deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-1606
Published: 2017-12-11
Description: IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 132926.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.ibm.com/support/docview.wss?uid=swg22011179; http://www.securityfocus.com/bid/102049; https://exchange.xforce.ibmcloud.com/vulnerabilities/132926
CVE: CVE-2017-1613
Published: 2017-12-11
Description: IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to non-sensitive Engagement Center template data. IBM X-Force ID: 132954.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22010690; http://www.securityfocus.com/bid/102051; https://exchange.xforce.ibmcloud.com/vulnerabilities/132954
CVE: CVE-2017-1632
Published: 2017-12-11
Description: IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133178.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22010549; http://www.securityfocus.com/bid/102191; https://exchange.xforce.ibmcloud.com/vulnerabilities/133178
CVE: CVE-2017-1683
Published: 2017-12-11
Description: IBM Connections Engagement Center 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134005.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22010690; http://www.securityfocus.com/bid/102051; https://exchange.xforce.ibmcloud.com/vulnerabilities/134005
CVE: CVE-2017-1760
Published: 2017-12-11
Description: IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose some sensitive information. IBM X-Force ID: 126454.
CVSS Score: 7.1 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22005392; https://exchange.xforce.ibmcloud.com/vulnerabilities/126454; http://www.ibm.com/support/docview.wss?uid=swg22005392
CVE: CVE-2017-8865
Published: 2017-12-11
Description: Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an attacker on the network to replay VoIP traffic between a Dino device and remote server to any other Dino device.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://dl.acm.org/citation.cfm?id=3139947; https://dl.acm.org/citation.cfm?id=3139947
CVE: CVE-2017-8866
Published: 2017-12-11
Description: Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a different Dino device to decrypt VoIP traffic between a child's Dino and remote server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://dl.acm.org/citation.cfm?id=3139947; https://dl.acm.org/citation.cfm?id=3139947
CVE: CVE-2017-8867
Published: 2017-12-11
Description: Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the device and remote server, allowing a malicious user to map encrypted traffic to a particular AES key index and gaining further access to eavesdrop on privacy-sensitive voice communication of a child and their Dino device.
CVSS Score: 5.9 (MEDIUM)
References: https://dl.acm.org/citation.cfm?id=3139947; https://dl.acm.org/citation.cfm?id=3139947
CVE: CVE-2017-2886
Published: 2017-12-11
Description: A memory corruption vulnerability exists in the .PSD parsing functionality of ACDSee Ultimate 10.0.0.292. A specially crafted .PSD file can cause an out of bounds write vulnerability resulting in potential code execution. An attacker can send a specific .PSD file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/102133; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0393; http://www.securityfocus.com/bid/102133
CVE: CVE-2017-17553
Published: 2017-12-12
Description: The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2017-002.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2017-002.md
CVE: CVE-2017-17554
Published: 2017-12-12
Description: A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio 0.4.6, which may lead to DoS when playing a crafted audio file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference%28DoS%29%20Vulnerability%20was%20found%20in%20function%20%20aubio_source_avcodec_readframe%20of%20aubio.md; https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference%28DoS%29%20Vulnerability%20was%20found%20in%20function%20%20aubio_source_avcodec_readframe%20of%20aubio.md
CVE: CVE-2017-17555
Published: 2017-12-12
Description: The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html; https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference%28DoS%29%20Vulnerability%20was%20found%20in%20function%20swri_audio_convert%20of%20ffmpeg%20libswresample.md; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html
CVE: CVE-2017-16678
Published: 2017-12-12
Description: Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-918
References: http://www.securityfocus.com/bid/102149; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2457562
CVE: CVE-2017-16679
Published: 2017-12-12
Description: URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52, that allows an attacker to redirect users to a malicious site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/102157; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2520995
CVE: CVE-2017-16680
Published: 2017-12-12
Description: Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are missing user input validation which could allow unprivileged attackers to forge audit log lines. Hence the interpretation of audit log files could be hindered or misdirected. 2) User Account and Authentication writes audit logs into syslog and additionally writes the same audit entries into a log file. Entries in the log file miss escaping. Hence the interpretation of audit log files could be hindered or misdirected, while the entries in syslog are correct.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://www.securityfocus.com/bid/102138; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2522510
CVE: CVE-2017-16681
Published: 2017-12-12
Description: Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as user controlled inputs are not sufficiently encoded.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102142; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2523913
CVE: CVE-2017-16682
Published: 2017-12-12
Description: SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/102143; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2526781
CVE: CVE-2017-16683
Published: 2017-12-12
Description: Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a service.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/102146; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2531656
CVE: CVE-2017-16684
Published: 2017-12-12
