deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-5665
Published: 2017-03-01
Description: The splt_cue_export_to_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/95906; https://blogs.gentoo.org/ago/2017/01/29/mp3splt-null-pointer-dereference-in-splt_cue_export_to_file-cue-c/; http://www.securityfocus.com/bid/95906
CVE: CVE-2017-5666
Published: 2017-03-01
Description: The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (invalid free and crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://www.securityfocus.com/bid/95908; https://blogs.gentoo.org/ago/2017/01/29/mp3splt-invalid-free-in-free_options-options_manager-c/; http://www.securityfocus.com/bid/95908
CVE: CVE-2017-5851
Published: 2017-03-01
Description: The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.  NOTE: this typically has no risk; this crash of this command-line program has no further consequences for availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/96002; https://blogs.gentoo.org/ago/2017/02/01/mp3splt-null-pointer-dereference-in-free_options-options_manager-c/; http://www.securityfocus.com/bid/96002
CVE: CVE-2017-5852
Published: 2017-03-01
Description: The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2017/02/01/12; http://www.openwall.com/lists/oss-security/2017/02/02/10; http://www.securityfocus.com/bid/97032
CVE: CVE-2017-5853
Published: 2017-03-01
Description: Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/96066; https://blogs.gentoo.org/ago/2017/02/01/podofo-signed-integer-overflow-in-pdfparser-cpp/; http://www.securityfocus.com/bid/96066
CVE: CVE-2017-5854
Published: 2017-03-01
Description: base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2017/02/01/14; http://www.openwall.com/lists/oss-security/2017/02/02/12; http://www.securityfocus.com/bid/96072
CVE: CVE-2017-5855
Published: 2017-03-01
Description: The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/96516; https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-podofopdfparserreadxrefsubsection-pdfparser-cpp/; http://www.securityfocus.com/bid/96516
CVE: CVE-2017-5886
Published: 2017-03-01
Description: Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96512; https://blogs.gentoo.org/ago/2017/02/03/podofo-heap-based-buffer-overflow-in-podofopdftokenizergetnexttoken-pdftokenizer-cpp/; http://www.securityfocus.com/bid/96512
CVE: CVE-2017-5974
Published: 2017-03-01
Description: Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3878; http://www.openwall.com/lists/oss-security/2017/02/14/3; http://www.securityfocus.com/bid/96268
CVE: CVE-2017-5975
Published: 2017-03-01
Description: Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3878; http://www.openwall.com/lists/oss-security/2017/02/14/3; http://www.securityfocus.com/bid/96268
CVE: CVE-2017-5976
Published: 2017-03-01
Description: Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3878; http://www.openwall.com/lists/oss-security/2017/02/14/3; http://www.securityfocus.com/bid/96268
CVE: CVE-2017-5977
Published: 2017-03-01
Description: The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2017/02/14/3; http://www.securityfocus.com/bid/96268; https://blogs.gentoo.org/ago/2017/02/09/zziplib-invalid-memory-read-in-zzip_mem_entry_extra_block-memdisk-c/
CVE: CVE-2017-5978
Published: 2017-03-01
Description: The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3878; http://www.securityfocus.com/bid/96268; https://blogs.gentoo.org/ago/2017/02/09/zziplib-out-of-bounds-read-in-zzip_mem_entry_new-memdisk-c/
CVE: CVE-2017-5979
Published: 2017-03-01
Description: The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2017/dsa-3878; http://www.securityfocus.com/bid/96268; https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in-prescan_entry-fseeko-c/
CVE: CVE-2017-5980
Published: 2017-03-01
Description: The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2017/dsa-3878; http://www.securityfocus.com/bid/96268; https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in-zzip_mem_entry_new-memdisk-c/
CVE: CVE-2017-5981
Published: 2017-03-01
