deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-15594
Published: 2017-10-18
Description: An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.
CVSS Score: 8.8 (HIGH)
References: http://www.securitytracker.com/id/1039568; https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html; https://security.gentoo.org/glsa/201801-14
CVE: CVE-2017-15595
Published: 2017-10-18
Description: An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking.
CVSS Score: 8.8 (HIGH)
CWE: CWE-400
References: https://lists.debian.org/debian-lts-announce/2017/11/msg00027.html; https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html; https://security.gentoo.org/glsa/201801-14
CVE: CVE-2017-15596
Published: 2017-10-18
Description: An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishandling upon detection of an add-to-physmap error.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-400
References: http://www.debian.org/security/2017/dsa-3969; http://www.securitytracker.com/id/1039568; https://xenbits.xen.org/xsa/advisory-235.html
CVE: CVE-2017-8024
Published: 2017-10-18
Description: EMC Isilon OneFS (versions prior to 8.1.0.1, versions prior to 8.0.1.2, versions prior to 8.0.0.6, version 7.2.1.x) is impacted by a reflected cross-site scripting vulnerability that may potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2017/Oct/34; http://seclists.org/fulldisclosure/2017/Oct/34
CVE: CVE-2017-13083
Published: 2017-10-18
Description: Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily convince a user to execute arbitrary code
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295, CWE-345, CWE-347, CWE-494, CWE-494
References: http://www.kb.cert.org/vuls/id/403768; http://www.securityfocus.com/bid/100516; https://github.com/pbatard/rufus/commit/c3c39f7f8a11f612c4ebf7affce25ec6928eb1cb
CVE: CVE-2011-5320
Published: 2017-10-18
Description: scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) via a large string of 0s.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2015/03/12/14; https://bugzilla.redhat.com/show_bug.cgi?id=1196745; https://marc.info/?l=gimp-developer&m=[PII_REDACTED]5823&w=2
CVE: CVE-2014-3164
Published: 2017-10-18
Description: cmds/servicemanager/service_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5 allows attackers to cause a denial of service (NULL pointer dereference, or out-of-bounds write) via vectors related to binder passed lengths.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/101506; https://android-review.googlesource.com/#/c/platform/frameworks/native/+/101104/; https://android-review.googlesource.com/#/c/platform/frameworks/native/+/101104/1/cmds/servicemanager/service_manager.c
CVE: CVE-2014-3531
Published: 2017-10-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://projects.theforeman.org/issues/6580; https://bugzilla.redhat.com/show_bug.cgi?id=1108745; https://github.com/theforeman/foreman/pull/1580
CVE: CVE-2014-3706
Published: 2017-10-18
Description: ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/101507; https://bugzilla.redhat.com/show_bug.cgi?id=1154977; http://www.securityfocus.com/bid/101507
CVE: CVE-2014-3709
Published: 2017-10-18
Description: The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/101508; https://bugzilla.redhat.com/show_bug.cgi?id=1154971; https://issues.jboss.org/browse/KEYCLOAK-765
CVE: CVE-2014-7242
Published: 2017-10-18
Description: The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission application 1.2.2 and earlier for Android allow man-in-the-middle attackers to spoof servers and obtain sensitive information by leveraging failure to verify SSL/TLS server certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN27388160/index.html; http://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000125.html; http://jvn.jp/en/jp/JVN27388160/index.html
CVE: CVE-2014-7813
Published: 2017-10-18
Description: Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack of garbage collection of inserted symbols.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1157872; https://bugzilla.redhat.com/show_bug.cgi?id=1157872
CVE: CVE-2014-8491
Published: 2017-10-18
Description: The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widget_default/gallery.php or (2) flash-album-gallery/skins/banner_widget_default/gallery.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://g0blin.co.uk/cve-2014-8491/; https://wpvulndb.com/vulnerabilities/8238; https://g0blin.co.uk/cve-2014-8491/
CVE: CVE-2015-2156
Published: 2017-10-18
Description: Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html; http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html
CVE: CVE-2015-3400
Published: 2017-10-18
Description: sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might allow remote authenticated users to obtain sensitive information by reading shared files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2015/04/22/4; http://www.securityfocus.com/bid/74272; https://github.com/FransUrbo/zfs/commit/99aa4d2b4fd12c6bef62d02ffd1b375ddd42fcf4
CVE: CVE-2017-8022
Published: 2017-10-18
Description: An issue was discovered in EMC NetWorker (prior to 8.2.4.9, all supported 9.0.x versions, prior to 9.1.1.3, prior to 9.2.0.4). The Server service (nsrd) is affected by a buffer overflow vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on vulnerable installations of the software, or cause a denial of service, depending on the target system's platform.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2017/Oct/35; http://www.securitytracker.com/id/1039583; http://seclists.org/fulldisclosure/2017/Oct/35
CVE: CVE-2015-5164
Published: 2017-10-18
Description: The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://bugzilla.redhat.com/show_bug.cgi?id=1247732; https://pulp.plan.io/issues/23; https://bugzilla.redhat.com/show_bug.cgi?id=1247732
CVE: CVE-2015-1239
Published: 2017-10-18
Description: Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://bugs.chromium.org/p/chromium/issues/detail?id=430891; https://bugs.chromium.org/p/chromium/issues/detail?id=457493; https://lists.debian.org/debian-lts-announce/2018/07/msg00025.html
CVE: CVE-2015-7714
Published: 2017-10-18
Description: Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitrary SQL commands via the (1) id, (2) copy_field in a data_copy action, (3) pshow in an update_field action, (4) css, (5) tip, (6) cat_id, (7) text_search, (8) plisting, or (9) pwizard parameter to administrator/index.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/134066/Realtyna-RPL-8.9.2-SQL-Injection.html; http://rpl.realtyna.com/change-logs/rpl7-changelog; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5272.php
CVE: CVE-2015-7715
Published: 2017-10-18
Description: Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an add_user action to administrator/index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/134067/Realtyna-RPL-8.9.2-CSRF-Cross-Site-Scripting.html; http://rpl.realtyna.com/change-logs/rpl7-changelog; http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.php
CVE: CVE-2015-7943
Published: 2017-10-18