Description: SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that require user identity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/102147; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2537152
CVE: CVE-2017-16685
Published: 2017-12-12
Description: Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insufficient encoding of user controlled inputs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102148; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2537545
CVE: CVE-2017-16687
Published: 2017-12-12
Description: The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 and 2.00, can be misused to enumerate valid and invalid user accounts. An unauthenticated user could use the error messages to determine if a given username is valid.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102152; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2549983
CVE: CVE-2017-16689
Published: 2017-12-12
Description: A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established to a different client or a different user on the same system, although no explicit Trusted/Trusting Relation to the same system has been defined.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/102144; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2449757
CVE: CVE-2017-16690
Published: 2017-12-12
Description: A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It is possible that SAPSetup / NwSapSetup.exe loads system DLLs like DWMAPI.dll (located in your Syswow64 / System32 folder) from the folder the executable is in and not from the system location. The desired behavior is that system dlls are only loaded from the system folders. If a dll with the same name as the system dll is located in the same folder as the executable, this dll is loaded and code is executed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/102145; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2529480
CVE: CVE-2017-16691
Published: 2017-12-12
Description: SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101822; https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/; https://launchpad.support.sap.com/#/notes/2546220
CVE: CVE-2017-17558
Published: 2017-12-12
Description: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html; http://openwall.com/lists/oss-security/2017/12/12/7; https://access.redhat.com/errata/RHSA-2018:0676
CVE: CVE-2017-17560
Published: 2017-12-12
Description: An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://download.exploitee.rs/file/generic/Exploiteers-DEFCON25.pdf; https://github.com/rapid7/metasploit-framework/pull/9248; https://www.exploit-db.com/exploits/43356/
CVE: CVE-2017-17561
Published: 2017-12-12
Description: SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.
CVSS Score: 7.2 (HIGH)
References: http://www.jianshu.com/p/35af80b97ee6; https://gist.github.com/WangYihang/9507e2efdceb67a5bc2761200f19f213; http://www.jianshu.com/p/35af80b97ee6
CVE: CVE-2017-17562
Published: 2017-12-12
Description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
CVSS Score: 8.1 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securitytracker.com/id/1040702; https://github.com/elttam/advisories/tree/master/CVE-2017-17562
CVE: CVE-2017-12155
Published: 2017-12-12
Description: A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-306
References: https://access.redhat.com/errata/RHSA-2018:0602; https://access.redhat.com/errata/RHSA-2018:1593; https://access.redhat.com/errata/RHSA-2018:1627
CVE: CVE-2017-5717
Published: 2017-12-12
Description: Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileges via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00095&languageid=en-fr; https://www.exploit-db.com/exploits/43373/; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00095&languageid=en-fr
CVE: CVE-2[PII_REDACTED]
Published: 2017-12-12
Description: The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: http://erlang.org/pipermail/erlang-questions/2017-November/094255.html; http://erlang.org/pipermail/erlang-questions/2017-November/094256.html; http://erlang.org/pipermail/erlang-questions/2017-November/094257.html
CVE: CVE-2017-11885
Published: 2017-12-12
Description: Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow a remote code execution vulnerability due to the way the Routing and Remote Access service handles requests, aka "Windows RRAS Service Remote Code Execution Vulnerability".
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102055; http://www.securitytracker.com/id/1039987; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11885
CVE: CVE-2017-11886
Published: 2017-12-12
Description: Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to how Internet Explorer handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102062; http://www.securitytracker.com/id/1039991; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11886
CVE: CVE-2017-11887
Published: 2017-12-12
Description: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how Internet Explorer handle objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11906 and CVE-2017-11919.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102063; http://www.securitytracker.com/id/1039993; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11887
CVE: CVE-2017-11888
Published: 2017-12-12
Description: Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how Microsoft Edge handles objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability".
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102065; http://www.securitytracker.com/id/1039990; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11888
CVE: CVE-2017-11889
Published: 2017-12-12
Description: ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102080; http://www.securitytracker.com/id/1039990; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11889
CVE: CVE-2017-11890
Published: 2017-12-12
Description: Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to how Internet Explorer handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102082; http://www.securitytracker.com/id/1039991; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11890
CVE: CVE-2017-11893
Published: 2017-12-12
Description: ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102081; http://www.securitytracker.com/id/1039990; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11893