Description: seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: http://www.debian.org/security/2017/dsa-3878; http://www.securityfocus.com/bid/96268; https://blogs.gentoo.org/ago/2017/02/09/zziplib-assertion-failure-in-seeko-c/
CVE: CVE-2017-2685
Published: 2017-03-01
Description: Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and 3.0.6 (excluding) contain a vulnerability that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-693, CWE-200
References: http://www.securityfocus.com/bid/96519; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-934525.pdf; http://www.securityfocus.com/bid/96519
CVE: CVE-2016-10151
Published: 2017-03-01
Description: The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2017/01/21/1; http://www.securityfocus.com/bid/90952; https://bugzilla.redhat.com/show_bug.cgi?id=1332508
CVE: CVE-2016-5374
Published: 2017-03-01
Description: NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the owner_rights ACL entry.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/96524; https://kb.netapp.com/support/s/article/ka51A00000007IBQAY/NTAP-20[PII_REDACTED]?language=en_US; http://www.securityfocus.com/bid/96524
CVE: CVE-2016-6485
Published: 2017-03-01
Description: The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://www.openwall.com/lists/oss-security/2016/07/19/3; http://www.openwall.com/lists/oss-security/2016/07/27/14; https://github.com/magento/magento2/pull/15017
CVE: CVE-2016-9830
Published: 2017-03-01
Description: The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://hg.code.sf.net/p/graphicsmagick/code/rev/38d0f281e8c8; http://lists.opensuse.org/opensuse-updates/2016-12/msg00141.html; http://www.debian.org/security/2016/dsa-3746
CVE: CVE-2017-5995
Published: 2017-03-01
Description: The NetApp ONTAP Select Deploy administration utility 2.0 through 2.2.1 might allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/96522; https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]; http://www.securityfocus.com/bid/96522
CVE: CVE-2017-6345
Published: 2017-03-01
Description: The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b74d439e1697110c5e5c600643e823eb1dd0762; http://www.debian.org/security/2017/dsa-3804; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.13
CVE: CVE-2017-6346
Published: 2017-03-01
Description: Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that makes PACKET_FANOUT setsockopt system calls.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d199fab63c11998a602205f7ee7ff7c05c97164b; http://www.debian.org/security/2017/dsa-3804; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.13
CVE: CVE-2017-6347
Published: 2017-03-01
Description: The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data layout, which allows local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted system calls, as demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP transmission.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca4ef4574f1ee5252e2cd365f8f5d5bafd048f32; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.1; http://www.openwall.com/lists/oss-security/2017/02/28/5
CVE: CVE-2017-6348
Published: 2017-03-01
Description: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices.
CVSS Score: 5.5 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c03b862b12f980456f9de92db6d508a4999b788; http://www.debian.org/security/2017/dsa-3804; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.13
CVE: CVE-2017-6353
Published: 2017-03-01
Description: net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dfcb9f4f99f1e9a49e43398a7bfbf56927544af1; http://www.debian.org/security/2017/dsa-3804; http://www.openwall.com/lists/oss-security/2017/02/27/2
CVE: CVE-2016-2879
Published: 2017-03-01
Description: IBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a local user to obtain and decrypt user credentials. IBM Reference #: 1997341.
CVSS Score: 7.8 (HIGH)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=swg21997341; http://www.securityfocus.com/bid/96502; http://www.ibm.com/support/docview.wss?uid=swg21997341
CVE: CVE-2016-2880
Published: 2017-03-01
Description: IBM QRadar 7.2 stores the encryption key used to encrypt the service account password which can be obtained by a local user. IBM Reference #: 1997340.