Description: Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.debian.org/security/2017/dsa-3897; http://www.securityfocus.com/bid/77293; https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2015-10-21/drupal-core-overlay-less-critical
CVE: CVE-2016-5714
Published: 2017-10-18
Description: Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://bugs.gentoo.org/597684; https://puppet.com/security/cve/cve-2016-5714; https://puppet.com/security/cve/pxp-agent-oct-2016
CVE: CVE-2017-14322
Published: 2017-10-18
Description: The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication and obtain administrative access by using the IEM_CookieLogin cookie with a specially crafted value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2017/Oct/39; https://security.infoteam.ch/en/blog/posts/narrative-of-an-incident-response-from-compromise-to-the-publication-of-the-weakness.html; https://www.exploit-db.com/exploits/44513/
CVE: CVE-2017-14956
Published: 2017-10-18
Description: AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/144617/AlienVault-USM-5.4.2-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2017/Oct/32; http://www.securityfocus.com/archive/1/541342/100/0/threaded
CVE: CVE-2017-15359
Published: 2017-10-18
Description: In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to access sensitive information to aid in subsequent attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2017/Oct/37; https://www.exploit-db.com/exploits/42991/; http://seclists.org/fulldisclosure/2017/Oct/37
CVE: CVE-2015-5227
Published: 2017-10-18
Description: The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://wordpress.org/plugins/landing-pages/#developers; https://wpvulndb.com/vulnerabilities/8200; https://wordpress.org/plugins/landing-pages/#developers
CVE: CVE-2015-5376
Published: 2017-10-18
Description: SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers to execute arbitrary SQL commands via the username field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://bogner.sh/2015/09/winpat-portal-3-unauthenticated-sql-injection-exploit/; https://bogner.sh/2015/09/winpat-portal-3-unauthenticated-sql-injection-exploit/
CVE: CVE-2015-5739
Published: 2017-10-18
Description: The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html; http://rhn.redhat.com/errata/RHSA-2016-1538.html
CVE: CVE-2015-5740
Published: 2017-10-18
Description: The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html; http://rhn.redhat.com/errata/RHSA-2016-1538.html
CVE: CVE-2015-6961
Published: 2017-10-18
Description: Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the _next parameter to user/logout.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/web2py/web2py/commit/e31a099cb3456fef[PII_REDACTED]53430ae59056b0; https://github.com/web2py/web2py/issues/731; https://github.com/web2py/web2py/commit/e31a099cb3456fef[PII_REDACTED]53430ae59056b0
CVE: CVE-2017-15600
Published: 2017-10-18
Description: In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00004.html; https://bugzilla.redhat.com/show_bug.cgi?id=1501695; https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz
CVE: CVE-2017-15601
Published: 2017-10-18
Description: In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/png_extractor.c, related to processiTXt and stndup.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00006.html; https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz; https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
CVE: CVE-2017-15602
Published: 2017-10-18
Description: In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00005.html; https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz; https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
CVE: CVE-2017-12251
Published: 2017-10-19
Description: A vulnerability in the web console of the Cisco Cloud Services Platform (CSP) 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines (VMs) operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation of certain authentication mechanisms in the URL of the web console. An attacker could exploit this vulnerability by browsing to one of the hosted VMs' URLs in Cisco CSP and viewing specific patterns that control the web application's mechanisms for authentication control. An exploit could allow the attacker to access a specific VM on the CSP, which causes a complete loss of the system's confidentiality, integrity, and availability. This vulnerability affects Cisco Cloud Services Platform (CSP) 2100 running software release 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, or 2.2.2. Cisco Bug IDs: CSCve64690.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-264, CWE-287
References: http://www.securityfocus.com/bid/101487; http://www.securitytracker.com/id/1039613; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-ccs
CVE: CVE-2017-12259
Published: 2017-10-19
Description: A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA51x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by sending malformed SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA51x Series IP Phones that are running Cisco SPA51x Firmware Release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63982.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/101488; http://www.securitytracker.com/id/1039615; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip
CVE: CVE-2017-12260
Published: 2017-10-19
Description: A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/101495; http://www.securitytracker.com/id/1039616; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1
CVE: CVE-2017-12271
Published: 2017-10-19
Description: A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCuz88421, CSCuz91356, CSCve56308.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/101524; http://www.securitytracker.com/id/1039621; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-spa
CVE: CVE-2017-12272
Published: 2017-10-19
Description: A vulnerability in the web framework code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected software. An attacker could exploit this vulnerability by convincing a user of the web interface to access a malicious link or by intercepting a user request for the affected web interface and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvb09516.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/101494; http://www.securitytracker.com/id/1039627; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-cisco-ios-xe
CVE: CVE-2017-12284
Published: 2017-10-19
Description: A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profile information, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input- and validation-checking mechanisms in the system. An attacker could exploit this vulnerability by issuing specific commands after authenticating to the system. A successful exploit could allow the attacker to view profile information where only certain parameters should be visible. Cisco Bug IDs: CSCve14401.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/101501; http://www.securitytracker.com/id/1039624; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-jab