deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-4422
Published: 2017-10-19
Description: The TEEOS module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a denial of service (memory corruption) via a crafted application.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/74742; http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-432799.htm; http://www.securityfocus.com/bid/74742
CVE: CVE-2015-6668
Published: 2017-10-19
Description: The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://vagmour.eu/cve-2015-6668-cv-filename-disclosure-on-job-manager-wordpress-plugin/; https://wpvulndb.com/vulnerabilities/8167; https://vagmour.eu/cve-2015-6668-cv-filename-disclosure-on-job-manager-wordpress-plugin/
CVE: CVE-2017-10933
Published: 2017-10-19
Description: All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerability that allows remote attackers to read arbitrary files on the system via a full path name after host address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008582; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008582
CVE: CVE-2017-15643
Published: 2017-10-19
Description: An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP for updates along with a CRC32 checksum and an update value for verification of the downloaded files. The attacker first forces the client to initiate an update transaction by modifying an update field within an HTTP 200 response, so that it refers to a nonexistent update. The attacker then modifies the HTTP 404 response so that it specifies a successfully found update, with a Trojan horse executable file (e.g., guardxup.exe) and the correct CRC32 checksum for that file.
CVSS Score: 7.4 (HIGH)
CWE: CWE-444
References: https://blogs.securiteam.com/index.php/archives/3485; https://www.ikarussecurity.com/about-ikarus/security-blog/vulnerability-in-windows-antivirus-products-ik-sa-2017-0001/; https://blogs.securiteam.com/index.php/archives/3485
CVE: CVE-2017-15644
Published: 2017-10-19
Description: SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: http://www.webmin.com/changes.html; http://www.webmin.com/security.html; https://blogs.securiteam.com/index.php/archives/3430
CVE: CVE-2017-15645
Published: 2017-10-19
Description: CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.webmin.com/changes.html; http://www.webmin.com/security.html; https://blogs.securiteam.com/index.php/archives/3430
CVE: CVE-2017-15646
Published: 2017-10-19
Description: Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.webmin.com/changes.html; http://www.webmin.com/security.html; https://blogs.securiteam.com/index.php/archives/3430
CVE: CVE-2017-15647
Published: 2017-10-19
Description: On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blogs.securiteam.com/index.php/archives/3472; https://blogs.securiteam.com/index.php/archives/3472
CVE: CVE-2017-15648
Published: 2017-10-19
Description: In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.phpsugar.com/blog/2017/10/php-melody-v2-7-3-maintenance-release/; https://blogs.securiteam.com/index.php/archives/3464; http://www.phpsugar.com/blog/2017/10/php-melody-v2-7-3-maintenance-release/
CVE: CVE-2017-15649
Published: 2017-10-19
Description: net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=008ba2a13f2d04c947adc536d19debb8fe66f110; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4971613c1639d8e5f102c4e797c3bf8f83a5a69e; http://patchwork.ozlabs.org/patch/813945/
CVE: CVE-2017-14017
Published: 2017-10-19
Description: An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An uncontrolled search path element vulnerability has been identified, which may allow a remote attacker without privileges to execute arbitrary code in the form of a malicious DLL file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: http://www.securityfocus.com/bid/101483; https://ics-cert.us-cert.gov/advisories/ICSA-17-290-01; http://www.securityfocus.com/bid/101483
CVE: CVE-2017-14019
Published: 2017-10-19
Description: An Unquoted Search Path or Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An unquoted search path or element vulnerability has been identified, which may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate his or her privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428, CWE-428
References: http://www.securityfocus.com/bid/101483; https://ics-cert.us-cert.gov/advisories/ICSA-17-290-01; http://www.securityfocus.com/bid/101483
CVE: CVE-2017-15650
Published: 2017-10-19
Description: musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses, and thus an attacker can provide an unexpected number by sending A records in a reply to an AAAA query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.musl-libc.org/cgit/musl/commit/?id=45ca5d3fcb6f874bf5ba55d0e9651cef68515395; http://git.musl-libc.org/cgit/musl/tree/WHATSNEW; http://openwall.com/lists/oss-security/2017/10/19/5
CVE: CVE-2017-15651
Published: 2017-10-20
Description: PRTG Network Monitor 17.3.33.2830 allows remote authenticated administrators to execute arbitrary code by uploading a .exe file and then proceeding in spite of the error message.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://medium.com/stolabs/security-issue-on-prtg-network-manager-ada65b45d37b; https://medium.com/stolabs/security-issue-on-prtg-network-manager-ada65b45d37b
CVE: CVE-2017-2131
Published: 2017-10-20
