deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when configuring existing GitHub organization folders. This allowed users with read access to the GitHub organization folder to reconfigure it, including changing the GitHub API endpoint for the organization folder to an attacker-controlled server to obtain the GitHub access token, if the organization folder was initially created using Blue Ocean.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://jenkins.io/security/advisory/2017-08-07/; https://jenkins.io/security/advisory/2017-08-07/
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3981; http://www.securityfocus.com/bid/100267; http://www.securitytracker.com/id/1039132
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://seclists.org/oss-sec/2017/q3/277; http://www.debian.org/security/2017/dsa-3981; http://www.securityfocus.com/bid/100262
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with Credentials Plugin to store passwords securely, and automatically migrates existing passwords.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2017-08-07/; https://jenkins.io/security/advisory/2017-08-07/
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser extensions or cross-site scripting vulnerabilities. The Datadog Plugin now encrypts the API key transmitted to administrators viewing the global configuration form.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100223; https://jenkins.io/security/advisory/2017-08-07/; http://www.securityfocus.com/bid/100223
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://www.debian.org/security/2017/dsa-3963; http://www.securityfocus.com/bid/100290; https://access.redhat.com/errata/RHSA-2017:2489
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.debian.org/security/2017/dsa-3963; http://www.securityfocus.com/bid/100290; https://access.redhat.com/errata/RHSA-2017:2489
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-601
References: http://www.debian.org/security/2017/dsa-3934; http://www.securityfocus.com/bid/100283; http://www.securitytracker.com/id/1039131
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://doc.akka.io/docs/akka-http/10.0.6/security/2017-05-03-illegal-media-range-in-accept-header-causes-stackoverflowerror.html; https://doc.akka.io/docs/akka-http/10.0.6/security/2017-05-03-illegal-media-range-in-accept-header-causes-stackoverflowerror.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://octobercms.com/support/article/rn-8; http://packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html; http://octobercms.com/support/article/rn-8
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: [ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://tech.mantz-it.com/2016/12/sql-injection-in-frappe-framework.html; http://tech.mantz-it.com/2016/12/sql-injection-in-frappe-framework.html
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-05
Description: Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/101010; http://www.securitytracker.com/id/1039434; https://access.redhat.com/errata/RHSA-2017:2793
CVE: CVE-2017-12728
Published: 2017-10-05
Description: An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Authenticated, non-administrative local users are able to alter service executables with escalated privileges, which could allow an attacker to execute arbitrary code under the context of the current system services.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: http://www.securityfocus.com/bid/100668; https://ics-cert.us-cert.gov/advisories/ICSA-17-250-01; http://www.securityfocus.com/bid/100668
CVE: CVE-2017-13993
Published: 2017-10-05
Description: An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior versions. An uncontrolled search path element vulnerability has been identified which could be exploited by placing a specially crafted DLL file in the search path. If the malicious DLL is loaded prior to the valid DLL, an attacker could execute arbitrary code on the system. This vulnerability does not affect the connected blood glucose monitor and would not impact delivery of therapy to the patient.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-427
References: http://www.securityfocus.com/bid/100659; https://ics-cert.us-cert.gov/advisories/ICSMA-17-250-01; http://www.securityfocus.com/bid/100659
CVE: CVE-2017-13995
Published: 2017-10-05
Description: An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/100951; https://ics-cert.us-cert.gov/advisories/ICSA-17-264-04; http://www.securityfocus.com/bid/100951
CVE: CVE-2017-14000
Published: 2017-10-05
Description: An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access the application without authenticating.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/100953; https://ics-cert.us-cert.gov/advisories/ICSA-17-264-02; http://www.securityfocus.com/bid/100953
CVE: CVE-2017-15015
Published: 2017-10-05
Description: ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/ImageMagick/ImageMagick/issues/724; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE: CVE-2017-15016
Published: 2017-10-05
Description: ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/ImageMagick/ImageMagick/issues/725; https://usn.ubuntu.com/3681-1/; https://github.com/ImageMagick/ImageMagick/issues/725
CVE: CVE-2017-15017
Published: 2017-10-05
Description: ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/ImageMagick/ImageMagick/issues/723; https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE: CVE-2017-15018
Published: 2017-10-05
Description: LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://sourceforge.net/p/lame/bugs/480/; https://sourceforge.net/p/lame/bugs/480/
CVE: CVE-2017-15019
Published: 2017-10-05
Description: LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://sourceforge.net/p/lame/bugs/477/; https://sourceforge.net/p/lame/bugs/477/
CVE: CVE-2017-15020
Published: 2017-10-05
Description: dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-parse_die-dwarf1-c/; https://sourceware.org/bugzilla/show_bug.cgi?id=22202; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=1da5c9a485f3dcac4c45e96ef4b7dae5948314b5
CVE: CVE-2017-15021
Published: 2017-10-05
Description: bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfd_getl32.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-bfd_getl32-opncls-c/; https://sourceware.org/bugzilla/show_bug.cgi?id=22197; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=52b36c51e5bf6d7600fdc6ba115b170b0e78e31d
CVE: CVE-2017-15022
Published: 2017-10-05
Description: dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allows remote attackers to cause a denial of service (bfd_hash_hash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scan_unit_for_symbols and parse_comp_unit.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-bfd_hash_hash-hash-c/; https://sourceware.org/bugzilla/show_bug.cgi?id=22201; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=11855d8a1f11b102a702ab76e95b22082cccf2f8
CVE: CVE-2017-15023
Published: 2017-10-05