CVSS Score: 7.8 (HIGH)
CWE: CWE-320
References: http://www.ibm.com/support/docview.wss?uid=swg21997340; http://www.securityfocus.com/bid/96614; http://www.ibm.com/support/docview.wss?uid=swg21997340
CVE: CVE-2016-5932
Published: 2017-03-01
Description: IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998294.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21998294; http://www.securityfocus.com/bid/96453; http://www.ibm.com/support/docview.wss?uid=swg21998294
CVE: CVE-2016-8232
Published: 2017-03-01
Description: Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) versions earlier than 66Z of Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 allows an unauthenticated attacker with access to the AMM's IP address to send a crafted URL that could inject a malicious script to access a user's AMM data such as cookies or other session information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/95839; https://exchange.xforce.ibmcloud.com/vulnerabilities/121443; https://support.lenovo.com/us/en/product_security/LEN-5700
CVE: CVE-2016-9992
Published: 2017-03-01
Description: IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1992067.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg21992067; http://www.ibm.com/support/docview.wss?uid=swg21992067
CVE: CVE-2016-9993
Published: 2017-03-01
Description: IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1992067.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg21992067; http://www.ibm.com/support/docview.wss?uid=swg21992067
CVE: CVE-2016-9994
Published: 2017-03-01
Description: IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1976805.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg21976805; http://www.ibm.com/support/docview.wss?uid=swg21976805
CVE: CVE-2017-3826
Published: 2017-03-01
Description: A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder of the Cisco NetFlow Generation Appliance (NGA) with software before 1.1(1a) could allow an unauthenticated, remote attacker to cause the device to hang or unexpectedly reload, causing a denial of service (DoS) condition. The vulnerability is due to incomplete validation of SCTP packets being monitored on the NGA data ports. An attacker could exploit this vulnerability by sending malformed SCTP packets on a network that is monitored by an NGA data port. SCTP packets addressed to the IP address of the NGA itself will not trigger this vulnerability. An exploit could allow the attacker to cause the appliance to become unresponsive or reload, causing a DoS condition. User interaction could be needed to recover the device using the reboot command from the CLI. The following Cisco NetFlow Generation Appliances are vulnerable: NGA 3140, NGA 3240, NGA 3340. Cisco Bug IDs: CSCvc83320.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-20
References: http://www.securityfocus.com/bid/96509; http://www.securitytracker.com/id/1037938; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170301-nga
CVE: CVE-2016-8233
Published: 2017-03-01
Description: Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that could be viewed by a non-privileged user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: http://www.securityfocus.com/bid/95992; https://support.lenovo.com/us/en/product_security/LEN-11635; http://www.securityfocus.com/bid/95992
CVE: CVE-2016-10228
Published: 2017-03-02
Description: The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2017/03/01/10; http://www.securityfocus.com/bid/96525; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE: CVE-2017-6319
Published: 2017-03-02
Description: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/96520; https://github.com/radare/radare2/commit/ad55822430a03fe075221b543efb434567e9e431; https://github.com/radare/radare2/issues/6836
CVE: CVE-2017-6387
Published: 2017-03-02
Description: The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DEX file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/96521; https://github.com/radare/radare2/commit/ead645853a63bf83d8386702cad0cf23b31d7eeb; https://github.com/radare/radare2/issues/6857
CVE: CVE-2017-6415
Published: 2017-03-02
Description: The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/96523; https://github.com/radare/radare2/issues/6872; https://github.com/radareorg/radare2/commit/68338b71a563b24e62617bb629059adc0c94b230
CVE: CVE-2015-8994
Published: 2017-03-02
Description: An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode ("opcode" in PHP jargon). Cache keys vary depending on configuration, but filename is a central key component, and compiled opcode can generally be run if a script's filename is known or can be guessed. Many common shared-hosting configurations change EUID in child processes to enforce privilege separation among hosted users (for example using mod_ruid2 for the Apache HTTP Server, or php-fpm user settings). In these scenarios, the default Zend OpCache behavior defeats script file permissions by sharing a single SHM cache among all child PHP processes. PHP scripts often contain sensitive information: Think of CMS configurations where reading or running another user's script usually means gaining privileges to the CMS database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=php-internals&m=[PII_REDACTED]7925&w=2; http://marc.info/?l=php-internals&m=[PII_REDACTED]4565&w=2; http://openwall.com/lists/oss-security/2017/02/28/1
CVE: CVE-2017-6062
Published: 2017-03-02
Description: The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287
References: https://github.com/pingidentity/mod_auth_openidc/blob/master/ChangeLog; https://github.com/pingidentity/mod_auth_openidc/issues/222; https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.5
CVE: CVE-2017-6384
Published: 2017-03-02
Description: Memory leak in the login_user function in saslserv/main.c in saslserv/main.so in Atheme 7.2.7 allows a remote unauthenticated attacker to consume memory and cause a denial of service. This is fixed in 7.2.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: http://www.securityfocus.com/bid/96552; https://github.com/atheme/atheme/pull/539; https://github.com/atheme/atheme/releases/tag/v7.2.8
CVE: CVE-2017-6390
Published: 2017-03-02
Description: An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/96555; https://github.com/soruly/whatanime.ga/commit/c334dd8499a681587dd4199e90b0aa0eba814c1d; https://github.com/soruly/whatanime.ga/issues/8