Description: Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allow an attacker to bypass access restrictions to view the configuration menu via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101581; https://jvn.jp/en/jp/JVN54795166/; http://www.securityfocus.com/bid/101581
CVE: CVE-2017-2132
Published: 2017-10-20
Description: Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allow an attacker to delete arbitrary files in a specific directory via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101584; https://jvn.jp/en/jp/JVN54795166/; http://www.securityfocus.com/bid/101584
CVE: CVE-2017-2133
Published: 2017-10-20
Description: SQL injection vulnerability in Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/101583; https://jvn.jp/en/jp/JVN54795166/; http://www.securityfocus.com/bid/101583
CVE: CVE-2017-14937
Published: 2017-10-20
Description: The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (or the OBD connector). This affects the airbag control units (aka pyrotechnical control units or PCUs) of unspecified passenger vehicles manufactured in 2014 or later, when the ignition is on and the speed is less than 6 km/h. Specifically, there are only 256 possible key pairs, and authentication attempts have no rate limit. In addition, at least one manufacturer's interpretation of the ISO 26021 standard is that it must be possible to calculate the key directly (i.e., the other 255 key pairs must not be used). Exploitation would typically involve an attacker who has already gained access to the CAN bus, and sends a crafted Unified Diagnostic Service (UDS) message to detonate the pyrotechnical charges, resulting in the same passenger-injury risks as in any airbag deployment.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-327
References: http://www.mmt.hs-karlsruhe.de/downloads/IEEM/Schwachstellen/PCU_Vulnerability_Description_HsKA.PDF; https://www.rapid7.com/db/modules/post/hardware/automotive/pdt; https://www.researchgate.net/publication/321183727_Security_Evaluation_of_an_Airbag-ECU_by_Reusing_Threat_Modeling_Artefacts
CVE: CVE-2017-12628
Published: 2017-10-20
Description: The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/101532; https://www.mail-archive.com/server-user%40james.apache.org/msg15633.html; http://www.securityfocus.com/bid/101532
CVE: CVE-2017-6141
Published: 2017-10-20
Description: In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel (TMM). The Session Ticket option is disabled by default.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K21154730; https://support.f5.com/csp/article/K21154730
CVE: CVE-2017-6144
Published: 2017-10-20
Description: In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code (TAC) database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in BIG-IP PEM for Device Type and OS (DTOS) and Tethering detection. Customers not using BIG-IP PEM, not configuring downloads of TAC database files, or not using HTTP for that download are not affected.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://support.f5.com/csp/article/K81601350; https://support.f5.com/csp/article/K81601350
CVE: CVE-2017-6145
Published: 2017-10-20
Description: iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.
CVSS Score: 7.3 (HIGH)
CWE: CWE-613
References: https://support.f5.com/csp/article/K22317030; https://support.f5.com/csp/article/K22317030
CVE: CVE-2017-6165
Published: 2017-10-20
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5.1 HF6 through 11.5.4 HF4, 11.6.0 through 11.6.1 HF1, and 12.0.0 through 12.1.2 on VIPRION platforms only, the script which synchronizes SafeNet External Network HSM configuration elements between blades in a clustered deployment will log the HSM partition password in cleartext to the "/var/log/ltm" log file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: http://www.securityfocus.com/bid/101543; http://www.securitytracker.com/id/1039638; https://support.f5.com/csp/article/K74759095
CVE: CVE-2017-15291
Published: 2017-10-20
Description: Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows remote attackers to inject arbitrary web script or HTML via the Description field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fireshellsecurity.team/assets/pdf/Router-TP-LINK-TL-MR3220-Vulnerability-XSS.pdf; https://www.exploit-db.com/exploits/43023/; https://fireshellsecurity.team/assets/pdf/Router-TP-LINK-TL-MR3220-Vulnerability-XSS.pdf
CVE: CVE-2017-15670
Published: 2017-10-20
Description: The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101521; https://access.redhat.com/errata/RHSA-2018:0805; https://access.redhat.com/errata/RHSA-2018:1879
CVE: CVE-2017-15671
Published: 2017-10-20
Description: The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-772
References: http://www.securityfocus.com/bid/101517; https://sourceware.org/bugzilla/show_bug.cgi?id=22325; http://www.securityfocus.com/bid/101517
CVE: CVE-2010-3659
Published: 2017-10-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified parameters to unknown backend forms.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2010/09/28/8; http://www.openwall.com/lists/oss-security/2014/02/12/8; http://www.securityfocus.com/bid/42029
CVE: CVE-2011-1935
Published: 2017-10-20
Description: pcap-linux.c in libpcap 1.1.1 before commit ea9432fabdf4b33cbc76d9437200e028f1c47c93 when snaplen is set may truncate packets, which might allow remote attackers to send arbitrary data while avoiding detection via crafted packets.
