14445
Published: 2018-08-02
Description: An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0494; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0494
CVE: CVE-2017-14446
Published: 2018-08-02
Description: An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0495; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0495
CVE: CVE-2017-16338
Published: 2018-08-02
Description: An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bad0 the value for the host key is copied using strcpy to the buffer at 0xa00016e0. This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484
CVE: CVE-2017-16339
Published: 2018-08-02
Description: An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large, sending anything longer will cause a buffer overflow.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484
CVE: CVE-2017-16340
Published: 2018-08-02
Description: An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c0e8 the value for the s_dport key is copied using strcpy to the buffer at 0xa000180c. This buffer is 6 bytes large, sending anything longer will cause a buffer overflow.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484
CVE: CVE-2017-16341
Published: 2018-08-02
Description: An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c224 the value for the s_vol_play key is copied using strcpy to the buffer at 0xa0000418. This buffer is maximum 8 bytes large (this is the maximum size it could be, it is possible other global variables are stored between this variable and the next one that we could identify), sending anything longer will cause a buffer overflow.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484