Description: read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/101611; https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-concat_filename-dwarf2-c/; https://security.gentoo.org/glsa/201801-01
CVE: CVE-2017-15024
Published: 2017-10-05
Description: find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://blogs.gentoo.org/ago/2017/10/03/binutils-infinite-loop-in-find_abstract_instance_name-dwarf2-c/; https://sourceware.org/bugzilla/show_bug.cgi?id=22187; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=52a93b95ec0771c97e26f0bb28630a271a667bd2
CVE: CVE-2017-15025
Published: 2017-10-05
Description: decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted ELF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://blogs.gentoo.org/ago/2017/10/03/binutils-divide-by-zero-in-decode_line_info-dwarf2-c/; https://sourceware.org/bugzilla/show_bug.cgi?id=22186; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d8010d3e75ec7194a[PII_REDACTED]b27486b742d48
CVE: CVE-2017-9628
Published: 2017-10-05
Description: An Information Exposure issue was discovered in Saia Burgess Controls PCD Controllers with PCD firmware versions prior to 1.28.16 or 1.24.69. In certain circumstances, the device pads Ethernet frames with memory contents.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/100949; https://ics-cert.us-cert.gov/advisories/ICSA-17-234-05; http://www.securityfocus.com/bid/100949
CVE: CVE-2017-12244
Published: 2017-10-05
Description: A vulnerability in the detection engine parsing of IPv6 packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause high CPU utilization or to cause a denial of service (DoS) condition because the Snort process restarts unexpectedly. The vulnerability is due to improper input validation of the fields in the IPv6 extension header packet. An attacker could exploit this vulnerability by sending a malicious IPv6 packet to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped. This vulnerability is specific to IPv6 traffic only. This vulnerability affects Cisco Firepower System Software Releases 6.0 and later when the software has one or more file action policies configured and is running on any of the following Cisco products: 3000 Series Industrial Security Appliances (ISR), Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services, Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls, Advanced Malware Protection (AMP) for Networks, 7000 Series Appliances, Advanced Malware Protection (AMP) for Networks, 8000 Series Appliances, FirePOWER 7000 Series Appliances, FirePOWER 8000 Series Appliances, Firepower Threat Defense for Integrated Services Routers (ISRs), Firepower 2100 Series Security Appliances, Firepower 4100 Series Security Appliances, Firepower 9300 Series Security Appliances, Virtual Next-Generation Intrusion Prevention System (NGIPSv) for VMware. Cisco Bug IDs: CSCvd34776.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/101119; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-fpsnort; http://www.securityfocus.com/bid/101119
CVE: CVE-2017-12245
Published: 2017-10-05
Description: A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause depletion of system memory, aka a Firepower Detection Engine SSL Decryption Memory Consumption Denial of Service vulnerability. If this memory leak persists over time, a denial of service (DoS) condition could develop because traffic can cease to be forwarded through the device. The vulnerability is due to an error in how the Firepower Detection Snort Engine handles SSL traffic decryption and notifications to and from the Adaptive Security Appliance (ASA) handler. An attacker could exploit this vulnerability by sending a steady stream of malicious Secure Sockets Layer (SSL) traffic through the device. An exploit could allow the attacker to cause a DoS condition when the device runs low on system memory. This vulnerability affects Cisco Firepower Threat Defense (FTD) Software Releases 6.0.1 and later, running on any of the following Cisco products: Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls, Firepower 2100 Series Security Appliances, Firepower 4100 Series Security Appliances, Firepower 9300 Series Security Appliances. Cisco Bug IDs: CSCve02069.
CVSS Score: 8.6 (HIGH)
CWE: CWE-399, CWE-772
References: http://www.securityfocus.com/bid/101118; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-ftd; http://www.securityfocus.com/bid/101118
CVE: CVE-2017-12246
Published: 2017-10-05
Description: A vulnerability in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of the HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to the local IP address of an affected device. A successful exploit could allow the attacker to cause the affected device to reload. This vulnerability affects Cisco Adaptive Security Appliance (ASA) Software that is running on the following Cisco products: ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, ISA 3000 Industrial Security Appliance. Cisco Bug IDs: CSCvd59063.
CVSS Score: 8.6 (HIGH)
CWE: CWE-399, CWE-20
References: http://www.securityfocus.com/bid/101165; http://www.securitytracker.com/id/1039503; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-asa
CVE: CVE-2017-12256
Published: 2017-10-05
Description: A vulnerability in the Akamai Connect feature of Cisco Wide Area Application Services (WAAS) Appliances could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition on an affected device. The vulnerability is due to certain file-handling inefficiencies of the affected system. An attacker could exploit this vulnerability by directing client systems to access a corrupted file that the client systems cannot decompress correctly. A successful exploit could allow the attacker to cause the affected device to crash or hang unexpectedly and result in a DoS condition that may require manual intervention to regain normal operating conditions. Cisco Bug IDs: CSCve82472.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/101180; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-waas; http://www.securityfocus.com/bid/101180
CVE: CVE-2017-12257
Published: 2017-10-05
Description: A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve96608.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/101167; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-wms; http://www.securityfocus.com/bid/101167
CVE: CVE-2017-12258
Published: 2017-10-05
Description: A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. The vulnerability exists because the affected software does not provide sufficient protections for HTML inline frames (iframes). An attacker could exploit this vulnerability by directing a user of the affected software to an attacker-controlled web page that contains a malicious HTML inline frame. A successful exploit could allow the attacker to conduct click-jacking or other types of client-side browser attacks. Cisco Bug IDs: CSCve60993.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-59, CWE-79
References: http://www.securityfocus.com/bid/101172; http://www.securitytracker.com/id/1039505; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-ucm