CVSS Score: 9.8 (CRITICAL)
References: http://article.gmane.org/gmane.network.tcpdump.devel/4968; http://thread.gmane.org/gmane.network.tcpdump.devel/5018; http://www.openwall.com/lists/oss-security/2011/05/19/11
CVE: CVE-2013-6049
Published: 2017-10-20
Description: apt-listbugs before 0.1.10 creates temporary files insecurely, which allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/02/08/5; https://security-tracker.debian.org/tracker/CVE-2013-6049/; http://www.openwall.com/lists/oss-security/2014/02/08/5
CVE: CVE-2017-13127
Published: 2017-10-20
Description: The VIP.com application for IOS and Android allows remote attackers to obtain sensitive information and hijack the authentication of users via a rogue access point and a man-in-the-middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://ibreakthings.com/2017/10/13/cve-2017-13127-security-teams-care/; https://ibreakthings.com/2017/10/13/cve-2017-13127-security-teams-care/
CVE: CVE-2015-5177
Published: 2017-10-22
Description: Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) via a crafted package.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: http://sourceforge.net/p/openslp/mercurial/ci/2bc15d0494f886d9c4fe342d23bc160605aea51d/; http://www.securityfocus.com/bid/76635; http://www.securitytracker.com/id/1033719
CVE: CVE-2015-5699
Published: 2017-10-22
Description: The Switch Configuration Tools Backend (clcmd_server) in Cumulus Linux 2.5.3 and earlier allows local users to execute arbitrary commands via shell metacharacters in a cl-rctl command label.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2015/Aug/23; http://seclists.org/fulldisclosure/2015/Aug/23
CVE: CVE-2017-12317
Published: 2017-10-22
Description: The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application software. The vulnerability is due to the use of a static key value stored in the application used to encrypt the connector protection password. An attacker could exploit this vulnerability by gaining local, administrative access to a Windows host and stopping the Cisco AMP for Endpoints service. Cisco Bug IDs: CSCvg42904.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/101520; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171020-ampfe; http://www.securityfocus.com/bid/101520
CVE: CVE-2017-15727
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpMyFAQ/commit/5c3e4f96ff0ef6b91a3f0aa64eb28197c5cf5435; https://www.exploit-db.com/exploits/43063/; https://github.com/thorsten/phpMyFAQ/commit/5c3e4f96ff0ef6b91a3f0aa64eb28197c5cf5435
CVE: CVE-2017-15728
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpMyFAQ/commit/2d2a85b59e058869d7cbcfe2d73fed4a282f2e5b; https://github.com/thorsten/phpMyFAQ/commit/2d2a85b59e058869d7cbcfe2d73fed4a282f2e5b
CVE: CVE-2017-15729
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/thorsten/phpMyFAQ/commit/867618110feb836e168435548d6c2cbb7c65eda3; https://github.com/thorsten/phpMyFAQ/commit/867618110feb836e168435548d6c2cbb7c65eda3
CVE: CVE-2017-15730
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/thorsten/phpMyFAQ/commit/cce47f94375bb0102ab4f210672231dbb854dd0d; https://www.exploit-db.com/exploits/43064/; https://github.com/thorsten/phpMyFAQ/commit/cce47f94375bb0102ab4f210672231dbb854dd0d
CVE: CVE-2017-15731
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/thorsten/phpMyFAQ/commit/fadb9a70b5f7624a6926b8834d5c6001c210f09c; https://github.com/thorsten/phpMyFAQ/commit/fadb9a70b5f7624a6926b8834d5c6001c210f09c
CVE: CVE-2017-15732
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/thorsten/phpMyFAQ/commit/ec8b3cc37d05b6625e24916b8f7253f830015b5f; https://github.com/thorsten/phpMyFAQ/commit/ec8b3cc37d05b6625e24916b8f7253f830015b5f
CVE: CVE-2017-15733
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/thorsten/phpMyFAQ/commit/ef5a66df4bcfacc7573322af33ce10c30e0bb896; https://github.com/thorsten/phpMyFAQ/commit/ef5a66df4bcfacc7573322af33ce10c30e0bb896
CVE: CVE-2017-15734
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/thorsten/phpMyFAQ/commit/fa26c52384b010edaf60c525ae5b040f05da9f77; https://github.com/thorsten/phpMyFAQ/commit/fa26c52384b010edaf60c525ae5b040f05da9f77
CVE: CVE-2017-15735
Published: 2017-10-22
Description: In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/thorsten/phpMyFAQ/commit/867618110feb836e168435548d6c2cbb7c65eda3; https://github.com/thorsten/phpMyFAQ/commit/867618110feb836e168435548d6c2cbb7c65eda3
CVE: CVE-2017-15736
Published: 2017-10-22
Description: Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://core.spip.net/projects/spip/repository/revisions/23701; https://usn.ubuntu.com/4536-1/; https://www.debian.org/security/2018/dsa-4228
CVE: CVE-2017-11292
Published: 2017-10-22
Description: Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://www.securityfocus.com/bid/101286; http://www.securitytracker.com/id/1039582; https://access.redhat.com/errata/RHSA-2017:2899
CVE: CVE-2017-15790
Published: 2017-10-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-15791
Published: 2017-10-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-15792
Published: 2017-10-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-15793
Published: 2017-10-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-15794
Published: 2017-10-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-15795
Published: 2017-10-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-15796
Published: 2017-10-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none